The legal framework of international data transfers
International data transfer unites two different but closely connected questions: first, when the transfer of data to another state or international organisation is permitted; second, how the Georgian Law on Personal Data Protection extends to controllers registered abroad. This page is oriented precisely towards the second, international dimension: for foreign companies that process data in Georgia and for Georgian organisations cooperating with them.
Under the first paragraph of Article 2 of the law, its scope covers the processing of data on the territory of Georgia by automatic and semi-automatic means, the non-automatic processing of data that form part of a filing system, and also the processing by means of technical facilities located in Georgia by a controller registered outside Georgia. The only exception is where the technical facilities are used solely for the transit of data. This means that foreign services using servers or other technical facilities located in Georgia fall under the Georgian law.
The special representative: who needs one and when
Under the first paragraph of Article 34, where a controller or processor registered outside Georgia processes data by means of technical facilities located in Georgia, it is obliged, before processing, to appoint or designate a special representative in Georgia. The representative is registered under the procedure established by a normative act issued by the State Audit Office.
The sequence here is clearly defined: the controller acquires the right to process data only after the registration of the special representative. In other words, first registration — then processing. The representative is obliged to fulfil the requirements imposed by the General Auditor in the manner established by law, and its appointment does not release the foreign person from this obligation.
The data subject has the right to demand the exercise of his or her rights against a foreign controller through the special representative. At the same time, the appointment obligation does not extend to persons based in European Union member states to whom the personal data protection rules operating in the European Union apply, or to persons based in states recognised by the European Union as states with adequate data protection.
The rules of permissive transfer
The lawfulness of an international transfer itself is established by Article 37. Transfer is admissible where the requirements provided for by law exist and appropriate guarantees of data protection and of the protection of the subject's rights are ensured in the corresponding state. In addition, the law names permitted exceptional grounds, including international treaties, contractual guarantees with the permission of the State Audit Office, informed written consent, vital interests and significant public interest.
In every case the controller is obliged to adopt the organisational and technical measures necessary for the secure transfer of data, and the onward transfer of transferred data to a third party is admissible only where it serves the original purposes and satisfies the same grounds and guarantees.