In Georgia, the release by Secretary of State Brian Kemp’s office of the addresses, dates of birth and Social Security and driver’s license numbers of the state’s more than 6.1 million registered voters is more than water cooler talk. Geogians from Ringgold to Valdosta and everywhere in between are upset, and two people have already filed a class-action lawsuit against the state.
So do they have a case? Drew’s informative and engaging analysis addresses that question in Friday’s Fulton County Daily Report. While the release of the personally identifiable information appears to be a violation of Georgia’s 8-year-old Personal Identity Protection Act, the plaintiffs’ recourse appears limited. Drew notes that they don’t seek damages in the lawsuit. He also points out that, unlike other states’ data breach notification laws, Georgia’s statute doesn’t expressly create a private right of action or include statutory penalties. And had plaintiffs sought damages, Drew adds, it probably would have triggered a sovereign immunity fight.
Click here to read the column.