Activities

The Personal Data Protection Service is an independent state authority, its activities are:

• Monitoring lawfulness of personal data processing;

• Monitoring covert investigative actions and activities performed within the central databank of electronic communications identification data.

Control over the legality of personal data processing in Georgia dates back to 2013. Conducted oversight of covert investigative actions has been carried out since 2015. These powers were exercised by the Office of the Personal Data Protection Inspector in 2013-2019, and from 2019 to 2022 by his legal successor, the State Inspector's Service.

From March 1, 2022, this mandate was given to the Personal Data Protection Service.

Key principles of the Personal Data Protection Service are:

• lawfulness;
• protection of human rights and freedoms;
• independence and political neutrality;
• objectivity and impartiality;
• professionalism;
• maintenance of professional secrecy and confidentiality.

One of the key functions of the Personal Data Protection Service is the oversight of data protection legislation and monitoring lawfulness of data processing in Georgia. For this purpose, the Office conducts its activities in four main directions:

• Audit (inspection) of the lawfulness of data processing in public and private entities;
• Handling citizens’ complaints related to data protection;
• Providing consultations to public and private entities on the issues related to data protection;
• Informing the public about the state of data protection in Georgia and events related to it.

 Inspection

Inspection is auditing the lawfulness of data processing in public and private organizations, that the President of Data Protection Service is entitled to carry out at any time on his/her own initiative or on the basis of an interested person’s complaint.

Within the scope of an inspection the President of Data Protection Service is entitled to enter any premises, examine any  documents and information, notwithstanding its content and form of storage; request a document and/or information from any individual or a legal person, including information containing national, commercial, professional, tax, or bank secret, also materials and/or documents, reflecting operative-investigational activities and investigation of a crime, that pertain to national secrets and are necessary to conduct an inspection within the relevant scope.

Handling Citizens’ Complaints

If a citizen believes that his/her personal data are processed in violation of the law, he/she enjoys the right to address President of Data Protection Service . In the process of handling a complaint, the President of Data Protection Service examines and evaluates submitted facts and circumstances. If required, the President of Data Protection Service requests additional materials from relevant persons and conducts an inspection of data controller or data processor.

The term of handling a complaint is two months. On the basis of a substantiated decision this term may be extended for one month.

Mechanisms of Responding to Violations

If the President of Data Protection Service identifies a violation in result of an inspection or handling a citizen’s complaint, he/she is entitled to:

• Impose a relevant administrative liability, including a fine or a warning on the data controller and data processor
• Order elimination of the deficiencies in an indicated form and within an indicated period; require temporary or permanent termination of data processing; blocking, erasure, destruction or depersonalization of data, termination of transfer to another state or international organization;

• Address the court if a data controller or data processor fails to comply with the orders;
• Address a competent authority if the President of Data Protection Service believes that elements of crime are present;

• Decision of the service is mandatory and it may be appealed at a court in accordance with the procedure established by the legislation.

Consultations

The Data Protection Service Office provides free-of-charge consultations to citizens and organizations on data protection issues. Any interested individual or legal person can reach the  Office in a verbal or written form or via phone and receive a consultation on his/her rights, obligations, legislation and any other issues of concern.

Raising Public Awareness

Raising public awareness is one of the key priorities of the  Service, while establishing the culture of respect for privacy in the country is part of its mission. Accordingly, the public is regularly informed on the importance of data protection, its rights and obligations, accompanying risks and activities of the Data Protection Service Office. Multiple projects, events and activities are being planned and implemented via diverse and modern channels of communication, digital and interactive forms, multimedia platforms and educational activities.

International Relations

Personal Data Protection Service is actively engaged in various international and multilateral formats and international processes in the field of data protection, including activities of Council of Europe’s consultative committee for Convention 108 (T-PD).

Service is an accredited member of numerous international working groups and conferences. Amongst them are International Working Group on Data Protection in Telecommunications (the so-called Berlin Group), Global Privacy Enforcement Network (GPEN), Central and Eastern Europe Data Protection Authorities (CEEDPA) and others.

The Personal Data Protection Service is involved in the implementation of Association Agreement and Association Agenda; also, the Office has significantly contributed to the conclusion of the agreement between Georgia and European Police Office (Europol) and is currently participating in the ongoing negotiations on signing an agreement with Eurojust (EU’s judicial cooperation body). In addition, the Inspector’s Office was actively engaged in the visa dialogue process with the European Union.

SEE LESS