Privacy & Information Security Law Blog

On November 17, 2015, two plaintiffs filed a putative class action alleging that Georgia’s Secretary of State, Brian Kemp, improperly disclosed the Social Security numbers, driver’s license numbers and birth dates of more than 6.1 million Georgia voters. The lawsuit alleges that the Secretary violated Georgia’s Personal Identity Protection Act by disclosing the voters’ personally identifiable information, failing to provide voters notice of the breach and failing to notify consumer reporting agencies.

The plaintiffs allege that a “Voter File” typically is distributed monthly to political parties and members of the media, but includes only certain data elements such as voter names, addresses, race, gender, registration date and last voting date. In October 2015, a different version of the Voter File was allegedly mailed that also disclosed voters’ Social Security numbers, driver’s license numbers and birth dates.

In public statements, Secretary Kemp has taken responsibility for the mailings. The Secretary has terminated the employee responsible for what is being called a “clerical error,” and claims that all of the discs containing the files have been retrieved or destroyed. The Secretary’s office also has “verified with the media outlets and political parties that they have not copied or otherwise disseminated confidential data.”