The right to request information: the Georgian legal frame
The institution of a data subject's information request is often labelled with a foreign abbreviation, but in Georgia the right is defined by the Law of Georgia on Personal Data Protection: a subject may demand from the controller confirmation of whether data concerning him or her are being processed, receive detailed information about the processing, and inspect the data together with copies. On this page we explain what a subject may demand, within which terms and in what form the answer must arrive, and what obligation a company bears in responding to such requests.
What information the subject may receive
Under the law, the subject is entitled to demand confirmation of whether data concerning him or her are processed and whether the processing is justified, and — corresponding to the request and free of charge — to receive the following information: which data are processed and what the basis and purpose of the processing are; the source of collection or receipt of the data; the storage period, or where a specific term cannot be determined, the criteria for setting it; the subject's rights; the legal basis and purposes of transfers and the appropriate safeguards, where data are transferred to another state or an international organisation; the identity or categories of recipients; and the logic involved in a decision produced by automated processing, including profiling, its influence on the processing and its expected consequences. The list is complete: in one answer the subject receives the full picture of who, why and for how long uses the data.
Deadlines and form
The information must be provided to the subject no later than 10 working days from the request. In special cases, with proper justification, that term may be extended by no more than a further 10 working days, of which the subject must be notified immediately. Unless legislation provides otherwise, the subject may choose the form in which the information is supplied; where no other form is requested, the information is provided in the same form in which the request was made. In practice this means that an electronic request normally entails an electronic answer — unless the subject wishes otherwise.
Access and copies
Access is regulated separately: the subject is entitled to inspect at the controller the personal data existing about him or her and to receive free copies of them. The law carves two exceptions out of the free rule: where a fee for inspection or for issuing copies is provided for by Georgian legislation, and where the controller sets a reasonable fee because of the resource expended in issuing the data in a form different from the storage form or because of the frequency of requests. The fee must not exceed the amount of the resource actually expended, and the burden of proving the reasonableness of the fee rests on the controller itself. Copies may also be supplied in a different form, in exchange for a reasonable fee, where that is technically possible.
The controller's parallel duty at collection
Preparing to answer requests begins earlier: the law obliges the controller, before collection or at the moment collection begins, to provide the subject with minimum information: its own identity and contact details, and those of its representative and processor where they exist; the purposes and legal basis of the processing; whether the provision of data is mandatory and the consequences of refusal; the legitimate interests where the processing rests on them; the identity and contact of the data protection officer, where one is appointed; the identity or categories of recipients; planned transfers and safeguards; the storage period or its criteria; and the subject's rights. This information must be supplied in simple and understandable language, in particular for minors. A properly performed duty of this kind lightens the burden of later requests as well.
The organisation's duty to secure the rights
Finally, the law obliges the controller, upon the subject's request, to ensure in the established manner the exercise of the rights defined by the chapter, including taking all measures for compliance and, where necessary, for demonstrating it. The duty extends to the processor with respect to the information held by it. We help build procedures for responding to requests, draft information texts and set fees reasonably — contact us for a consultation.
How to prepare an organisation for requests
Responsibility for answers is a process established by law, and its ordering lies in the hands of the organisation. The first step is building a register of processing: for an answer to be possible within 10 working days, the company must know where and in which systems data of a subject are stored, who the recipients are and for what period storage occurs — precisely the information the law requires it to supply. The second is deadline control: extension is allowed only in special cases, with proper justification and immediate notice, so the recording of every request and the tracking of its term are essential. The third is a fee policy: if the company charges for a different form of provision or for frequent requests, it must be able to account for the resource expended, since it bears the burden of proving the fee reasonable. The fourth is demonstration: the law demands not only compliance but the ability to substantiate it, so documenting every request and answer should be regular practice.