The Purpose of the Law and What It Protects
Under Article 1 of the Law of Georgia on Personal Data Protection, the purpose of the law is to protect, in the processing of personal data, human fundamental rights and freedoms, including the rights to inviolability of private and family life, personal space and communication. This framing matters: data protection here is not a technical topic but part of the system of human rights, and it is through that prism that the law assesses every act of processing, from a small business's client base to state registries.
The Scope of the Law
Under Article 2, the law applies to the processing of data by automatic and semi-automatic means, and to non-automatic processing of data intended for inclusion in a filing system. It also applies to processing by a controller registered abroad carried out with technical means located in Georgia, except where those means are used only for transit. At the same time, the law does not apply to processing by a natural person purely for personal or family purposes, to processing for state security, defence, intelligence and counter-intelligence purposes, to processing in court proceedings, to processing by the media for informing the public, and to processing for academic, artistic and literary purposes. In addition, any person who accidentally receives data not intended for them must respect the rights of the data subject and must not attempt unlawful processing. This scope creates a balance between private space and public interests.
The Principles of Processing
Article 4 establishes six core principles: data must be processed lawfully, fairly, transparently and without violating dignity; collected only for specific, clearly defined and legitimate purposes; processed only to the extent necessary; kept accurate and, where necessary, up to date; stored only for the period necessary for the purpose; and protected by appropriate technical and organizational measures. Special attention is paid to further processing: where data are processed for a purpose other than the original one without consent or a statutory basis, the controller must consider the connection between the original and the new purpose, the nature of the relationship, the subject's reasonable expectations and the possible consequences. The use of data collected by law enforcement bodies for general analysis of criminal activity is a recognized exception, and long-term storage for archiving, scientific or statistical purposes is permitted with appropriate security measures. The controller is responsible for compliance with the principles and must be able to demonstrate it.