The right to erasure in Georgian law
The right to demand the deletion of data is colloquially known in foreign terminology as the right to be forgotten. In Georgia the institution is defined by the Law on Personal Data Protection: a data subject is entitled to demand the cessation of the processing of data concerning him or her — including profiling — and the deletion or destruction of the data. The right is not absolute: the law defines lawful grounds for refusal and alternative instruments such as blocking. On this page we explain how the mechanism works for the subject and for the organisation.
The request and the deadline
No later than 10 working days from the subject's request — unless another term is established by legislation — the processing must cease or the data must be deleted or destroyed, or else the subject must be informed of the ground for refusal with an explanation of how to appeal. In addition, the subject is entitled to receive information about the relevant action immediately upon its performance, but no later than 10 working days. The organisation must therefore both perform the action and notify the result — and meet both deadlines.
When refusal is possible
The law names four grounds on which the controller may refuse to satisfy the request: first, another basis for the processing exists; second, the data are processed for the purpose of a legal claim or pleadings; third, the processing is necessary for the exercise of the right to freedom of expression or information; fourth, the data are processed for archiving purposes in the public interest, or for scientific, historical research or statistical purposes, where exercising the right would make the achievement of those purposes impossible or significantly harm them. Where any of these grounds exists, the burden of justifying it rests on the controller — a refusal consisting of a bare citation does not suffice.
Publicly available data and the notification wave
A special rule applies where the subject's data are processed in a publicly available form: the subject may additionally demand restriction of availability and the deletion of copies or of any internet link connected with the data. Nor does the deletion decision remain confined to a single organisation: the controller must notify every recipient of the data, and every person to whom it itself transferred the data, except where this is impossible because of the number of recipients or disproportionate expense. The recipients, in turn, are obliged to cease processing and to delete or destroy the data. A properly executed request thus spreads like a wave along the whole chain of the data.
Withdrawal of consent as a special case
Where the processing rests on the subject's consent, withdrawal is the most direct route to deletion: the subject may withdraw consent at any time, without any explanation or justification, and the processing must then stop, or the data be deleted or destroyed, no later than 10 working days from the request, unless another basis exists. Withdrawal is possible in the same form in which the consent was given, and before withdrawing the subject is entitled to receive information about the possible consequences.
Blocking — the alternative where deletion does not happen
The law defines the right to blocking in five situations: the subject disputes the authenticity or accuracy of the data; the processing is unlawful but the subject opposes deletion and requests blocking; the data are no longer needed for the purpose but the subject needs them for a complaint or a lawsuit; a deletion request is under examination; or the data must be retained as evidence. Information about the blocking decision is communicated to the subject immediately upon its adoption, but no later than 3 working days from the request. Blocked data, apart from storage, may otherwise be processed only in the defined cases — with the subject's consent, for a legal claim, to protect interests, or in the public interest.
Where the subject applies and how to plan the answer
On a violation, the subject applies to the State Audit Service, the court or a superior administrative organ; the State Audit Service may be asked to decide on blocking before the examination concludes, and its decision is appealable in court. For the organisation, the decisive factor is ordering the process in advance: recording requests, controlling deadlines, documenting grounds and maintaining the mechanism for notifying recipients. We help build this process and assess specific requests — contact us.
In practice erasure requests most often begin in three situations: the subject ends the relationship with a company and demands the removal of a profile; data were published or transferred to a third party and the subject wishes to limit their spread; or consent was given for a time and is now being withdrawn. In each case the circle of refusal grounds differs: in the first, what is decisive is whether another processing basis exists, for instance a retention duty imposed by law; in the second, to whom and in what form the data were transferred; in the third, whether another basis survives the withdrawal. This is why a uniform answer to every request is dangerous: an organisation that replies to all requests with a single template either deletes data unnecessarily or refuses requests without grounds.