The Legal Nature of Electronic Evidence
In the digital era, most evidence in a case is born electronically: files, emails, chats, recordings, geolocation data. Georgian procedure regulates this field through dedicated terminology. A computer system is any device or group of interconnected devices which automatically processes data through a program — including a personal computer, any device with a microprocessor, and a mobile telephone. Computer data is any information represented in a form suitable for processing in a computer system, including programs that ensure its functioning. The definitions are deliberately broad, so that no device escapes the procedural framework by its technical form.
The definition of a document is equally broad: a document is any source in which information is recorded in verbal-symbolic form or as a photo, film, video, sound or other recording, or through the use of other technical means. Electronic content is thus a fully-fledged document, and its collection is governed by the same procedural frame that applies to material documents — with the same guarantees and the same avenues of challenge.
Search and Seizure on Digital Media
To seize an information-containing object — including digital media — a search or seizure is conducted on the basis of a substantiated suspicion, by court ruling or, in urgent necessity, by investigator's decree. The seized object is described in detail in the protocol, sealed and, where possible, packaged; the purpose of sealing is to preserve the integrity of digital evidence, since alteration or contamination of the data destroys the reliability of any conclusion drawn from it. Chain-of-custody discipline is not bureaucratic decoration but the foundation of the evidentiary value of the entire operation.
Where information is believed to be kept at a specific place and a search is not necessary, seizure without search is available. The personal search regime extends to devices found on clothing, among items in possession, or in a vehicle — including mobile telephones, which fall squarely within the definition of a computer system.
Requesting Information from Service Providers
The central instrument for collecting digital evidence is the request for a document or information. Where a substantiated suspicion exists that significant information is stored in a computer system or data storage medium, the prosecutor — and the defence — may apply to the court for a ruling ordering its production. In urgent necessity the action may be conducted on the basis of a prosecutor's decree. The defence's equal standing to seek such an order is an important manifestation of the equality of arms in electronic evidence gathering.
Where a person is suspected of criminal activity using a computer system, the prosecutor may request from a service provider subscriber information: the type of communication service used, the technical means and the time of service; the subscriber's identity, address, contact numbers, account and billing information; and information on the location of installed equipment. These data are distinguished from internet traffic data and content data — a boundary that is decisive for confidentiality protection, because the regime for obtaining each category differs.
Covert Investigative Actions
The most intensive form of interference with electronic communications is covert investigative action. The Code lists its types: covert monitoring and recording of telephone communications; removal and fixation of information from a communication channel — through connection to communication means, computer networks, line communications and station equipment — and from a computer system, both directly and remotely, including the installation of software for that purpose; determination of geolocation in real time; control of postal and telegraph items; covert video recording, audio recording and photography; and electronic surveillance by technical means that cause no harm to life, health or the environment.
Several covert actions may be conducted simultaneously. The intensity of these measures dictates strict judicial control: each must be justified by a substantiated decision, and the defence's task is to test that justification in every specific case — the grounds, the scope, and the duration of the intrusion.
Legality Criteria and the Defence
The core questions regarding electronic evidence are: who obtained the data and with what authority; whether there was a ruling or decree; whether the sealing and protocol rules were observed; and whether the boundaries protecting content data were respected. A negative answer to any of these leads to the inadmissibility of the evidence — an outcome that can dismantle an entire digital case built on unlawful foundations.
For businesses and individuals, prevention also matters: data retention policies, access logging, and a legal assessment of which service providers store what information and for how long. The law limits requests even to identification data whose retention period has expired — a guarantee that is far from formal, and one that any compliance programme should reflect.
Frequently Asked Questions
Is an electronic file a document?
Yes. A document includes any source in which information is recorded by technical means — photo, video, audio or any other format.
Who may request the production of data?
The prosecutor — and the defence equally — may move the court for a production ruling; in urgent necessity, by prosecutor's decree.
What is the difference between subscriber data and content?
Subscriber information covers the service type, technical means, time, identity and billing, and is distinct from internet traffic and content data; the regimes for obtaining them differ.
Can telephone communications be monitored?
Covert monitoring and recording of telephone communications is a covert investigative action under strict judicial control; the defence must verify its lawfulness in every case.
How We Help on Legal.ge
The advocates of Legal.ge assess the legality of electronic evidence, represent clients' interests in production requests, and move to exclude unlawfully obtained data. Contact us if your digital data has been requested or seized.