A foreign statute or the Georgian law: what governs data processing in Georgia
The California Consumer Privacy Act is a statute of a United States state and does not govern the processing of data in Georgia. For processing that touches Georgia — a Georgian service, a page aimed at the Georgian market, or the collection of consumer data through technical means located in Georgia — a single law applies: the Law of Georgia on Personal Data Protection, which is built on the European model and requires a prior basis for processing, including the data subject's consent. The Californian approach — an opt-out at the point of sale of data — is not sufficient under the Georgian law: here consent must be an active expression given for a specific purpose. On this page we explain what the Georgian law demands and how consumer rights look inside its frame. The Californian statute may serve only as a point of contrast for orientation, not as a compliance reference.
The scope of the law: whom it covers
The law applies to the automated and semi-automated processing of data on the territory of Georgia, and to non-automated processing of data that form part of a filing system or are intended to be included in one. The territorial criterion matters especially for companies registered abroad: the law also reaches processing carried out by a controller registered outside Georgia using technical means located in Georgia, except where those means are used only for the transit of data. At the same time the law does not apply to processing by a natural person for plainly personal or household purposes; processing for the purposes of state security, defence, intelligence and counter-intelligence activities; processing for the purposes of court proceedings; processing by mass-media outlets for informing society; and processing for academic, artistic and literary purposes.
Legal bases and the emphasis on consent
Processing is permissible only where one of the statutory bases exists: the subject's declared consent for one or several specific purposes; performance of an obligation under a contract with the subject or the taking of steps at the subject's request prior to entering a contract; processing provided for by law; performance of duties imposed by Georgian legislation on the controller; data made publicly available by law or by the subject; protection of the vital interests of the subject or another person; protection of a significant public interest; performance of tasks in the public interest defined by Georgian legislation; protection of the legitimate interests of the controller or a third party — except where the subject's overriding interest in the protection of rights prevails; and consideration of the subject's application. Alongside the list stands one of the law's strictest demands: the obligation to justify the legal basis rests on the controller itself. In practice this means that for every purpose and every data flow the company must know — and be able to document — the basis on which its processing stands.