Rights and their limits — where the confidentiality guarantee ends
A data subject's rights — information, access, rectification, cessation of processing, blocking, portability — are powerful instruments, but the law also regulates their limits. Article 21 of the Georgian Law on Personal Data Protection provides that the rights envisaged by Articles 13 through 20 and Articles 24 and 25 of the law may be restricted only where this is directly provided for by Georgian legislation, does not violate human fundamental rights and freedoms, and is a necessary and proportional measure in a democratic society. Restriction is permissible only where exercising the right may threaten state security, information security and cybersecurity or defense interests; public safety; crime prevention, investigation, criminal prosecution and the administration of justice; interests significant to the country's finances, economy, public health and social protection; the detection of professional ethics violations; the functions of regulatory and supervisory bodies; the rights and freedoms of the subject or other persons, including freedom of expression; the protection of state, commercial, professional and other secrets; or the substantiation of a legal claim or defence. The measure applies only to the extent necessary for its purpose; the decision on restriction and refusal must be communicated to the subject — except where notification would endanger achieving the purpose — and the burden of proof lies on the controller. The rights must be ensured free of charge, and where requests are unreasonably frequent, the controller may refuse performance — with written notice and an explanation of the right to appeal.
The complaint route — State Audit Service, court, superior organ
Under Article 22 of the law, where rights or established rules are violated, the subject may apply to the State Audit Service, the court and/or a superior administrative organ. The subject may also request the State Audit Service to decide on blocking the data before the examination of the application is completed — a guarantee protecting the data from further processing while the case is pending. The Service's decision is appealed to court under the conditions and periods established by legislation.
How an application is examined
Article 50 of the law explains the Service's procedure: the application is examined and the measures provided by legislation are applied. Within 10 days of receiving the application, the Service decides on the measures to be applied and informs the applicant. To study the circumstances, the Service may conduct an inspection, and the controller is obliged to hand over materials on demand. The examination period must not exceed 2 months; by a substantiated decision it may be extended by no more than 1 month. Where additional materials are requested, the proceedings are suspended — and that period is not counted within the deadline. Before completion, a decision on blocking the data is possible; despite blocking, processing may continue where necessary for vital interests, state security and defense. After completion, the Service decides on one of the measures and notifies both the subject and the controller.
Where proceedings end with a fine or another decision, the General Auditor's decision is appealed in court under the procedure of the Administrative Offences Code — by the person against whom it was issued, within 1 month of its official communication. On appeal, the decision is executed from the moment the court's decision enters into legal force — the appeal thus postpones execution for that period.
Practical conclusions for the organization and the subject
For an organization, the practical meaning of this framework is that every refusal or restriction must be substantiated in writing: the law requires evidence of the ground, necessity and proportionality of the restriction, and that burden lies on the controller. For the subject, knowing the deadlines matters: a decision on measures is taken within ten days, examination does not exceed two months, and the General Auditor's decision may be appealed within one month — losing time weakens one's position. At the same time, the rule of free exercise of the rights means a fee may be imposed only in the exceptions established by law.
Fines for violating Chapter III rights
Article 72 of the law ties administrative fines to the violation of any data-subject right envisaged by Chapter III (except the right to appeal). Violation of one right: for persons with annual turnover not exceeding GEL 500 000 — a warning or a fine of GEL 1 000; above that turnover — a warning or GEL 1 500. Violation of two or more rights: GEL 2 000 and GEL 3 000 respectively. With aggravating circumstances, the fine for one violated right rises to GEL 1 500 and GEL 3 000, and for two or more rights — up to GEL 3 000 and GEL 5 000. Ignoring the rights thus turns directly into financial risk. The Legal.ge team assists both in defending a subject's rights and, on the organization's side, in lawfully substantiating restrictions and answering complaints.
Frequently Asked Questions
Below are frequently asked questions about confidentiality rights.
When may the rights of a data subject be restricted?
Only where directly provided for by legislation, where the measure is necessary and proportionate and exercising the right endangers a listed interest such as state security or the investigation.
Where may a complaint be filed?
With the State Audit Service, the court and/or a superior organ; blocking of the data may also be requested.
Within what time is an application examined?
The decision on measures is taken within 10 days; the overall examination does not exceed 2 months, extendable with justification by 1 month.
What fine is provided for breach of the rights?
Fines for violating Chapter III rights are set by a separate article and depend on the breach.
How We Help on Legal.ge
A confidentiality dispute turns on the right complaint route and the deadlines. On Legal.ge a data-protection specialist will assess the breach, prepare the complaint and protect your interests. Contact us.