Cybersecurity compliance for regulated firms in Georgia

Three parts

What a complete answer covers in Georgia

In Georgia, different licenses are overseen by different regulators. Where a rule below applies to one kind of firm, the text says so.

• The federal minimum. The FTC Safeguards Rule (16 CFR 314) treats a wide range of nonbank businesses as financial institutions, including mortgage lenders and servicers, consumer finance companies, tax preparers, collection firms, title and settlement agents, money services businesses, and dealers that arrange financing. A firm within its reach must keep a written security program, appoint a qualified individual to run it, and report to its board each year. Insurance producers and investment advisers fall outside the FTC's jurisdiction and answer to their own regulators, and banks and credit unions answer to their prudential regulators under the interagency information-security guidelines. Which side of that line a firm falls on depends on what it does and who supervises it.
• What a license adds in Georgia. Conditions attach to whatever a firm is licensed or registered to do, and they differ widely from one type of license to another. Mortgage is the area where most of our work lies, and in Georgia mortgage licensing is overseen by the Georgia Department of Banking and Finance. Ga. Comp. R. & Regs. 80-11-1-.08 requires every Georgia mortgage licensee to create and maintain an information security program that meets the FTC Safeguards Rule (16 C.F.R. Part 314), and the Department of Banking and Finance reviews the program, risk assessment and incident response plan during examinations. A companion rule, 80-11-1-.07, requires a copy of any breach notice a licensee sends under federal or state law to go to the Department at the same time. Other licenses are overseen by other regulators and carry conditions of their own.
• What Georgia law says about protecting data. Georgia's only general data-security statute is a disposal law. Businesses must shred, erase or otherwise make personal information unreadable before discarding customer records (O.C.G.A. §10-15-2). The law expressly excludes banks and financial institutions already subject to GLBA's privacy and security provisions, which are covered by federal safeguards duties instead.
• Your counterparties' requirements. Investors, warehouse lenders, carriers, underwriters and institutional clients send questionnaires of their own, and their reviews decide whether a relationship continues. Add the laws of each state where your customers live, and that is the list a firm has to answer. Our assessment begins by producing it, matched to your firm and with each source cited.

Also relevant in Georgia: Georgia's general breach statute reaches only 'information brokers' and government 'data collectors'. Servicers still have notice duties: Department rules require a mortgage licensee that sends breach notices under any federal or state law to deliver a copy to the Department of Banking and Finance at the same time (Ga. Comp. R. & Regs. 80-11-1-.07).

General information, not legal advice. Which of these requirements reach your firm depends on its circumstances. The assessment answers that question and names the source of each finding.