About this service
Artificial-intelligence systems live on data: they collect, analyse, classify and make decisions based on it. The Georgian law on personal data protection contains no separate chapter for artificial intelligence — and that is the first thing anyone working in this field must know. Processing within such systems is assessed under the law's general norms: the principles of processing, the legal bases, the special regime for automated decisions and the impact-assessment duty. This service builds the legal assessment of your system on precisely these four pillars — from product design to operation.
The principles — where every assessment begins
Article 4 of the law establishes the principles of processing, which extend fully to AI systems: data must be processed lawfully, fairly, transparently for the subject and without violating their dignity; data must be collected only for concrete, clearly defined and legitimate purposes, and further processing incompatible with the original purpose is impermissible; data must be processed only to the extent necessary for the purpose; and data must be accurate. For AI, concrete questions quickly arise here: how transparent is it that a model uses a subject's data; whether the use of training data is compatible with the purpose of collection; and whether the collected volume is genuinely necessary. The law also contemplates follow-on questions: in processing for another purpose, account must be taken of the connection between the original and the new purpose, the nature of the relationship between the controller and the subject, the subject's reasonable expectations and more.
Legal bases — why the processing is permitted
Under Article 5, processing is permitted where one of the bases exists: the subject's consent for one or several specific purposes; necessity for the performance of an obligation under a contract with the subject or for concluding one; provision by law; necessity for duties imposed by legislation; public availability of the data; protection of vital interests; significant public interest and others. In an AI system this question is no formality: the training corpus, the product's functioning and internal analytics often serve different purposes, and each may require a different basis. Choosing the basis and documenting it is precisely the work that must be done at the design stage of the system.