Commentary Addressing Risks and Opportunities Through the Lifecycle of Data, Technology, Advertising and Innovation

Data Counsel

Home | Data Counsel

The Georgia Senate voted to pass the Georgia Consumer Privacy Protection Act (<a href="https://www.legis.ga.gov/legislation/66835">SB 473</a>) on Feb. 27th. Although the bill is similar to many other comprehensive state privacy laws, there are some notable distinctions.

core/paragraph

The law would apply to entities that conduct business in Georgia, exceed $25 million in revenue and either (1) process the personal information of at least 175,000 Georgia consumers or (2) control or process the personal information of at least 25,000 Georgia consumers and derive more than 50 percent of their gross revenue from the sale of personal information. The law would also provide exemptions similar to those of other comprehensive state privacy laws, including exemptions for nonprofit organizations and entity- and data-level exemptions for institutions that comply with the Gramm-Leach-Bliley Act and the Heath Information Portability and Accountability Act. Unlike the California Consumer Privacy Act, the definition of “consumer” does not include individuals acting in a commercial or employment context such as job applicants, employees, independent contractors or commercial business-to-business entities.

The law would provide consumers with rights similar to those provided by other comprehensive privacy laws, including the right to access, delete and correct information; the right to obtain a copy of the consumer’s personal information in a portable format; and the right to opt out of sales, targeted advertising and profiling. Additionally, covered entities would be required to obtain consent prior to processing sensitive data such as race, ethnic origin, sex life or orientation, physical or mental health condition and precise geolocation data.

Covered entities would also be required to provide consumers with a reasonably accessible privacy notice, engage processors pursuant to a written contract, and conduct and document data protection assessments for various processing activities, including targeted advertising, selling of personal information and certain types of profiling.

Covered entities would be able to make an affirmative defense to violations of the law if the covered entity maintains a written privacy program that conforms to National Institute of Standards and Technology or other comparable privacy frameworks. Additionally, the attorney general must provide covered entities with written notice of any violation and an opportunity to cure such violations within 60 days prior to initiating any action. Although there isn’t a private right of action, courts may impose a civil penalty of $7,500 for each violation.

The Georgia General Assembly’s 2024 legislative session is scheduled to conclude at the end of March.

The Peach State Takes a Bite at Privacy Law