Ask Reggi Your Question Now

Reggi is the free generative AI assistance for regulatory compliance
Ask a Question

Can I skip obtaining consent to sell personal information in Georgia? What are the requirements?

To sell personal information in Georgia, you must obtain consent from the individuals whose information you wish to sell. The Georgia Code states that it is unlawful for any person, firm, or corporation engaged in the business of selling any type of merchandise in the State of Georgia to promise a consideration, either cash or otherwise, to a buyer of such merchandise for providing the names or other information relative to other prospective purchasers of such merchandise, unless the promise of such consideration is contained in the contract of sale between the seller and the buyer [5.1]. Additionally, all licensees must create and maintain an information security program to safeguard the nonpublic personal information of customers to the extent required by 16 C.F.R. Part 314 (the “Safeguards Rule”) [1.2][2.2]. If a licensee provides notice under applicable federal or state law of an information security incident involving unauthorized access to personal information, then the licensee shall simultaneously provide a duplicate of such disclosure to the Department [2.1]. Pursuant to O.C.G.A. § 10-1-912, a business that satisfies the definition of an information broker is required to provide notice to Georgia residents in the event of a data breach that results in access or likely access to unencrypted personal information [2.1]. In the event of a breach of a telephone record concerning a Georgia resident, the telecommunications company must provide notice to the Georgia resident immediately following discovery or notification of the breach if such breach is reasonably likely to cause quantifiable harm to the Georgia resident [3.2].

Source(s):
Jurisdiction

Georgia, Georgia