The legal nature of a cookie policy in Georgia
Cookies and the tracking technologies around them leave personal data behind with every website visit, which is why their use must be governed by a cookie policy or privacy notice. Georgia has no separate statute on cookies — this field falls entirely under the Georgian Law on Personal Data Protection, which is built on the principles of the European Union's General Data Protection Regulation but is itself the binding framework in Georgia. Within the system of the law, a cookie policy is a form of performing the information duty: the document through which the controller informs the data subject about the processing of data concerning them. Below we examine what exactly this document must contain in order to be lawful.
The minimum information a cookie policy must contain
Where data is collected directly from the data subject — including through cookies or website forms — point 1 of Article 24 of the law obliges the controller, before collection or at the latest at the time collection begins, to provide the subject with at least the following information:
- the identity and contact details of the controller, its representative and, where one exists, the processor;
- the purposes and the legal basis of the processing;
- whether providing the data is mandatory and, if it is, the legal consequences of refusal, as well as whether collection is envisaged by Georgian legislation or is a necessary condition for entering into a contract;
- the significant legitimate interests of the controller or a third party, where processing rests on legitimate interests;
- the identity and contact details of the data protection officer, where one has been appointed;
- the identity of recipients or the categories of recipients;
- any planned transfer of data to another state or an international organization, together with the appropriate safeguards, including any permission for the transfer;
- the storage period of the data or, where a specific period cannot be defined, the criteria for setting it;
- the data subject's rights under the law.
A cookie policy that does not reflect this list does not perform the information duty — a banner saying "we use cookies" does not satisfy the law's requirements. The information must be given in simple and intelligible language, especially where the subject is a minor, orally or in writing, including electronically, unless the subject requests written form.
Informing when data is not collected from the subject
Often cookies and advertising tools obtain data not from the consumer directly but from third parties. In this case point 1 of Article 25 requires that the subject receive the full information envisaged by Article 24, and also be told which data concerning them is processed, the source of that data, and whether it was obtained from a publicly available source. The timing rule is precise: the information must be provided within a reasonable period; where the data is used to contact the subject — at the first communication; and where disclosure is planned — before disclosure, but no later than 10 working days from obtaining the data, unless grounds for restricting the right under the law exist.
When informing is not required
The law also contemplates exceptions. Under point 2 of Article 24, providing the information is not required where there is a reasonable assumption that the subject already possesses it. Where special legislation establishes a different information procedure for collection that does not violate the subject's fundamental rights, then upon the subject's written request the information must be provided within 10 working days of the request; in exceptional cases this period may be extended by no more than 10 working days, of which the subject must be notified immediately. Point 3 of Article 25 releases the controller from the duty where the subject already possesses the information; where collection or disclosure is established by law or is necessary for performing a statutory duty; or where informing is impossible, requires disproportionate effort, or would seriously harm or render impossible the lawful purpose of processing — in these cases suitable measures must still be taken to protect the subject's rights, including placing general information about the acquisition publicly.
The data subject's right to information free of charge
A cookie policy is not merely a passive notice: under Article 13 the subject has the right to request from the controller confirmation of whether data concerning them is processed, and — corresponding to the request — to receive free of charge information about the data being processed, the basis and purpose of processing, the source of collection, the storage period or its criteria, the subject's rights, the basis and safeguards for transfers, the recipients, and also decisions reached through automated processing, including profiling, and the logic applied to them. This information must be provided no later than 10 working days from the request; in exceptional cases the period may be extended by no more than 10 working days, with immediate notice to the subject. Unless the subject requests otherwise, the information is provided in the same form in which the request was made.
Fines for failure to perform the information duty
Article 74 of the law ties a fine directly to non-performance of the information duty under Articles 24 and 25, and the measures differ by annual turnover. For a natural person, a public institution, a non-entrepreneurial legal entity, a branch of a foreign enterprise and an individual entrepreneur whose annual turnover does not exceed GEL 500 000, the measure is a warning or a fine of GEL 1 000. For a legal entity — other than a non-entrepreneurial one — a branch of a foreign enterprise and an individual entrepreneur whose annual turnover exceeds GEL 500 000, the measure is a warning or a fine of GEL 1 500. Where the same act is committed with aggravating circumstances, the fine rises: for persons with turnover up to GEL 500 000 it amounts to GEL 2 000, and for persons with turnover above GEL 500 000 — to GEL 3 000. A deficient cookie policy is therefore not merely a reputational matter but a direct financial risk.
The Legal.ge professionals assist in drafting cookie policies and privacy notices that reflect every requirement of the law and protect your business from the risk of fines.