How the use of data for AI training is regulated in Georgia
Training artificial intelligence systems requires vast volumes of records, texts, images and other data that are often collected about other people. This raises a fundamental legal question: may such data be used to teach a model. In Georgian law this question is answered by general norms: the Georgian Law on Personal Data Protection contains no article specifically devoted to artificial intelligence. This must be said plainly: using training data is not in conflict with the law — it is simply subject to the same general regime that governs any other processing: the processing principles, the grounds, the rules on special-category data and the design requirements.
This means that when collecting training data and feeding them to a model, an organisation must answer the same questions that accompany any other processing: what the purpose of processing is, on which ground it takes place, how compatible that purpose is with the original purpose for which the data were collected, and by which measures the risk to the rights of subjects is reduced. The Georgian law follows the European approach, so international practice remains a comparative framework, while the decisive argument is always the Georgian norm.
The compatibility test for further processing
Using data for artificial intelligence training is almost always further processing: the data were collected for one purpose and are used for another — a training — purpose. Under Article 4 of the law, further processing of data for a purpose incompatible with the original purpose is inadmissible. To determine compatibility, the second paragraph of Article 4 establishes six factors that form the basis for assessing a training project.
First: whether a connection exists between the original purpose of collection and the training purpose. Second: the character of the relationship between the controller and the data subject at the time of collection. Third: whether the subject has a reasonable expectation of such further processing of data about him or her. Fourth: whether special-category data are being processed. Fifth: the possible consequences for the subject that may accompany this processing. Sixth: the existence of technical and organisational security measures.
In practice, if data collected from a consumer for the provision of a service unexpectedly become part of a training corpus, the reasonable-expectation factor is the weakest link: the subject could not anticipate such use, and this points towards a conclusion of incompatibility. Documentation of training projects should therefore begin with an analysis against these six factors.