{"id":13212,"date":"2015-11-25T14:59:00","date_gmt":"2015-11-25T14:59:00","guid":{"rendered":"http:\/\/statescoop.scpnewsgrp.com\/data-breach-class-action-lawsuit-prompt-georgia-it-policy-review-3\/"},"modified":"2021-09-03T14:04:54","modified_gmt":"2021-09-03T18:04:54","slug":"data-breach-class-action-lawsuit-prompt-georgia-it-policy-review-3","status":"publish","type":"post","link":"https:\/\/statescoop.com\/data-breach-class-action-lawsuit-prompt-georgia-it-policy-review-3\/","title":{"rendered":"Data breach, class action lawsuit prompt Georgia IT policy review"},"content":{"rendered":"

Georgia is scrambling to review its IT policies as it faces a class action lawsuit over the mistaken release of voters’ personal information.<\/p>\n

On Nov. 20, Secretary of State Brian Kemp laid out a series of steps that the state is taking in the wake of the breach, announcing in a statement<\/a> that he\u2019s hired consulting firm Ernst & Young to perform an audit of Georgia\u2019s IT practices and that he\u2019s implemented \u201cstrict new rules\u201d governing the security of voter information.<\/p>\n

According to Kemp, a \u201cclerical error\u201d by an IT employee led to the inadvertent inclusion of personally identifiable information, including Social Security numbers, of millions of people\u00a0on\u00a0a statewide voter list. On Oct. 13, that information was then burned onto 12 discs and mailed to media organizations and statewide political parties as part of their agreements with the state to access demographic voter information.<\/p>\n

Kemp said his office discovered the error on Nov. 13, but the breach didn\u2019t come to light until two Georgia women filed suit<\/a> against Kemp in Fulton County Superior Court on Nov. 17.<\/p>\n

The complaint alleges that Kemp violated Georgia law by failing to notify people affected by the breach, and asks the court to order the state to provide full notification and \u201cequitable relief to prevent future disclosures of personal or private information.\u201d The suit also claims that the roughly 6.2 million voters affected are eligible for inclusion as plaintiffs.<\/p>\n

Kemp claims that his office ensured the 12 discs were \u201cretrieved or destroyed\u201d by Nov. 19, and he\u2019s confident that the groups that received them never \u201ccopied or otherwise disseminated\u201d the data. He added that the employee who made the critical mistake was fired for \u201cbreaking internal rules\u201d governing the information.<\/p>\n

But as the suit makes its way through the legal process, questions persist over the state\u2019s handling of the case.<\/p>\n

Michael Smith, communications director for the Democratic Party of Georgia, told StateScoop his group was among those to receive a disc containing the information. Since the party lacks the necessary software to analyze the data on the disc, Smith said the mistake slipped past their notice until news broke about the suit.<\/p>\n

Smith also claims that the party didn\u2019t hear from Kemp\u2019s office about the mix-up until Nov. 17, the day the suit was filed. In his statement on the breach, Kemp, a Republican who is seen as a contender for the 2018 gubernatorial race, alleges that state investigators began contacting the groups mailed the discs on the morning of Nov. 16.<\/p>\n

\u201cWe found out because of the lawsuit that was filed, just like the rest of Georgia, and that\u2019s really sad,\u201d Smith said. \u201c[Kemp\u2019s] callous disregard for the safety and well being of voters in Georgia is simply staggering.\u201d<\/p>\n

Representatives from three other groups that received the data \u2014 the Georgia Republican Party, the Libertarian Party of Georgia and the \u201cGeorgia GunOwner\u201d magazine \u2014 did not respond to requests for comment by StateScoop.<\/p>\n

Smith said \u201ca good start\u201d to remedying the issue \u201cwould be to get a new secretary of state\u201d but he\u2019s also hopeful the suit presses Georgia to adopt more secure data practices to prevent future incidents.<\/p>\n

However, John Hutchins, an Atlanta-based attorney with LeClairRyan that focuses on privacy and data security law, feels the suit\u2019s requests for an overhaul of state policies may hit a snag.<\/p>\n

\u201cIt\u2019s hard for me to imagine a court just fashioning its own remedy outside of a regulatory agency requesting it,\u201d Hutchins said.<\/p>\n

Hutchins said a body like Federal Trade Commission could get involved and issue a consent decree calling for \u201ccertain remedial action,\u201d but there\u2019s no sign of that happening just yet.<\/p>\n

Ken Rashbaum, the head of Barton LLP\u2019s privacy and cybersecurity practice, is more optimistic. He said\u00a0the court could find some precedent in civil rights cases, such as the controversial case in Yonkers, New York, when a federal judge ordered the city to revise its plans for building public housing units.<\/p>\n

\u201cA court could conceivably [lay out changes] then order the state to report back to the court on a periodic basis as to how the initiative is going,\u201d Rashbaum said. \u201cWhether the Georgia state court is going to want to get involved in that, I can\u2019t say.\u201d<\/p>\n

But Rashbaum sees other problems in the case. He worries that the claim that the millions of people affected by the breach deserve inclusion as class action plaintiffs is \u201cawfully broad,\u201d and Hutchins added that there are \u201cproblems with class action lawsuits in data breach cases all over the country.\u201d<\/p>\n

Regardless of the success of the suit, Rashbaum said\u00a0this breach could even prompt state lawmakers to get involved.<\/p>\n

\u201cThey\u2019ve got their statutes and they may to revisit them and see if they can be tightened a little bit,\u201d Rashbaum said.<\/p>\n","protected":false},"excerpt":{"rendered":"

The inadvertent release of the personal information of more than 6 million people has resulted in intense scrutiny of the state’s data practices.<\/p>\n","protected":false},"author":95,"featured_media":39356,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"disable_grayscale_images":true,"grayscale_contrast":0,"sponsored_content":false,"display_author_bio":true,"story_type":"","footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[4677,20646,20650],"tags":[4,12,29,30,39,251,4411,5275,16536],"people":[],"special-report":[],"authors":[],"class_list":["post-13212","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-state","category-cybersecurity","category-data-analytics","tag-tech-news","tag-state-local-news","tag-states","tag-georgia","tag-legislation","tag-privacy","tag-secretary-of-state-brian-kemp","tag-data-analytics","tag-cybersecurity"],"yoast_head":"\nData breach, class action lawsuit prompt Georgia IT policy review | StateScoop<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/statescoop.com\/data-breach-class-action-lawsuit-prompt-georgia-it-policy-review-3\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Data breach, class action lawsuit prompt Georgia IT policy review | StateScoop\" \/>\n<meta property=\"og:description\" content=\"The inadvertent release of the personal information of more than 6 million people has resulted in intense scrutiny of the state's data practices.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/statescoop.com\/data-breach-class-action-lawsuit-prompt-georgia-it-policy-review-3\/\" \/>\n<meta property=\"og:site_name\" content=\"StateScoop\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/StateScoop\/\" \/>\n<meta property=\"article:published_time\" content=\"2015-11-25T14:59:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2021-09-03T18:04:54+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2021\/03\/GettyImages-1280385511.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"2309\" \/>\n\t<meta property=\"og:image:height\" content=\"1299\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Alex Koma\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@State_Scoop\" \/>\n<meta name=\"twitter:site\" content=\"@State_Scoop\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/statescoop.com\/data-breach-class-action-lawsuit-prompt-georgia-it-policy-review-3\/\",\"url\":\"https:\/\/statescoop.com\/data-breach-class-action-lawsuit-prompt-georgia-it-policy-review-3\/\",\"name\":\"Data breach, class action lawsuit prompt Georgia IT policy review | StateScoop\",\"isPartOf\":{\"@id\":\"https:\/\/statescoop.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/statescoop.com\/data-breach-class-action-lawsuit-prompt-georgia-it-policy-review-3\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/statescoop.com\/data-breach-class-action-lawsuit-prompt-georgia-it-policy-review-3\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2021\/03\/GettyImages-1280385511.jpg\",\"datePublished\":\"2015-11-25T14:59:00+00:00\",\"dateModified\":\"2021-09-03T18:04:54+00:00\",\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/statescoop.com\/data-breach-class-action-lawsuit-prompt-georgia-it-policy-review-3\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/statescoop.com\/data-breach-class-action-lawsuit-prompt-georgia-it-policy-review-3\/#primaryimage\",\"url\":\"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2021\/03\/GettyImages-1280385511.jpg\",\"contentUrl\":\"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2021\/03\/GettyImages-1280385511.jpg\",\"width\":2309,\"height\":1299},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/statescoop.com\/#website\",\"url\":\"https:\/\/statescoop.com\/\",\"name\":\"StateScoop\",\"description\":\"Latest news and events in state and local government technology\",\"publisher\":{\"@id\":\"https:\/\/statescoop.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/statescoop.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/statescoop.com\/#organization\",\"name\":\"StateScoop\",\"url\":\"https:\/\/statescoop.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/statescoop.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2023\/01\/StateScoop-Black.png\",\"contentUrl\":\"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2023\/01\/StateScoop-Black.png\",\"width\":1470,\"height\":186,\"caption\":\"StateScoop\"},\"image\":{\"@id\":\"https:\/\/statescoop.com\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/StateScoop\/\",\"https:\/\/x.com\/State_Scoop\",\"https:\/\/www.linkedin.com\/company\/statescoop\/\",\"https:\/\/www.youtube.com\/@StateScoop\"]}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Data breach, class action lawsuit prompt Georgia IT policy review | StateScoop","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/statescoop.com\/data-breach-class-action-lawsuit-prompt-georgia-it-policy-review-3\/","og_locale":"en_US","og_type":"article","og_title":"Data breach, class action lawsuit prompt Georgia IT policy review | StateScoop","og_description":"The inadvertent release of the personal information of more than 6 million people has resulted in intense scrutiny of the state's data practices.","og_url":"https:\/\/statescoop.com\/data-breach-class-action-lawsuit-prompt-georgia-it-policy-review-3\/","og_site_name":"StateScoop","article_publisher":"https:\/\/www.facebook.com\/StateScoop\/","article_published_time":"2015-11-25T14:59:00+00:00","article_modified_time":"2021-09-03T18:04:54+00:00","og_image":[{"width":2309,"height":1299,"url":"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2021\/03\/GettyImages-1280385511.jpg","type":"image\/jpeg"}],"author":"Alex Koma","twitter_card":"summary_large_image","twitter_creator":"@State_Scoop","twitter_site":"@State_Scoop","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/statescoop.com\/data-breach-class-action-lawsuit-prompt-georgia-it-policy-review-3\/","url":"https:\/\/statescoop.com\/data-breach-class-action-lawsuit-prompt-georgia-it-policy-review-3\/","name":"Data breach, class action lawsuit prompt Georgia IT policy review | StateScoop","isPartOf":{"@id":"https:\/\/statescoop.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/statescoop.com\/data-breach-class-action-lawsuit-prompt-georgia-it-policy-review-3\/#primaryimage"},"image":{"@id":"https:\/\/statescoop.com\/data-breach-class-action-lawsuit-prompt-georgia-it-policy-review-3\/#primaryimage"},"thumbnailUrl":"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2021\/03\/GettyImages-1280385511.jpg","datePublished":"2015-11-25T14:59:00+00:00","dateModified":"2021-09-03T18:04:54+00:00","inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/statescoop.com\/data-breach-class-action-lawsuit-prompt-georgia-it-policy-review-3\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/statescoop.com\/data-breach-class-action-lawsuit-prompt-georgia-it-policy-review-3\/#primaryimage","url":"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2021\/03\/GettyImages-1280385511.jpg","contentUrl":"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2021\/03\/GettyImages-1280385511.jpg","width":2309,"height":1299},{"@type":"WebSite","@id":"https:\/\/statescoop.com\/#website","url":"https:\/\/statescoop.com\/","name":"StateScoop","description":"Latest news and events in state and local government technology","publisher":{"@id":"https:\/\/statescoop.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/statescoop.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/statescoop.com\/#organization","name":"StateScoop","url":"https:\/\/statescoop.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/statescoop.com\/#\/schema\/logo\/image\/","url":"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2023\/01\/StateScoop-Black.png","contentUrl":"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2023\/01\/StateScoop-Black.png","width":1470,"height":186,"caption":"StateScoop"},"image":{"@id":"https:\/\/statescoop.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/StateScoop\/","https:\/\/x.com\/State_Scoop","https:\/\/www.linkedin.com\/company\/statescoop\/","https:\/\/www.youtube.com\/@StateScoop"]}]}},"parsely":{"version":"1.1.0","canonical_url":"https:\/\/statescoop.com\/data-breach-class-action-lawsuit-prompt-georgia-it-policy-review-3\/","smart_links":{"inbound":0,"outbound":0},"traffic_boost_suggestions_count":0,"meta":{"@context":"https:\/\/schema.org","@type":"NewsArticle","headline":"Data breach, class action lawsuit prompt Georgia IT policy review","url":"http:\/\/statescoop.com\/data-breach-class-action-lawsuit-prompt-georgia-it-policy-review-3\/","mainEntityOfPage":{"@type":"WebPage","@id":"http:\/\/statescoop.com\/data-breach-class-action-lawsuit-prompt-georgia-it-policy-review-3\/"},"thumbnailUrl":"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2021\/03\/GettyImages-1280385511.jpg?w=150&h=150&crop=1","image":{"@type":"ImageObject","url":"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2021\/03\/GettyImages-1280385511.jpg"},"articleSection":"State","author":[{"@type":"Person","name":"Alex Koma","url":"https:\/\/statescoop.com\/author\/alex-koma\/"}],"creator":["Alex Koma"],"publisher":{"@type":"Organization","name":"StateScoop","logo":"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2023\/01\/cropped-ss_favicon.png"},"keywords":["cybersecurity","data analytics","georgia","legislation","privacy","secretary of state brian kemp","state & local news","states","tech news"],"dateCreated":"2015-11-25T14:59:00Z","datePublished":"2015-11-25T14:59:00Z","dateModified":"2021-09-03T18:04:54Z"},"rendered":"<script type=\"application\/ld+json\" class=\"wp-parsely-metadata\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@type\":\"NewsArticle\",\"headline\":\"Data breach, class action lawsuit prompt Georgia IT policy review\",\"url\":\"http:\\\/\\\/statescoop.com\\\/data-breach-class-action-lawsuit-prompt-georgia-it-policy-review-3\\\/\",\"mainEntityOfPage\":{\"@type\":\"WebPage\",\"@id\":\"http:\\\/\\\/statescoop.com\\\/data-breach-class-action-lawsuit-prompt-georgia-it-policy-review-3\\\/\"},\"thumbnailUrl\":\"https:\\\/\\\/statescoop.com\\\/wp-content\\\/uploads\\\/sites\\\/6\\\/2021\\\/03\\\/GettyImages-1280385511.jpg?w=150&h=150&crop=1\",\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/statescoop.com\\\/wp-content\\\/uploads\\\/sites\\\/6\\\/2021\\\/03\\\/GettyImages-1280385511.jpg\"},\"articleSection\":\"State\",\"author\":[{\"@type\":\"Person\",\"name\":\"Alex Koma\",\"url\":\"https:\\\/\\\/statescoop.com\\\/author\\\/alex-koma\\\/\"}],\"creator\":[\"Alex Koma\"],\"publisher\":{\"@type\":\"Organization\",\"name\":\"StateScoop\",\"logo\":\"https:\\\/\\\/statescoop.com\\\/wp-content\\\/uploads\\\/sites\\\/6\\\/2023\\\/01\\\/cropped-ss_favicon.png\"},\"keywords\":[\"cybersecurity\",\"data analytics\",\"georgia\",\"legislation\",\"privacy\",\"secretary of state brian kemp\",\"state & local news\",\"states\",\"tech news\"],\"dateCreated\":\"2015-11-25T14:59:00Z\",\"datePublished\":\"2015-11-25T14:59:00Z\",\"dateModified\":\"2021-09-03T18:04:54Z\"}<\/script>","tracker_url":"https:\/\/cdn.parsely.com\/keys\/statescoop.com\/p.js"},"jetpack_publicize_connections":[],"jetpack_featured_media_url":"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2021\/03\/GettyImages-1280385511.jpg","distributor_meta":false,"distributor_terms":false,"distributor_media":false,"distributor_original_site_name":"StateScoop","distributor_original_site_url":"https:\/\/statescoop.com","push-errors":false,"_links":{"self":[{"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/posts\/13212","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/users\/95"}],"replies":[{"embeddable":true,"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/comments?post=13212"}],"version-history":[{"count":1,"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/posts\/13212\/revisions"}],"predecessor-version":[{"id":43224,"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/posts\/13212\/revisions\/43224"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/media\/39356"}],"wp:attachment":[{"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/media?parent=13212"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/categories?post=13212"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/tags?post=13212"},{"taxonomy":"people","embeddable":true,"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/people?post=13212"},{"taxonomy":"special-report","embeddable":true,"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/special-report?post=13212"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/statescoop.com\/wp-json\/wp\/v2\/authors?post=13212"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}