A foreign statute or the Georgian law: what governs data processing in Georgia
The California Consumer Privacy Act is a statute of a United States state and does not govern the processing of data in Georgia. For processing that touches Georgia — a Georgian service, a page aimed at the Georgian market, or the collection of consumer data through technical means located in Georgia — a single law applies: the Law of Georgia on Personal Data Protection, which is built on the European model and requires a prior basis for processing, including the data subject's consent. The Californian approach — an opt-out at the point of sale of data — is not sufficient under the Georgian law: here consent must be an active expression given for a specific purpose. On this page we explain what the Georgian law demands and how consumer rights look inside its frame. The Californian statute may serve only as a point of contrast for orientation, not as a compliance reference.
The scope of the law: whom it covers
The law applies to the automated and semi-automated processing of data on the territory of Georgia, and to non-automated processing of data that form part of a filing system or are intended to be included in one. The territorial criterion matters especially for companies registered abroad: the law also reaches processing carried out by a controller registered outside Georgia using technical means located in Georgia, except where those means are used only for the transit of data. At the same time the law does not apply to processing by a natural person for plainly personal or household purposes; processing for the purposes of state security, defence, intelligence and counter-intelligence activities; processing for the purposes of court proceedings; processing by mass-media outlets for informing society; and processing for academic, artistic and literary purposes.
Legal bases and the emphasis on consent
Processing is permissible only where one of the statutory bases exists: the subject's declared consent for one or several specific purposes; performance of an obligation under a contract with the subject or the taking of steps at the subject's request prior to entering a contract; processing provided for by law; performance of duties imposed by Georgian legislation on the controller; data made publicly available by law or by the subject; protection of the vital interests of the subject or another person; protection of a significant public interest; performance of tasks in the public interest defined by Georgian legislation; protection of the legitimate interests of the controller or a third party — except where the subject's overriding interest in the protection of rights prevails; and consideration of the subject's application. Alongside the list stands one of the law's strictest demands: the obligation to justify the legal basis rests on the controller itself. In practice this means that for every purpose and every data flow the company must know — and be able to document — the basis on which its processing stands.
Consumer rights: information and access
A data subject is entitled to request from the controller confirmation of whether data concerning him or her are being processed, and — corresponding to the request and free of charge — detailed information: which data are processed, the basis and purpose of the processing, the source of collection, the storage period or the criteria for determining it, the subject's rights, the legal bases and guarantees for transfers to another state or international organisation, the identity or categories of recipients, and the logic involved in any decision produced by automated processing, including profiling. The information must be provided no later than 10 working days from the request; in special cases, with proper justification, that term may be extended by no more than a further 10 working days, of which the subject must be notified immediately. The subject may also choose the form in which the information is supplied, unless Georgian legislation provides otherwise.
Erasure, cessation of processing and withdrawal of consent
A subject may demand the cessation of the processing of data concerning him or her — including profiling — and the deletion or destruction of the data. Within no later than 10 working days of the request the processing must stop or the data must be deleted or destroyed, or else the subject must be informed of the grounds for refusal with an explanation of how to appeal. Refusal is allowed only in the cases set by law: another basis for the processing exists; the data serve a legal claim or pleadings; the exercise of freedom of expression or information so requires; or the processing serves archiving, scientific or historical research or statistical purposes in the public interest. Where data are processed in a publicly available form, the subject may additionally demand restriction of availability and the deletion of copies or any internet link connected to the data, and the controller must notify all recipients, who must in turn delete their copies. Consent may be withdrawn at any time, without explanation, in the same form in which it was given — and the processing then stops or the data are deleted within 10 working days, unless another basis exists. Before withdrawal the subject may also request information about its possible consequences.
Where to complain: the supervisory authority and the court
Where rights or the rules established by the law are violated, the subject may apply to the State Audit Service, the court and a superior administrative organ. The State Audit Service may be asked to decide on blocking the data before the examination of the application is completed, and the Service's decision may be appealed in court under the conditions and terms of Georgian legislation. This is the enforcement mechanism through which the Georgian law exerts its force — not a petition to a foreign regulator, which will not act on processing governed by Georgian law.
Our service
If your business serves the Georgian market or uses technical means located in Georgia, we help you move onto the Georgian footing: we identify the basis for each processing operation, streamline the procedures for responding to data-subject requests, and prepare the company for interaction with the supervisory authority. Contact us for a consultation — we will assess your specific situation through the lens of the Georgian law rather than a foreign statute.