When you look over the Republican field of candidates in the governor’s race, two names stand out as frontrunners: Lt. Gov. Casey Cagle and Secretary of State Brian Kemp.

They are familiar names with voters due to their service in elected office—Cagle and Kemp both served in the state Senate before moving up to their current jobs, with Kemp representing Athens. They also know what it takes to run and win a statewide campaign. Cagle has done it three times, Kemp twice.

In a battle between Kemp and Cagle for the Republican nomination, Kemp may be giving his opponent the advantage, because the secretary of state has already made several unforced errors.

First, there was the massive data breach in the fall of 2015, when Kemp’s office erroneously distributed sensitive personal data about each of the state’s registered voters, including their Social Security and driver’s license numbers. Kemp ultimately found a scapegoat for the mess and fired one of his employees, but not before he was hit by a class-action lawsuit in Fulton County Superior Court. He ultimately was compelled to offer free credit monitoring and identity theft restoration services for the 6.2 million registered voters who were potentially affected by the breach.

More recently, Kemp was named in a pair of civil lawsuits alleging that he and other investors in a food processing company called Hart AgStrong had failed to repay more than $700,000 in loans after agreeing to personally pay back the loans. Kemp said in a statement that he was just one of “many” investors in the Hart AgStrong business.

Kemp has also put himself in the line of fire because of another decision involving personal information about the state’s registered voters.

President Donald Trump created a “Presidential Advisory Commission on Election Integrity” to investigate his unproved allegations that “millions” of people illegally voted for Hillary Clinton in the last presidential election. The commission asked election officials in the 50 states to give it personal data about all of their registered voters, including the last four digits of each voter’s Social Security number, their party registration, their criminal record, if applicable, and their voting history.

According to media reports, more than 40 states have refused to comply, either fully or partially, with the data request from Trump’s federal commission. Kemp readily agreed to give voter data to the Trump commission, although he said he would not pass along driver's license numbers, Social Security numbers, birth dates, phone numbers, or email addresses.

“Through a simple request, any individual can get a copy of the statewide voter file after paying $250,” Kemp said. “During the last 18 months alone, over 600 groups have taken advantage of this service provided by our office.”

Kemp’s problem here is that he is showing his allegiance to Trump, who is a very polarizing figure in national politics. He is also handing over personal information about voters to the federal government, which likely won’t please libertarian-minded Republicans.

None of these controversies are necessarily fatal. I don’t think there was anything venal about Kemp’s actions, and it could be that the civil lawsuits are resolved without anyone having to show up in court. Each of these events generated media headlines, however.  You can bet those headlines will come back and figure prominently in attack ads aimed at Kemp during the Republican primary. If Kemp is able to win the GOP nomination, he’ll have to face the negative attacks all over again in the general election.

As we saw in the recent 6th Congressional District election, attack ads can knock the stuffing out of a campaign. Just ask Jon Ossoff.

Kemp may already be shooting himself in the foot, and we’ve still got months to go before voters make their primary election choice.