Introduction

Political Repression and Personal Data

The Georgian Dream utilizes various forms of repression and intimidation to achieve the party’s objectives. The main targets of the repressions are the participants and supporters of the ongoing protests that began on 28 November 2024. The goal of the Georgian Dream is to suppress the protest and intimidate the wider public through various retributive methods.

To carry out widespread repression, it is necessary to identify target groups and individuals and to select and implement individualized forms of pressure. This cannot be achieved without enhanced operational-technical support, which only the security sector and law enforcement agencies have the resources to provide.

The state requires the acquisition, sorting, and processing, including through advanced analytical software, of a large volume of personal data to plan and implement large-scale party repression. Although such operations are related to the mandates of numerous state institutions, the Personal Data Protection Service, the body supervising personal data protection in Georgia, should be singled out among them.

In this context, IDFI focuses on one of the visible forms of political repression—financial repression—and the use of the infrastructure and video-analytical capabilities of the Ministry of Internal Affairs (MIA), as well as the LEPL Public Safety Command Center - 112, to implement it.

1. Operational Model for Creating a Chilling Effect through Financial Repression

1.1. Legislative Component (Political Support)

The repressive amendments in the legislation regulating assemblies and demonstrations were implemented in two stages by the Georgian Dream—in December 2024 and February 2025. Amendments were made to the Law of Georgia “On Assemblies and Demonstrations”, the Administrative Offences Code of Georgia, and the Criminal Code of Georgia. Numerous vague terms were introduced to the legislation regulating spontaneous assembly, creating a risk of misuse. Disproportionate fines were introduced for violating the rules of organizing or holding assemblies or demonstrations. For example, the fine for blocking a roadway during a demonstration has been increased from 500 GEL to 5,000 GEL, and if the violator is also the organizer of the demonstration, from 5,000 GEL to 15,000 GEL. The maximum duration of administrative detention saw a fourfold increase, from 15 to 60 days. The amendments also included a blanket ban on participants of the assembly for wearing masks or covering their faces through any other means.

The legitimacy of these amendments was called into question by the Venice Commission and OSCE/ODIHR. They criticized the process of adopting the legislative amendments. The Venice Commission underlined the adoption of the amendments through an expedited procedure (paragraph 23). It also noted that opposition parties, civil society organizations, and other stakeholders were not involved in drafting the amendments. As for the contents of the amendments themselves, according to the OSCE/ODIHR and Venice Commission’s assessments, the blanket ban on covering faces with masks or other means needs to be revised, while the sanctions provided for administrative offenses, both in the case of fines and administrative detention, are considered disproportionate. The opinions also criticize other legislative amendments, such as the ban on the use of temporary constructions, the authority of preventive detention, and others.

Overall, numerous legislative problems concerning the legislative amendments restricting freedoms of assembly/expression were identified by the Venice Commission and OSCE/ODIHR that are incompatible with fundamental human rights. Practically every legislative aspect that received revised regulations as a result of the amendments was sharply criticized by the Venice Commission and OSCE/ODIHR.

1.2. Infrastructure Component (Enhancing Video-Surveillance Capabilities)

In December 2024 and January 2025, the MIA upgraded the video surveillance system on Rustaveli Avenue, especially in the area surrounding the Parliament building. Specifically, the number of video cameras was increased substantially, as well as their technical capabilities.

There are now over 40 video surveillance cameras located on the front facade of the Parliament building and the rectangular perimeter (150m X 80m) along the building. Approximately 15 of them are vertically and horizontally rotating/steerable cameras with high optical zoom capabilities—so-called PTZ (Pan-Tilt-Zoom).

Analysis of state procurements reveals that the perimeter is mainly equipped with Chinese-made (Dahua) cameras. It should be noted that the company that produces these cameras is sanctioned under U.S. defense/security sanction programs.

 The photo shows one of the models of PTZ cameras located near the Parliament building.  

It should also be noted that the mentioned camera has an automatic tracking function, which allows for the technical characteristics (pan/tilt, zoom) to be used to track a person.

1.3. Judicial Component (Expanding the Material Content of the Offense and Creating a Chilling Effect)

According to paragraph 4 of Article 11¹ of the Law of Georgia “On Assemblies and Demonstrations”: "It is not permitted to artificially block the roadway of transport, unless the number of participants in the assembly or demonstration requires it. It is also not permitted to block the roadway of transport with vehicles, various structures, and/or objects." According to paragraph 1 of the same article: "In case of partial or complete blockage of the roadway by assembly or demonstration participants, the Ministry of Internal Affairs is authorized to make a decision to open the roadway or/and restore traffic, if it is otherwise possible to carry out the assembly or demonstration given the number of participants." In practice, the MIA always provided for an alternate route following the blocking of the road and has not made any decisions to free the roadway from participants during the ongoing protest.

The court case-law has evolved in a way that judges do not use any kind of objective standard when assessing the process of blocking the roadway. Moreover, the courts consider it a violation even when a person joins a demonstration with the roadway already blocked. In other words, the court fines not only people who participated in the blocking of the roadway, but anyone who happened to move on the roadway during an ongoing demonstration, even an hour after the blocking. In a number of cases, such interpretation and application of the legislation regulating assemblies and demonstrations essentially contradicts the basic principles of fundamental human rights (for example, the principles of foreseeability and the prohibition of liability without culpability).

Ultimately, the case-law has generated a chilling effect on participation in the demonstrations, stemming from the unreasonably, disproportionately high fine of 5,000 GEL and the threat of administrative detention.

1.4. Police Staffing Component - Involvement of Detectives and Intimidation Attempts

After 7 February 2025, the delivery of protocols by detectives of the Tbilisi Police Department has become one of the forms of notifying participants of demonstrations about an administrative offense. Their involvement in the process of filing administrative fines was requested by the Director of the Tbilisi Police Department, due to the large volume of cases. The main function of detectives at the Tbilisi Police Department is to investigate and respond to crimes, and this is how their function is generally perceived by the public.

Detectives, in groups of 2-8, would often visit protest participants and hand over fines past working hours, at nighttime. The use of teams of police detectives to provide postal services cannot be explained as a means to conserve resources. The purpose is clearly to intimidate the participants of the demonstration and their families.

It is notable that, according to IDFI’s assessment, the administrative offense protocols issued after February 7 contain substantial violations of the rules of administrative proceedings provided for by the Code of Administrative Offenses.

(Photo: Report of the Head of Patrol Police Department)

2. Three Key Violations of the Rules for Processing Personal Data

2.1. Surveillance and Tracking of Protest Participants during/after the Demonstration

Controlled cameras deployed on Rustaveli Avenue collect video footage to identify participants of a demonstration. This process constitutes the form of tracking/surveillance, as it involves manual operation of the cameras by an operator who fully utilizes the technical capabilities of the controlled cameras (“tracking”, “zooming”) against participants. As a result of long-term observation of the camera control features (a total of approximately 20 hours of recordings from two controlled cameras), it is clear that the camera is manually controlled by an operator, and the automation capabilities are not used to observe the demonstrations.

These operations are necessary to detect a person’s face in high resolution, which is in turn necessary for further identification using video analytics or human resources. It should be underlined that these kinds of video operations are done not only on people present on the roadway, but also those who stay within the areas designated for pedestrians, including when the protest is over and traffic on Rustaveli Avenue has been restored. This indicates that the state perceives the realization of the right to assembly as a threat, as an object of special interest, and that the video-surveillance system is used for the general identification of protest participants.

In this regard, attention should be focused on the fact that the Georgian Dream, through repressive amendments, has put a blanket ban on covering the face during demonstrations, which in turn indicates a high political interest in identifying the participants in the demonstration.

2.2. Issuing Recordings without Adequate Legal Basis

The video recordings from 112 can only be transferred to the MIA department only under an appropriate legal basis. For instance, other investigative bodies require prior or subsequent court approval to obtain a record from 112, except in the case of administrative offenses, where identification of a vehicle by state license plate is permitted.

In the case of the protests, following the end of a demonstration, Patrol Police and/or Tbilisi Police Departments of the MIA request video records from 112, without indicating any legal basis for the request, “due to official necessity”.

2.3.  Identification of Persons via Biometric Data (Face Recognition System)

Case materials contain identification documents—statements/reports. The case materials are inconsistent in this regard. Specifically, at the initial stage, MIA representatives in the court would point out that they had personally identified the person being accused of administrative offenses via a special electronic program. This approach was soon altered, likely due to its being blatantly unconvincing, and cases began to include specially assigned persons and detectives, who stated that they had uploaded the records obtained from 112 to a special electronic program and used it to identify people in the video recordings. 

Although the facial recognition system is not mentioned in any of the reports, the activities described by the persons delivering these reports only leave one possibility: tracking persons through the use of biometric data (unique facial characteristics).

Article 9 of the Law of Georgia “On Personal Data Protection”, meanwhile, does not prescribe the use of biometric data for the purposes of a response to administrative offenses.

3. Applications and Complaints Directed at the Personal Data Protection Service

Based on the aforementioned reasons, with the assistance of IDFI, 8 people addressed the Personal Data Protection Service in the period between 4 February 2025 and 17 March. They requested an examination into the lawfulness of the whole chain of processing of their personal data by the MIA and 112. Specifically, these appeals concerned the study of the full cycle of processing the photo/video materials depicting these people, which would include all forms and operations of processing the data from the moment of their creation to their presentation in court proceedings. Among them:

               Collecting and obtaining the data; 

Access to data, logging of access instances and usernames;

Taking photos/videos; 

Video surveillance; 

Uploading/archiving information in a database; 

Scope of access to the data; 

Control of access to them by various people; 

Exchange of data in databases between agencies;

Sharing with third parties; 

Identification of persons; 

Organizing, grouping, linking, storing, and using data;

Additionally, disclosure of data by transmitting, distributing, or otherwise making the data available; 

Grounds for processing, necessity, and proportionality;

Guarantees of protection of rights. 

Additionally, it should be noted that the appeals contained a special notice that the Service should also inspect the lawfulness of the processing and verifying of the personal data of applicants in the special electronic program of the MIA, as well as the verification of the lawfulness of processing the biometric data of appellants by the MIA. This note was made against the background of the mass identification of protest participants through photo/video materials and the large volume of administrative proceedings against them, which raised a reasonable suspicion that personal data, including biometric data, was being systematically processed to identify an individual(s) in a possibly illegal manner.

It is highly likely that the materials used in the proceedings against the complainants contained signs of violations of the Law of Georgia “On Personal Data Protection”, which was substantiated in the applications. The Personal Data Protection Service identified deficiencies concerning seven complainants, and after correcting the deficiencies, it left the applications of all seven individuals unreviewed. The Service also left the application of the eighth individual, for which no deficiencies had been identified, without review.

The Service points to the ongoing administrative offense proceedings against the complainants in court, precluding the possibility of examining the circumstances indicated in the applications submitted to the Personal Data Protection Service as the reason for leaving them unreviewed. All eight of the complainants submitted an administrative complaint regarding the decisions made by the Service.

In IDFI’s assessment, the Personal Data Protection Service has unjustifiably and illegally refused to exercise its authority and has avoided to fulfill its mandate. There were no grounds given for leaving the applications without a review. The request stated in the applications and the ongoing court proceedings on administrative offenses are separate legal processes, and it is not possible to consider them as being parallel/overlapping.

Specifically, if in one case the subject is the examination of the lawfulness of the chain of processing of personal data by MIA and 112, in the second case, the subject of dispute is determining the fact of an administrative offense and imposing corresponding liability. These two processes are independent of each other in terms of their initiators, purposes, as well as outcomes, subject matter, and scope. Refusal by the Service to consider applications based on the above grounds serves only as a way to avoid exercising its own supervisory powers.

According to information available to IDFI, the same practice of leaving applications without review is used by the Personal Data Protection Service concerning other applications as well. By establishing such a practice, the Service leaves the right to privacy of complainants unprotected and eliminates the mandate of the Personal Data Protection Service on the administrative offenses adjudicated before the court (and/or other body). This can be evaluated as a removal of the activities of enforcement agencies from the institutional control of the Personal Data Protection Service.

4. Personal Data Protection Service’s Passive Support for Repression

In IDFI’s opinion, the Personal Data Protection Service has declared a tacit support for the ongoing political repression in Georgia through its inactivity and in some cases, illegal actions, and it is turning a blind eye to the use of personal data and advanced video-analytical capabilities (e.g., facial recognition systems) in the service of political interests.

To assess indicators of passive support, it is first important to focus on the powers granted to the Personal Data Protection Service. According to Article 49 of the Law of Georgia “On Personal Data Protection”, the Service works in four main directions: providing consultations and raising awareness of the public regarding personal data protection, reviewing individual applications, and conducting inspections.

4.1. Implicit Refusal to Consider Individual Applications

Part 3 of the present analysis provided a detailed description of the way the Personal Data Protection Service is establishing a practice that will allow it to refuse to verify the lawfulness of the processing of personal data, including special categories of personal data, within the context of administrative offense proceedings.

It is important to note that reacting to individual applications is one of the most effective mechanisms in terms of addressing systemic deficiencies.

IDFI believes that in the present case, there were prerequisites for imposing a fine of thousands of GEL on the MIA for gross violations of the requirements stipulated by the Law of Georgia “On Personal Data Protection”. This would be an important mechanism for preventing impunity in the manipulation of personal data by police forces. (See Articles 66, 67, 68, 69, 73, and 74 of the Law of Georgia “On Personal Data Protection”).

The refusal of the Personal Data Protection Service to carry out its mandate is especially alarming in light of the information reflected in the 2024 annual report of the Service. Specifically, the report notes the following: “The degree of compliance with the principle of proportionality remains a challenge in the processing of personal data by law enforcement agencies in the course of legal proceedings. During the reporting period, the Service once again identified instances of excessive data processing in relation to the legitimate aim and basis. Also problematic are the issues related to the security sphere, cases of failure by the persons responsible for processing and authorized to process data to take appropriate organizational and technical measures (recording access to data, information security mechanisms (confidentiality, integrity, availability) to address possible and inherent threats to data processing); among them, the absence/incompleteness of the recording of actions performed on the data (so-called "logs") of legal access to data and the correct selection of the subject designated for this purpose, absence of user accounts for persons with access rights, and other related issues." Moreover, even though the Service had not audited the Public Safety Command Center - 112, it speaks about the violations of the rules for video-audio monitoring by enforcement agencies, especially considering the strict requirements of the new law “On Personal Data Protection”. (Unofficial translation,  See Report, pp. 87-88).

The report indicates that the Service is aware of the problematic environment and high risks in terms of personal data protection within law enforcement agencies—circumstances that would, with high probability, lead to the satisfaction of complainants’ requests and the imposition of multiple fines on the MIA.

4.2. Inspection with a Narrow Focus and Its Relation to the Individual Application Response Mechanism

As revealed by the statement disseminated by the Personal Data Protection Service on March 12 of the current year, the Service launched two unplanned inspections on February 18—on the legality of the processing of biometric data by the LEPL Public Safety Command Center - 112 and the processing of the biometric data by the Ministry of Internal Affairs using a special electronic program. First of all, it should be noted that starting an inspection on the processing of biometric data is a positive fact, however, the focus of the inspection is extremely narrow to biometric data only.  Many important issues related to video monitoring in general remain out of focus. For example, the use of 112's video monitoring capabilities to respond to administrative offenses that are not related to vehicles, issues related to the obligation to inform, etc.

Starting an inspection with such a narrow focus is particularly noteworthy because, as revealed from the Service's 2024 report, it is aware of the fertile ground for violations of video and audio monitoring rules and personal data in general by the Ministry (see Report, pp. 87-88).

It should be emphasized that inspection is not a mechanism for responding to individual applications, as this instrument can be used with or without it.

4.3. Information Vacuum and the Obligation to Inform the Public

After November 28, 2024, continuous protests have been taking place daily, and during this period, there have been raids, confiscation of phones during demonstrations, and fining of demonstrators, for which law enforcement officers used state video monitoring capabilities. From the report of the Personal Data Protection Service, it becomes clear that the Service was aware of the disproportionate processing of personal data and the challenges associated with implementing video monitoring, but the Service has not disseminated informational materials based on publicly known incidents in the context of the demonstrations. (News: from 27/04/2022 up to today; Decisions: from 25/04/2024 up to today; Recommendations: from 14/03/2024 up to today). This excludes the information spread on launching the inspection in response to the statement of the Georgian Young Lawyers’ Association.

The existence of high public interest in the issue provides the best opportunity to raise public awareness on this matter. Despite the special interest of the public in video surveillance carried out by the state using modern technologies and the complete vacuum of information, the Personal Data Protection Service has done nothing to fulfill its obligation to increase public awareness regarding the rights granted to individuals by the Law of Georgia on "Personal Data Protection." For example, they could have disseminated a list of rights that a data subject has in the context of video monitoring carried out by law enforcement agencies.

Conclusion

The specialized institution for personal data protection was established in Georgia in 2013 and has been functioning continuously since then. This institution has changed 3 Heads and was formed in its current form in 2022, as a result of the so-called reform that is perceived by local and international institutions more as political persecution of the previous Head rather than reform. According to IDFI's observation, the Personal Data Protection Institute (since its establishment) has always approached the issues of studying the abuse of operational-technical capabilities of law enforcement agencies and the resulting risks with fearful caution. 

Despite this, the instrumentalization of personal data protection for political purposes has never been so visible or intense. Against this background, the establishment of a practice that precludes the fulfillment of its own mandate by the Personal Data Protection Service leaves the right to privacy of complainants unprotected. In particular, this completely excludes the mandate of the Personal Data Protection Service regarding the processing of personal data in connection with administrative offenses subject to court jurisdiction. 

The establishment of this kind of practice amounts to a refusal to apply the mandate of the Personal Data Protection Service to a significant part of activities of law enforcement agencies, which will in turn substantially alter the institutional framework for the protection of privacy provided by the Law on "Personal Data Protection" and will violate the right of complainants to privacy/personal data protection. 

IDFI believes that the establishment of the problematic practice discussed in this document by the Personal Data Protection Service will be an official green light for law enforcement agencies to continue the unlimited instrumentalization of the right to privacy and personal data protection for party repression.

Massive Surveillance of Protesters and Inadequate Response of the Personal Data Protection Service

/public/upload/00000Liza/PDSP and Fines.pdf