The right to erasure in Georgian law
The right to demand the deletion of data is colloquially known in foreign terminology as the right to be forgotten. In Georgia the institution is defined by the Law on Personal Data Protection: a data subject is entitled to demand the cessation of the processing of data concerning him or her — including profiling — and the deletion or destruction of the data. The right is not absolute: the law defines lawful grounds for refusal and alternative instruments such as blocking. On this page we explain how the mechanism works for the subject and for the organisation.
The request and the deadline
No later than 10 working days from the subject's request — unless another term is established by legislation — the processing must cease or the data must be deleted or destroyed, or else the subject must be informed of the ground for refusal with an explanation of how to appeal. In addition, the subject is entitled to receive information about the relevant action immediately upon its performance, but no later than 10 working days. The organisation must therefore both perform the action and notify the result — and meet both deadlines.
When refusal is possible
The law names four grounds on which the controller may refuse to satisfy the request: first, another basis for the processing exists; second, the data are processed for the purpose of a legal claim or pleadings; third, the processing is necessary for the exercise of the right to freedom of expression or information; fourth, the data are processed for archiving purposes in the public interest, or for scientific, historical research or statistical purposes, where exercising the right would make the achievement of those purposes impossible or significantly harm them. Where any of these grounds exists, the burden of justifying it rests on the controller — a refusal consisting of a bare citation does not suffice.
Publicly available data and the notification wave
A special rule applies where the subject's data are processed in a publicly available form: the subject may additionally demand restriction of availability and the deletion of copies or of any internet link connected with the data. Nor does the deletion decision remain confined to a single organisation: the controller must notify every recipient of the data, and every person to whom it itself transferred the data, except where this is impossible because of the number of recipients or disproportionate expense. The recipients, in turn, are obliged to cease processing and to delete or destroy the data. A properly executed request thus spreads like a wave along the whole chain of the data.