Cookies and the Georgian law: the rules for consent
Working with cookie files has no stand-alone legislative regime in Georgia: the Law of Georgia on Personal Data Protection contains no cookie-specific article. That does not mean the area is unregulated — collecting and using data through cookies falls fully under the same law's general consent regime, applied to the identifiers of terminal equipment. Below we explain how the law defines consent, what duties a website owner has when consent is taken and when it is withdrawn, and what fines are established for breaching those duties.
Why a cookie file is personal data
Under the law's definitions, personal data is any information relating to an identified or identifiable natural person. A person is identifiable where identification is possible directly or indirectly, including by name, surname, identification number, geolocation data, identifiers of electronic communications or other characteristics. A cookie identifier is precisely such identifying data — it ties the visitor to a device and a pattern of behaviour. The definition of processing is equally broad: it covers the collection of data, access to them, organisation, storage, use, disclosure by transfer, making available, dissemination and any other action towards the data. Accordingly, writing a cookie, reading it and building a profile is processing, and where it runs through information technologies the full statutory regime applies. Automated processing is expressly defined as processing by means of information technologies, and profiling — any form of automated processing that evaluates or predicts characteristics connected with a person — falls within the same frame.
What consent is and when it serves as a basis
Under the law, consent is the data subject's freely and clearly expressed will, given by an active action, in writing or orally, after receiving the relevant information, to the processing of data concerning him or her for a specific purpose. Three features stand out. Informedness: consent must rest on information provided beforehand. Activity: it must be expressed by an action, not by silence. Specificity: it relates to a defined purpose. Processing is permissible only where one of the statutory bases exists, and the subject's consent is the first among them. The allocation of responsibility is unambiguous: the obligation to justify the legal basis of processing rests on the controller itself. A written consent — including an electronic one — is a consent signed by the subject or otherwise expressed in writing for a specific purpose after receiving the relevant information; the mechanics of a cookie banner must measure up to this standard.
Essential requirements when taking and withdrawing consent
The law lays down concrete requirements that a cookie banner's design will run into. First, separation: where written consent is planned in a document that also concerns other matters, the text of the consent must be formulated in clear, simple and understandable language and separated from the other parts of the document. Second, voluntariness: where consent is given within a contract or service, its freedom must be assessed, among other circumstances, by whether consent is an essential condition of that service and whether the service can be received without it. Third, information: before taking consent the controller must ensure that the subject is informed of the right to withdraw it. Fourth, the consequence: upon withdrawal the controller must immediately stop the processing and delete or destroy the processed data, unless the law provides otherwise; withdrawal does not annul the effects that arose before and within the scope of consent.
The withdrawal mechanism is regulated separately: the controller must ensure a mechanism for withdrawal that is free of charge, simple and accessible, including the possibility to withdraw consent in the same form in which it was given. Before withdrawal the subject is entitled to receive information about its possible consequences — including where withdrawal may have legal, financial or otherwise materially significant effects for the subject. Consent may be withdrawn at any time, without any explanation or justification, and the processing must then stop or the data be deleted no later than 10 working days from the request, unless another basis for processing exists. To this is added the burden of proof: where a dispute arises over the existence of consent, the controller bears the burden of proving its fact.
Fines for breaching the consent regime
The law attaches an administrative penalty to the failure to perform duties established for the taking of consent and its withdrawal. For a natural person, a public institution, a non-commercial legal entity, as well as a legal entity, a branch of a foreign enterprise and an individual entrepreneur whose annual turnover does not exceed 500 000 lari, the breach results in a warning or a fine of 1 000 lari; for a legal entity (other than a non-commercial one), a branch of a foreign enterprise and an individual entrepreneur whose annual turnover exceeds 500 000 lari — a warning or a fine of 2 000 lari. Where an aggravating circumstance is present, the fine is 2 000 lari and 4 000 lari respectively. These amounts look modest, but they are imposed per violation, and repeat findings accumulate quickly where the same defective banner keeps running.
Our service
We help bring a cookie policy and consent mechanism into order: we determine which cookie files are necessary and which require consent, draft information texts that meet the law's requirements, and prepare the withdrawal procedure. Contact us for a consultation — we will review your site and propose a practical solution.