Personal Data Protection as a Civil Right
Among the central guarantees of modern civil rights is the protection of personal data. Article 4 of the Law on Personal Data Protection establishes the principles of processing: data must be processed lawfully, fairly, transparently for the subject and without violating their dignity. Data may be collected only for specific, clearly defined and legitimate purposes and processed only to the extent necessary. They must be accurate and, where necessary, kept up to date; inaccurate data must be corrected, erased or destroyed without unjustified delay. After the purpose is achieved, data must be erased, destroyed or stored in depersonalized form unless storage is determined by law. Appropriate technical and organizational measures must protect the data from unauthorized or unlawful processing, accidental loss, destruction or damage, and the controller must be able to demonstrate compliance with these principles.
Grounds for Processing and Special Categories of Data
Under Article 5, processing is permitted where a statutory ground exists: the subject's consent for one or more specific purposes; performance of a contract with the subject or steps prior to one at the subject's request; processing envisaged by law; performance of duties imposed by legislation; data made publicly available by law or by the subject; protection of vital interests; a significant public interest; the legitimate interests of the controller or a third party, unless the subject's interests, including those of a minor, prevail; or examination of the subject's application. The obligation to substantiate the ground rests on the controller. Article 6 governs special categories of data: processing is allowed only with the guarantees of the subjects' rights ensured and on one of the listed grounds, for example the subject's written consent, direct legal regulation, protection of vital interests where the subject cannot consent, or the sphere of health care. The burden of substantiation again lies with the controller.
The Legal Rules on Video Surveillance
Article 10 of the law regulates video surveillance. It is permitted to prevent and detect crime, for public security, the protection of a person's safety and property, the protection of a minor, secret information, examinations and testing, provided it is an adequate and proportionate means. The controller must define in writing the purpose and scope of monitoring, its duration, the storage period of recordings, and the rules of access, storage and destruction. Surveillance of an employee's work process or space is permitted only as an exception where the aim cannot be achieved otherwise. It is prohibited in changing rooms, hygiene areas and spaces with a reasonable expectation of privacy, and every instance of access to recordings must be logged. Surveillance of the common entrance and common spaces of a residential building is permitted with the written consent of more than half of the owners, and a clearly visible warning sign must display the controller's name and contacts.
The Rights of the Data Subject and the Statutory Deadlines
Articles 13, 14, 15, 16 and 17 of the law grant the data subject broad rights. The subject may confirm whether their data are processed and receive information on the ground, purpose, source and storage period; access the data and receive free copies; request correction, updating or completion of inaccurate data; demand cessation of processing, erasure or destruction; and, in defined circumstances, blocking. The law attaches clear deadlines: information and copies are provided within 10 working days of the request, extendable in special cases, with substantiation, by no more than 10 working days, with immediate notice to the subject. Data are corrected, or the refusal communicated, within 10 working days, and processing must cease within the same period. Information on a blocking decision must be given no later than 3 working days from the request. Under Article 20, consent may be withdrawn at any time, without explanation, in the same form in which it was given; processing must then cease or the data be erased no later than 10 working days from the request, unless another ground exists.
How to Exercise These Rights in Practice
The subject may choose the form in which information is provided; by default it matches the request. On refusal, the controller must communicate the grounds and explain the appeal procedure. Information and copies are in principle free of charge; a fee is admissible only where provided by legislation or as a reasonable fee not exceeding the resources actually expended, with the burden of proving its reasonableness on the controller. Ignoring a properly framed request is itself a violation.
Frequently Asked Questions about Data Protection
Within what period must I be given information about myself?
No later than 10 working days from the request; in special cases, with proper substantiation, the period may be extended by no more than 10 working days, of which you must be notified immediately.
Can I receive copies of my data free of charge?
Yes, under Article 14 copies are provided free of charge, except where a fee is provided by legislation or a reasonable fee is set for providing the data in a different form.
When can I demand blocking of data?
For example, where you dispute the accuracy of the data, where processing is unlawful but you oppose erasure, or where the data are no longer needed for the purpose but you require them for a complaint. Information on blocking is provided within 3 working days of the request.
How do I withdraw my consent?
Consent may be withdrawn at any time, without any explanation, in the same form in which it was given. Processing must then cease or the data be erased no later than 10 working days from the request.
How We Help on Legal.ge
If your data are processed unlawfully somewhere, a website demands excessive information, or video surveillance affects your rights, the Legal.ge team will help you submit a request, monitor the deadlines and challenge a refusal, assessing the ground of processing and preparing a complaint where needed.