Collection and processing in Georgia
Data protection principles
As per Article 4 of Data Protection Law, the following principles shall be observed during data processing:
- data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject (lawfulness, fairness and transparency’). The obligation to ensure the transparency of data processing will not apply to the exceptional cases established by the respective Law;
- data shall be collected / obtained for specified, explicit and legitimate purposes. Further processing of data for other purposes that are incompatible with the initial purposes shall be inadmissible (Secondary Purpose);
- data shall be processed only to the extent necessary to achieve the respective legitimate purpose. The data shall be proportionate to the purpose for which they are processed;
- data shall be valid and accurate and, where necessary, kept up to date. Having regard to the purposes of data processing, inaccurate data shall be rectified, erased or destroyed without undue delay;
- data may be stored only for a period which is necessary for achieving the legitimate purpose for which the data are processed. Once the purpose for which the data was processed has been achieved, the data shall be erased, destroyed or stored in a depersonalized form, unless the processing of data is required by law and / or a subordinate normative legal act issued in accordance with law, and the storing of data is a necessary and proportionate measure in a democratic society to safeguard overriding interests;
- to ensure the security of data, technical and organizational measures shall be taken during the processing of data to ensure appropriate security, including protection against unauthorized or unlawful processing, accidental loss, destruction and / or damage.
The controller shall be responsible for, and demonstrate compliance with, the described principles when processing data.
Processing for a further purpose
If data are to be processed for purposes other than those for which they have been collected / obtained (Secondary Purpose), and the processing is not based on the consent of the data subject or on law, the controller shall, in order to decide whether the data were processed for purposes other than those for which they have been collected / obtained, take into account:
- any link between the initial purpose for which the data have been collected / obtained and the intended further purpose;
- the nature of the relationship between the controller and the data subject in the context of collecting / obtaining data;
- whether the data subject has reasonable expectations as to the further processing of data concerning him / her;
- whether special categories of data are processed;
- possible consequences for the data subject that may accompany further data processing;
- the existence of technical and organizational safeguards.
Data collected by a law enforcement agency in the course of its activities may be processed for the purpose of general analysis of criminal activity and to establish the relationship between the various offences detected. The further processing of data by the controller for the purposes of crime prevention (including the conduct of appropriate analytical research), investigation, prosecution, the administration of justice, the enforcement of detention and imprisonment, the execution of non-custodial sentences and probation, ensuring the placement of a person in a temporary detention cell, combating illegal migration, the implementation of international protection, responding to administrative offences, ensuring public and fire safety, the conduct of operative and investigative activities, the safeguarding of public safety and / or the protection of the rule of law (including the conduct of criminological research by a relevant law enforcement body or a court), shall not be considered to be incompatible with initial purposes if the processing of data is required by law, or a law and a subordinate normative act issued on the basis thereof.
Furthermore, the further processing of data for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall not be considered to be incompatible with initial purposes. Long-term storage of data for the purposes referred to herein shall be permitted if appropriate technical and organizational measures are in place to protect the rights of the data subject.
The controller shall be responsible for, and demonstrate compliance with, the described principles when processing data.
Grounds for data processing
Data processing is admissible where one of the following grounds exists:
- the data subject has given consent to the processing of data concerning him / her for one or more specific purposes;
- data processing is necessary for the performance of a contract entered into with the data subject or to enter into a contract at the request of the data subject;
- data processing is provided for by law;
- data processing is necessary for the controller to perform his / her statutory duties;
- according to law, the data are publicly available or the data subject has made them publicly available;
- data processing is necessary to protect the vital interests of the data subject or another person, including to monitor epidemics and / or prevent their spread, or manage humanitarian crises and natural and man-made disasters;
- data processing is necessary to protect substantial public interests;
- data processing is necessary to perform tasks falling within the scope of public interest as defined by the legislation of Georgia, including for the purposes of crime prevention, investigation, prosecution, the administration of justice, the enforcement of detention and imprisonment, the execution of non-custodial sentences and probation, the conduct of operative and investigative activities, the safeguarding of public safety and / or the protection of the rule of law, including information security and cyber security;
- data processing is necessary to protect important legitimate interests pursued by the controller or a third party, unless there is an overriding interest in protecting the rights of the data subject (including a minor);
- data processing is necessary to review an application submitted by the data subject (to provide services to him / her).
The controller has an obligation to justify the legal basis for the processing of data.
Processing of special categories of data
The processing of special categories of data is permitted only if the controller provides safeguards for the rights and interests of the data subject as provided for by the Data Protection Law and if one of the following grounds exists:
- the data subject has given consent to the processing of the special category data for one or more specified purposes;
- the processing of special categories of data is expressly and specifically regulated by law, and their processing is a necessary and proportionate measure in a democratic society;
- the processing of special categories of data is necessary to protect the vital interests of the data subject or another person and the data subject is physically or legally incapable of giving consent to the processing of special categories of data;
- the processing of special categories of data is necessary in the area of health care for the purposes of preventive, prophylactic, diagnostic, therapeutic, rehabilitative and palliative care, and for the management of services, medical equipment and the quality and safety of products, public health and the health care system, in accordance with the legislation of Georgia or a contract with a health professional (if these data are processed by a person who has an obligation to protect professional secrets);
- the processing of special categories of data is necessary for the purposes of performing the statutory duties of the controller or exercising the specific rights of the data subject in the field of social security and social protection, including for the management of the social security system and services;
- the processing of special categories of data is necessary for the purposes of crime prevention (including the conduct of appropriate analytical research), investigation, prosecution, the administration of justice, the enforcement of detention and imprisonment, the execution of non-custodial sentences and probation, ensuring the placement of a person in a temporary detention cell, combating illegal migration, the implementation of international protection, responding to administrative offences, ensuring public and fire safety, the conduct of operative and investigative activities, the safeguarding of public safety and / or the protection of the rule of law (including the conduct of criminological research by a relevant law enforcement body or a court), and the processing of such data is required by law, or a law and a subordinate normative act issued on the basis thereof;
- special categories of data are processed to ensure information security and cyber security;
- the processing of special categories of data is necessary because of the nature of labor obligations and relations, including for making decisions on employment and assessing the working capacity of the employee;
- the data subject has made his / her data publicly available without an explicit prohibition of their use;
- the processing of special categories of data is necessary to protect substantial public interests;
- special categories of data are processed by political or professional associations, and organizations with religious or non-religious philosophical aims, for their legitimate activities. In this case, the processing of such data may relate solely to the members or former members of this association / organization or persons who have regular contact with this association / organization in connection with its purposes, on condition that these data are not disclosed to a third party without the consent of the data subjects;
- the processing of special categories of data is necessary for archiving purposes in the public interest as provided for by law, for scientific or historical research purposes or statistical purposes if the law provides for the implementation of appropriate and specific measures to protect the rights and interests of the data subject. This ground for the processing of special categories data shall not apply if a special law expressly provides for the restriction of the processing of such data under additional and different conditions;
- special categories of data are processed for the purpose of the functioning of the Unified Migration Analytical System;
- special categories of data are processed for the purposes of exercising the right to education of persons with disabilities and persons with special educational needs;
- special categories of data are processed for the purposes of reviewing the issue within the ambit of the Law of Georgia on the Elimination of Violence against Women and / or Domestic Violence, and the Protection and Support of Victims of Such Violence;
- special categories of data are processed for the purpose of the re-socialization and rehabilitation of convicted persons and former prisoners, and for the coordination of the process of the referral of minors;
- special categories of data are processed for the purposes of issuing and publishing as public information, in accordance with the Organic Law of Georgia on General Courts, a judicial act adopted as a result of open court hearings;
- special categories of data are processed in cases expressly provided for by the Law of Georgia on Public Procurement;
- special categories of data are processed for the functioning of the institutional inter-agency coordination mechanism – for the purposes of identifying and / or managing cases involving harm or anticipated risks to the life, health or safety of the child and / or to the best interests of the child or to his / her rights, and ensuring, within the limits of these purposes, coordination between competent bodies (agencies) as designated by the Government of Georgia in the cases provided for by the Code on the Rights of the Child.
The controller has an obligation to justify the legal basis for the processing of special categories of data.
Specific processing activities
Procedure and conditions for giving consent to the processing of data relating to a minor
The processing of data relating to a minor is permitted on the basis of his / her consent if he / she has attained the age of 16, and the processing of data relating to a minor under the age of 16 is permitted with the consent of his / her parent or other legal representative, except in cases expressly provided for by law, including where the consent of a minor between the ages of 16 and 18 and his / her parent or other legal representative is required for the processing of data.
The controller is obliged to take reasonable and adequate measures to confirm the existence of the consent of the parent or other legal representative of a minor under the age of 16. In addition to that, the processing of special categories of data relating to a minor is permitted only on the basis of the written consent of the minor’s parent or other legal representative, except in cases expressly provided for by law.
When processing data relating to a minor, the controller is obliged to take into account and protect the best interests of the minor. Furthermore, the consent of a minor, his / her parents or other legal representative to the processing of data will not be considered valid if the processing of the data jeopardizes or harms the best interests of the minor.
Protection of data of a deceased person
After a data subject dies, the processing of data concerning him / her is permitted:
- on the grounds specified above (general grounds and grounds for specific categories of data, as above outlined);
- unless the processing of such data has been prohibited by the data subject’s parent, child, grandchild or spouse (except in cases where the data subject has prohibited in writing the processing of data concerning him / her after his / her death);
- if 30 years have passed since the death of the data subject;
- if this is necessary to exercise an inheritance right.
The processing of the name, surname, sex, date of birth and date of death of a deceased person is permitted irrespective of the circumstances and grounds as provided for above.
Processing of biometric data
Biometric data may be processed only if this is necessary for the purposes of carrying out activities, security, protection of property and prevention of the disclosure of secret information, and these purposes cannot be achieved by other means or involve disproportionate effort, as well as for the purposes of issuing an identity document in accordance with law, identifying a person crossing the state border, combating illegal migration, implementation of international protection, crime prevention, investigation, prosecution, administration of justice, the enforcement of detention and imprisonment, the execution of non-custodial sentences and probation, the re-socialization and rehabilitation of convicted persons and former prisoners, the coordination of the process of the referral of minors, the conduct of operative and investigative activities, and ensuring information security and cyber security and in other cases expressly provided for by law.
The controller is obliged, in accordance with the principles provided for by the Law (as stated above), to determine in writing, prior to processing, the purpose and amount of biometric data to be processed, the period of storage of these data, the procedure and conditions for their storage and destruction, and the mechanisms for the protection of the rights of the data subject.
Video monitoring
Video monitoring is permitted for the purposes of crime prevention, crime detection, public safety, the protection of personal safety and property, the protection of minors (including from harmful influence), the protection of secret information, examination / testing, and for the performance of tasks related to public and / or other legitimate interests, provided that the video monitoring is adequate and proportionate to the purpose of data processing.
To carry out video monitoring, the controller is obliged, in accordance with the principles provided for the Law (as outlined above), to determine in writing the purpose and amount of video monitoring, the duration of the video monitoring and the period of storage of the video recording, the procedure and conditions for accessing, storing and destroying the video recording, and the mechanism for the protection of the rights of the data subject, except in cases where a natural person carries out video monitoring in a residential building.
Video monitoring of the work process / area of an employee is only permitted in exceptional cases where the purposes referred to right above cannot be achieved by other means or involve disproportionate effort. Video monitoring is not permitted in changing rooms, hygiene facilities or other places where a data subject has a reasonable expectation of privacy and / or where video monitoring is contrary to generally accepted moral standards.
A video monitoring system and video recordings should be protected from unlawful encroachment and use. The controller shall ensure that any access to the video recordings is recorded, including the time of access and the user name that allow the identification of the person who accessed the video recording.
In a residential building, the video monitoring of a common entrance to a residential building and of a common space in a residential building shall be permitted with the written consent of more than half of the owners (if an owner cannot be identified, the consent of a possessor may be obtained), unless the controller / the processor carries out video monitoring to perform his / her statutory duties and the area of video monitoring includes the common entrance and common space of the residential building. Furthermore, the video monitoring of an entrance to an individual property in a residential building shall be permitted only by a decision of the owner / possessor or with his / her written consent, in such a manner that the video monitoring does not harm the legitimate interests of other persons (including those lawfully using the owner’s property).
The controller / processor should place a warning sign indicating that video monitoring is being carried out in a visible place and also warn the employee in writing of the specific purpose(s) of the video monitoring. Where the respective requirements are met, the data subject shall be deemed to be informed of the processing of data concerning him / her.
A warning sign indicating that video monitoring is being carried out should have an appropriate inscription, a clearly visible image of video monitoring in progress, and the name and contact details of the controller.
Audio monitoring
Audio monitoring is permitted:
- with the consent of the data subject;
- to make a record;
- to protect important legitimate interests pursued by the controller, provided that appropriate and specific measures are in place to safeguard the rights and interests of the data subject;
- in other cases expressly provided for by the legislation of Georgia.
To carry out audio monitoring, the controller is obliged, in accordance with the principles provided for by Law (as outlined above), to determine in writing and in advance, the purpose and amount of audio monitoring, the duration of the audio monitoring, the procedure and conditions for accessing, storing and destroying the audio recording, and the mechanism for the protection of the rights of the data subject.
Also, the controller should warn the data subject, prior to or upon starting audio monitoring, about the carrying out of audio monitoring, and explain to him / her his / her right to object (if any). The burden of proof of informing the data subject lies with the controller / processor.
If the data subject is informed of audio monitoring by means of a warning sign, the warning sign shall have an appropriate inscription, a clearly visible image of audio monitoring in progress, and the name and contact details of the controller.
Communicating with a data subject (privacy notices)
Where data are collected directly from the data subject, the controller is obliged to provide the data subject with at least the following information before or at the beginning of the collection:
- the identity / name and the contact details of the controller, his / her representative and / or the processor (if any);
- the purposes and the legal basis of the processing of the data;
- whether the provision of the data is mandatory, and where the provision of the data is mandatory, the legal consequences of refusal to provide them, as well as the information that the collection / obtaining of the data is required by the legislation of Georgia or is a necessary condition for entering into a contract (if such information exists);
- the important legitimate interests pursued by the controller or of a third party;
- the identity and the contact details of the personal data protection officer (if any);
- the identity of the recipients or categories of recipients of the data (if any);
- the planned transfer of data and the existence of appropriate safeguards for the protection of the data, including authorization to transfer the data (if any) if the controller plans to transfer the data to another state or an international organization;
- the period for which the data will be stored and, if no specific period can be determined, the criteria used to determine that period;
- the right of the data subject as provided for by this chapter.
The provision of the information referred to right above is not mandatory if it is reasonably foreseeable that the data subject already has such information.
The controller is obligated to provide the described information to the data subject, especially if the data subject is a minor, in simple and understandable language. This information may be provided orally or in writing (including electronically), unless the data subject requests the provision of the information in writing.
Where data are not collected directly from the data subject, the collector is obliged to provide the data subject with the information referred to right above (in case data are collected from data subject), as well as information as to which data concerning him / her are being processed, and the source of the data, including whether the data have been obtained from a publicly accessible source. The controller shall provide the data subject with the respective information within a reasonable period, or if the data are used to communicate with the data subject, at the time of the first communication with the data subject, or if the disclosure of the data is envisaged, before the data are disclosed, but not later than 10 working day after obtaining the data.
The obligation to provide the information shall not apply to the controller and / or the processor if: the data subject already has the described information; the collection or disclosure of the data is established by law or required for the performance of statutory duties; the information cannot be provided or involves disproportionate effort, or the fulfilment of the respective obligation would seriously impair or render impossible the achievement of the legitimate purpose(s) of the processing. In such cases, the controller shall take appropriate measures to protect the rights and legitimate interests of the data subject, including by making general information about the collection of data publicly available / publishing general information about the collection of data in an easily accessible form.
Consent reception or / and withdrawal
If a controller plans to obtain written consent from a data subject with a document that also covers other matters, the controller is obliged to formulate the wording of the consent in the document in a clear, simple and understandable language and to separate it from other parts of the document.
If the consent of a data subject is given within the scope of a contract or service, when determining whether or not the consent was given on a voluntary basis, among other circumstances, it shall be assessed whether the consent is a required term of the contract or service, and whether it is possible to receive the relevant service / enter into the relevant contract without such consent.
Before obtaining consent from a data subject, a controller shall ensure that the data subject is informed of his / her right to withdraw the consent.
A controller is obliged to immediately terminate the data processing and delete or destroy the processed data if a data subject withdraws his / her consent, unless otherwise provided for by the Law.
The withdrawal of consent by a data subject shall not lead to the cancellation of legal consequences arising before the withdrawal of the consent and within the scope of the consent.
On the basis of a request of a data subject or in the event that this results in legal, financial or other significant consequences for the data subject, a controller is obliged to provide the data subject, prior to the withdrawal of consent by the data subject, with information on the consequences of the withdrawal of consent.
A controller is obliged to provide a free, simple and accessible mechanism for withdrawing consent, including the possibility of withdrawing consent in the same form in which the consent was given.
In the event of a dispute regarding the existence of a data subject’s consent to data processing, a controller shall bear the burden of proving the fact of the existence of the data subject’s consent.
Rights of data subjects
Right of data subjects to receive information on the processing of data
The data subject shall have the right to obtain from the controller confirmation as to whether or not data concerning him / her are being processed and, if requested by the data subject, the following information free of charge:
- which data concerning him / her are being processed, as well as the grounds for and the purpose of the processing;
- the source from which the data were collected / obtained;
- the period for which the data will be stored and, if no specific period can be determined, the criteria used to determine that period;
- the rights of the data subject as provided for by the Law;
- the legal basis and purposes of the data transfer, as well as the appropriate data protection safeguards if the data are transferred to another state or an international organization;
- the identity of the recipients or the categories of recipients, including information on the ground for and purpose of the transfer, if the data are transferred to a third party;
- the decision made as a result of automated processing, including profiling, and the logic involved in making such a decision, as well as its impact on the processing and the expected results of the processing.
The data subject has the right to receive the information referred to right above not later than 10 working days after the request. This period may, in special cases and upon appropriate justification, be extended by no more than 10 working days, of which the data subject shall be notified immediately.
The controller shall have the right to provide the data subject with any information necessary to ensure transparent processing in accordance with transparency principle, unless the disclosure of the information is contrary to the law. Unless otherwise provided by the legislation of Georgia, the data subject has the right to choose the form of the provision of information described above. In addition, if the data subject does not request the information in another form, the information shall be provided in the same form in which it was requested.
Right to access and to obtain a copy
The data subject shall have the right to access personal data concerning him / her and to obtain copies of such data from the controller free of charge, except in cases where in order to access and / or issue the copies of data:
- a fee is required under the legislation of Georgia;
- a reasonable fee is established by the controller because of the resources spent on issuing them in a form other than the data are stored, and / or frequent requests.
The data subject shall have the right to access the data referred to above and / or to obtain copies thereof not later than 10 working days after the request, unless different time limits are set by the legislation of Georgia. The period may be extended in special cases and upon appropriate justification by no more than 10 working days, of which the data subject shall be notified immediately.
The data subject has the right to access the described data and / or to obtain copies thereof in a form in which they are kept by the controller and / or processor. The data subject shall also have the right to obtain copies of data concerning him / her in another form in return for a reasonable fee established by the controller and where technically feasible.
The fee shall not exceed the amount of resources actually spent by the controller. The burden of establishing a fee and of proving that its amount is reasonable shall lie with the controller.
Right to the rectification, update and completion of data
The data subject shall have the right to request the controller to rectify, update and / or complete erroneous, inaccurate and / or incomplete data concerning him / her. Within not later than 10 working days after the data subject has made such a request, the data shall be rectified, updated and / or completed, or the grounds on which the request was refused shall be notified, and the procedure for appealing against the refusal shall be explained, to the data subject.
If the controller, independently of the data subject, discovers that the data available to him / her are erroneous, inaccurate and / or incomplete, the controller shall rectify, update and / or complete the data within a reasonable period of time and inform the data subject thereof within 10 working days after the rectification of the data. The controller shall not be obliged to inform the data if the rectification, update and / or completion of the data is related to the correction / removal of a technical error. If there are objective circumstances that make it impossible to fulfil the obligation to inform the data subject within the said period, the controller shall inform the data subject of the change made at the time of the first communication to the data subject.
The collector shall inform all the recipients and all respective controllers and processors, to whom the controller transferred the same data, of the update and completion of the data, unless this information cannot be provided due to a large number of controllers / processors or recipients, and / or disproportionately high costs. The persons shall rectify, update and / or complete the data within a reasonable period after receiving the respective information.
Right to the termination of the processing, erasure or destruction of data
The data subject shall have the right to request the controller to terminate the processing of (including profiling), erase or destroy data concerning him / her. Within not later than 10 working days after the data subject has made such a request, the processing of the data shall be terminated, and / or the data shall be erased or destroyed, or the grounds on which the request was refused shall be notified and the procedure for appealing against the refusal shall be explained to the data subject. The controller shall have the right to refuse the request if:
- one of the grounds provided for above exists (general ground and / or ground for special category of data);
- data are processed for the purposes of substantiating a legal claim or a statement of defense;
- the processing of data is necessary for the exercise of the right of freedom of expression or information;
- data are processed for archiving purposes in the public interest as provided for by law, for scientific or historical research purposes or statistical purposes, and the exercise of the right to the termination of the processing, erasure or destruction of the data would render impossible or substantially impair the achievement of the purposes of the processing.
Where any of the described grounds exists, the controller shall have an obligation to justify the respective ground.
Furthermore, the data subject has the right to be informed of the termination of the processing, erasure or destruction of the data once the respective action has been taken, without delay and at the latest within 10 working days, also, where the data concerning him / her are processed in a publicly available form, to also request the controller to restrict access to the data and / or erase copies of or any internet links to the data.
The collector shall inform all the recipients and all respective controllers and processors, to whom the controller transferred the same data, of the termination of the processing, erasure and destruction of the data, unless this information cannot be provided due to a large number of controllers / processors or recipients, and / or disproportionately high costs. The respective persons shall, after the receipt of the respective information, terminate the processing of the data and erase or destroy the data.
Right to the blocking of data
The data subject has the right to request the controller to block data if any of the following circumstances exists:
- the authenticity or accuracy of the data is contested by the data subject;
- the processing of the data is unlawful, although the data subject opposes the erasure of the data and requests their blocking;
- the data are no longer needed for the purposes of the processing, but they are required by the data subject to lodge a complaint / claim;
- the data subject requests the termination of the processing, erasure or destruction of the data and this request is being considered;
- there is a need to retain the data for use as evidence.
The controller is obliged to block the data upon the request of the data subject if one of the circumstances provided for above applies, unless blocking the data could jeopardize one of the following:
- the fulfilment by the controller of the duties assigned to him / her by law and / or a law and a subordinate normative act issued on the basis thereof;
- the performance of tasks falling within the scope of public interest in accordance with law and the exercise by the controller of the powers conferred on him / her under the legislation of Georgia;
- the legitimate interests of the controller or a third party, unless there is an overriding interest in protecting the rights of a data subject, in particular a minor;
- the protection of interests of a data subject or a third party, or for the purposes of the security and defense of the State.
After the decision to block the data has been made, the controller may decide to unblock the data if any of the grounds provided for right above exists.
The data shall be blocked for the period that the reason for blocking them exists, and during this period, if technically feasible, the decision to block the data shall be attached to the relevant data. The data subject has the right to be informed of a decision to block the data or of the grounds for refusing to block the data once the decision has been made, without delay and at the latest within 3 working days after the request. Where data are blocked the data may be processed otherwise than by storage in the following cases:
- with the consent of the data subject;
- to substantiate a legal claim or a statement of defense;
- to protect the interests of the controller or a third party;
- to protect public interests in accordance with law.
Right to the transmission of data (data portability)
In the case of the automated processing of data on the grounds provided for by Article 5(1)(a) and (b) (Consent and / or Fulfillment of the Contractual Obligation) and Article 6(1)(a) (Consent) of the Data Protection Law, if technically feasible, the data subject shall have the right to receive from the controller data concerning him / her which he / she has provided to the controller in a structured, commonly used and machine-readable format, or to require that the data be transmitted to another controller.
Automated individual decision-making and related rights
The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal or other similarly significant effects concerning him / her, except where a decision based on profiling is:
- based on the data subject’s explicit consent;
- necessary for entering into, or performing, a contract between the data subject and a controller;
- provided for by law or by a subordinate normative act issued within the powers delegated on the basis of the law.
Where there is a respective request from the data subject, the controller shall take appropriate measures to safeguard the data subject’s rights and freedoms and legitimate interests, including by involving human resources in the decision-making and by giving the right to the data subject to express his / her point of view and to contest the decision.
The use of special categories of data in the decision-making shall be permitted only in the cases provided for by Article 6(1)(a), (f) and (j) (Consent and / or during Investigations and / or Public Interest) of the Data Protection Law, provided that appropriate measures to safeguard the data subject’s rights and freedoms and legitimate interests are in place.
Right to withdraw consent
A data subject has the right to withdraw his / her consent at any time and without explanation. In such case, the processing of the data shall be terminated, and / or the processed data shall be erased or destroyed, according to the request of the data subject, within not later than 10 working days after the request, provided that no other ground for the processing exists. Furthermore, the data subject has the right to withdraw his / her consent in the same form in which it was given. Also, before withdrawing consent, the data subject has the right to request and receive from the controller information on the possible consequences of withdrawing the consent.
Restriction of the rights of data subjects
The rights of the data subject described above may be restricted if this is expressly provided for by the legislation of Georgia, does not violate fundamental human rights and freedoms, and is a necessary and proportionate measure in a democratic society, and the exercise of these rights may jeopardize:
- national security, information security and cyber security and / or defense interests;
- public safety interests;
- crime prevention, investigation, prosecution, the administration of justice, the enforcement of detention and imprisonment, the execution of non-custodial sentences and probation, and the conduct of operative and investigative activities;
- interests relating to financial or economic (including monetary, budgetary and taxation), public health and social protection issues of importance to the country;
- the detection of the data subject’s violations of professional ethical standards, including those of a regulated profession, and the imposition of liability on the data subject;
- the exercise of the functions and powers of regulatory and / or supervisory bodies in the respective areas;
- the protection of the rights and freedoms, including freedom of expression, of the data subject and others;
- the protection of state, commercial, professional and other secrets provided for by law;
- the substantiation of a legal claim or a statement of defense.
A described measure may be applied only to the extent necessary to achieve the purpose of the restriction. If the grounds listed above exist, the decision of the controller to restrict, or to refuse the exercise of, the rights of the data subject shall be notified to the data subject, except where the provision of the information would jeopardize the purpose (purposes) of the restriction of the right.
The exercise by the data subject of the rights elucidated above is free of charge, subject to the exceptions established by the Data Protection Law. Where the data subject makes an unreasonable number of requests, the controller may refuse to comply with the request, in which case he / she shall immediately inform the data subject in writing and explain to him / her his / her right to appeal.
Where the rights of the data subject are restricted and his / her request is refused, the burden of proof shall lie with the controller.
Right to appeal
If the rights as provided for and the rules established by the Data Protection Law are violated, the data subject has the right to apply to the Personal Data Protection Service, to a court and / or a superior administrative body in accordance with procedures established by law. In addition to that, the data subject has the right to request the Personal Data Protection Service to make a decision to block the data until a decision is made to complete the consideration of the application. Also, the data subject has the right to appeal the decision of the Personal Data Protection Service to a court, in compliance with the conditions and time limits established by the legislation of Georgia.
