I know nothing about GA law (CA is more than enough), but the CA equivalent is probably Civil Code ยง1798.81:
"A business shall take all resonable steps to destroy, or arrange for destruction of a customer's records within its custody or control containing personal information which is no longer to be retained by the business by (1) shredding, (2) erasing, or (3) otherwise modifying the personal information in those records to make it unreadable or undecipherable by any means."
_________________________
Al Miller, CRCM
Opinions expressed are my own and not necessarily shared by my employer.