The Bases for Processing Data in the Workplace
The protection of employees' personal data in Georgia is governed by the Law of Georgia on Personal Data Protection. Under Article 5, the processing of data is permissible where one of the established bases exists: the data subject's consent for a specific purpose; the necessity of processing for the performance of an obligation under a contract with the subject or for concluding a contract at the subject's request; provision by law; the need for the controller to fulfil obligations imposed by legislation; public availability; the protection of vital interests; significant public interest; the tasks of a public-interest sphere; the significant legitimate interests of the controller or a third party — save where the interests of the subject, including a minor's, prevail; and the necessity of examining the subject's application.
In the employment relationship this list reads as follows: consent is never always necessary and often not required at all — the processing of an employee's data is frequently covered by the performance of obligations under the employment contract or by the demands of law. Article 5 places the accent in its second point: the obligation to substantiate the legal basis of processing lies with the controller — an employer must determine and record that basis in advance for each process.
Special Category Data and Employment
The processing of information on health, belief or other sensitive matters is subject to a strict regime: under Article 6, the processing of special category data is permissible only where the controller ensures the guarantees of protection of the subject's rights and interests provided by law and one of the established bases exists. Such bases include, for example, written consent for a specific purpose, direct regulation by law, vital interests, and the purposes of health care or social security.
For the employment context a special basis is particularly significant: the processing of special category data is permissible where it is necessary by the nature of labor obligations and relations — including for taking a decision on employment or assessing the employee's labor skills. This is, however, an exception and not a general rule: the collection of sensitive data "just in case" is not justified by this norm — the connection of necessity with the labor relationship must be established in every case.