Is there a separate privacy statute for connected devices?

No. There is no sectoral statute; connected-device data runs on the general regime of the Law on Personal Data Protection — principles, protection by design, security and incident notification.

What does minimisation at design level mean?

It means that when creating a new product, the automatically applied initial method must be the processing of and access to only the minimal volume of data, including through pseudonymisation. Data beyond what a specific purpose requires must not be processed automatically.

Which security measures are required?

Organisational and technical measures corresponding to possible and accompanying threats, including pseudonymisation, access logging and mechanisms ensuring confidentiality, integrity and accessibility. Their effectiveness is periodically assessed and updated as needed.

Within what term must an incident be notified?

No later than 72 hours from discovery the State Audit Service must be notified in writing or electronically, unless significant harm is unlikely. The notice covers the circumstances, the affected data, the damage and the measures.

IoT Data Privacy in Tbilisi, Georgia

Connected device data and the Georgian law

Internet-connected devices — sensors, household appliances, wearable gadgets, industrial controllers — continuously collect information about owners and users: location, regime, habits, sometimes health indicators. Georgia has no separate sectoral statute for the confidentiality of connected devices, and this should be said plainly: data flows from connected devices run on the general regime — the Law of Georgia on Personal Data Protection. That law demands protection at the level of design, security measures, processing principles and incident response. Below we explain how these requirements extend to a connected-device product.

Processing principles — the starting frame

The law establishes principles to be observed in processing, and each of them bears directly on devices. Data must be processed lawfully, fairly, transparently for the subject and without violating dignity. Collection is admissible only for specific, clearly defined and legitimate purposes, and further processing incompatible with the original purpose is impermissible. Data must be processed only to the extent necessary for achieving the legitimate purpose and must be proportionate to it. Data must be authentic and accurate, and storage — only for the period necessary for the purpose: once the purpose is achieved, the data are deleted, destroyed or stored in depersonalised form. Finally, the security principle requires technical and organisational measures protecting the data from unauthorised or unlawful processing and accidental loss.

Protection at the level of design: minimisation as the initial method

The law defines an approach tied precisely to new products: taking into account new technologies, costs, the character, scale, context and purposes of processing, and the expected risks to the rights of subjects, the controller must adopt appropriate technical and organisational measures both when determining the means of processing and in the process itself — including pseudonymisation. Moreover, when determining the quantity of data, the scale of processing, storage periods and access, it must be ensured that only the volume necessary for the specific purpose is processed automatically. The measures must be applied so that, before an alternative approach is chosen, an indefinite circle of persons is automatically granted access only to the minimal volume of data. In the connected-device context this means: the device must be designed so that information transmitted from the sensor is processed only in the quantity and only for the period the function requires.