The Bases for Processing Data in the Workplace
The protection of employees' personal data in Georgia is governed by the Law of Georgia on Personal Data Protection. Under Article 5, the processing of data is permissible where one of the established bases exists: the data subject's consent for a specific purpose; the necessity of processing for the performance of an obligation under a contract with the subject or for concluding a contract at the subject's request; provision by law; the need for the controller to fulfil obligations imposed by legislation; public availability; the protection of vital interests; significant public interest; the tasks of a public-interest sphere; the significant legitimate interests of the controller or a third party — save where the interests of the subject, including a minor's, prevail; and the necessity of examining the subject's application.
In the employment relationship this list reads as follows: consent is never always necessary and often not required at all — the processing of an employee's data is frequently covered by the performance of obligations under the employment contract or by the demands of law. Article 5 places the accent in its second point: the obligation to substantiate the legal basis of processing lies with the controller — an employer must determine and record that basis in advance for each process.
Special Category Data and Employment
The processing of information on health, belief or other sensitive matters is subject to a strict regime: under Article 6, the processing of special category data is permissible only where the controller ensures the guarantees of protection of the subject's rights and interests provided by law and one of the established bases exists. Such bases include, for example, written consent for a specific purpose, direct regulation by law, vital interests, and the purposes of health care or social security.
For the employment context a special basis is particularly significant: the processing of special category data is permissible where it is necessary by the nature of labor obligations and relations — including for taking a decision on employment or assessing the employee's labor skills. This is, however, an exception and not a general rule: the collection of sensitive data "just in case" is not justified by this norm — the connection of necessity with the labor relationship must be established in every case.
Video Monitoring at the Workplace
Under Article 10, video monitoring is permissible for the purposes of preventing and detecting crime, public security, the protection of the person and of property, the protection of a minor, the protection of secret information, examination or testing purposes, and other legitimate tasks — where it is an adequate and proportionate means for the purpose of the processing. The controller is obliged to define in writing the purpose and scope of the monitoring, its duration, the storage period of the recording, the rules of access, storage and destruction, and the mechanisms for protecting the subject's rights.
The video monitoring of an employee's work process or space is permissible only as an exception — where the named purposes cannot be achieved by other means or would require disproportionately great effort. Monitoring in changing rooms, places designated for hygiene, or any space where a person has a reasonable expectation of privacy is absolutely impermissible. The system and the recordings must be protected against unlawful interference, and every instance of access — including the time and the user's name — must be recorded.
Liability for Violations of the Monitoring Rules
Under Article 69, a violation of the video monitoring rules entails a warning or a fine: for a general violation — a fine of 1 000 GEL where the annual turnover does not exceed 500 000 GEL, and 2 000 GEL where the turnover exceeds 500 000 GEL; for monitoring in changing rooms or spaces with a reasonable expectation of privacy — respectively 3 000 and 5 000 GEL; and the repetition of a general violation under aggravating circumstances is punished by 2 000 and 4 000 GEL.
These amounts may seem small, but a fine always attaches to a separate violation: every unlawful camera, every unaccounted recording and every improper response is a separate fact, and their sum — like the damage to reputation — grows quickly.
Frequently Asked Questions
May an employee's data be processed without consent?
Yes — Article 5 provides bases other than consent, including performance of a contractual obligation and duties imposed by law; substantiating the basis is the employer's burden.
When may sensitive data be processed in employment?
Under Article 6 — subject to guarantees and one of the established bases, including where it is necessary by the nature of labor obligations and relations, for employment decisions or the assessment of labor skills.
Is video monitoring of the workplace allowed?
Only as an exception — where the purposes of Article 10 cannot be achieved otherwise or would require disproportionate effort; changing rooms and hygiene places are absolutely prohibited.
What fines apply to monitoring violations?
Under Article 69 — a warning or a fine: from 1 000 to 2 000 GEL in general cases, from 3 000 to 5 000 GEL for monitoring in prohibited spaces, and from 2 000 to 4 000 GEL upon aggravating repetition.
How We Help on Legal.ge
The correct management of employee data depends on the soundness of all three links: defining the basis for each process, observing the special regime of sensitive data, and the proportionality of monitoring. The law frames all three clearly, and their breach returns as a measurable result — a fine.
The lawyers working on Legal.ge will help you inventory the bases of data processing, prepare internal policies and consent forms, document the video monitoring rules, and assess damage risks. Contact us for a consultation — protecting an employee's data is a matter of trust, beyond the fine.