For the enforcement of the Russian-style Foreign Agents Law, on 1 August 2024, the “Rule for Registration, Financial Declaration Submission, and Monitoring of Organizations Pursuing the Interests of Foreign Power” was approved by the Order of the Minister of Justice of Georgia. According to the Order, the approved financial declaration form, which itself consists of 12 parts, entails the submission of financial information with maximum detail, which will subsequently be published in the stigmatizing and discrediting registry. The form includes the publication of various personal data of not only the employees of a given organization but also any other individual who has any kind of financial relationship with the organization.

After the approval of the financial declaration foreseen under the Russian-style Foreign Agents Law, Netgazeti addressed the Personal Data Protection Service with a request for an assessment of its compliance with existing standards of personal data protection. The Service indicated that the form, “in terms of its contents, is in compliance with the standards of minimization and proportionality of the processing of personal data.”

After getting acquainted with said assessment of the Personal Data Protection Service, IDFI addressed the Service with a request for information regarding various expenses of the Service, in the same form as the obligation of publication has been imposed on civil society and media organizations according to the Russian-style Foreign Agents Law. For instance, IDFI requested the following information from the Personal Data Protection Service:

- The amount of remuneration paid to each employee in 2024 (salary, monetary awards, bonuses - separately), with personal data (name, surname, identification number, bank account) of the persons receiving the remuneration;

- Business trip expenses incurred for each employee in 2024 (travel, hotel, per diem - separately) and the purpose of the business trip, with personal data (name, surname, identification number, bank account) of persons on said business trips;

- List of expenses for consulting, notary, translator, and translation services incurred by the Service in 2024, with the personal data of the persons providing the services (name, surname/title, identification number, bank account);

-List of advertising expenses incurred in 2024 (television, print, internet advertising, branded accessories, outdoor advertising, and other advertising expenses), with the list of executing companies/persons, identification numbers, recipient bank accounts, circulation/duration of advertising, area of coverage (in case of print and internet advertising), and the unit cost (GEL).    

In response, the Personal Data Protection Service indicated that the information requested by IDFI contained personal data, and the data concerning all employees (and other persons) except the officials (Head of the Personal Data Protection Service, the First Deputy, and the Deputy) was provided in a depersonalized form (personal data was covered). Additionally, some of the information concerning even the officials, such as bank account numbers, were also not presented.

IDFI believes that, like the Russian-style Foreign Agents Law itself, the financial declaration form developed on its basis is not in compliance with personal data protection standards. At the same time, it should be emphasized that the Russian-style Foreign Agents Law imposes obligations on civil society and media organizations to submit and publish personal data, the publicity of which is limited by law in relation to the representatives of the public sector. This once again confirms the repressive nature of the Russian-style Foreign Agents Law.