On June 14, 2023, the Parliament of Georgia successfully adopted the new legislation "On Personal Data Protection" in the third reading, which substantially changed existing regulations concerning the processing of personal data and expanded the grounds for data processing. Until now, the restrictive nature of the law and its inflexible norms were a significant obstacle in terms of freedom of information in the country. Before the change the list of data processing bases, coupled with restrictive norms surrounding special categories of data, created an unreasonably disproportionate balance between the protection of personal data and freedom of expression and access to information, which was accompanied by the practice of interpretation of legislative provisions massively against the content of freedom of information.
The newly enacted law has effectively addressed ambiguities surrounding the processing of personal data and has brought significant changes to the strict legal framework. IDFI positively evaluates the legislative changes and holds the hope that these changes will be implemented in a manner that aligns with the underlying principle of striking a reasonable balance between personal data protection and freedom of information.
The draft law was initiated on May 22, 2019. On August 22, 2019, IDFI presented its opinions and recommendations to the Parliament of Georgia concerning the initial version of the draft law. The Parliament took some of these recommendations into account.
Specifically, the original version of the draft law included an exhaustive list of grounds for processing ordinary category personal data among which the existing provision of the current law - “data processing is provided for by Law” was removed. IDFI believed that removing the mentioned basis posed a threat to the accessibility of information publicity of which derived from other legal acts (such as property status declarations and public register data).
Furthermore, the original version overlooked the following basis: “Data processing is necessary to protect a significant public interest.” Excluding this basis could jeopardize the availability of information that serves a legitimate public interest, which, in specific cases, may outweigh the need to protect data subjects’ interests. Also, the initial version of the draft law did not contain the following basis: "According to the law, the data is publicly available or the data subject has made it publicly available" - obviously, when individuals themselves make their information publicly accessible, it is inherent that they no longer have a legitimate interest for the state to protect such data.
In this regard, the Parliament of Georgia took into account the recommendations of IDFI and included these grounds of personal data processing in the adopted version.
The new law introduces a wider range of grounds for processing special category data compared to the previous law. This should be considered as a positive development, since the strict norms regulating processing of special category data posed significant barriers to freedom of information. Furthermore, it is noteworthy that the previous blanket prohibition in the law, which made it impossible to disclose data without the consent of the data subject, has been eliminated.
Just like ordinary category data, special category data can now be processed, including disclosure, when there is a significant public interest (in relation to the special category data, this basis was not determined in the previous law).
According to the new law, the processing of special category data is allowed only if the person responsible for the processing ensures safeguards for protecting rights and interests of the data subject as provided by the law. This provision introduces an additional requirement for processing special category data, and lack of its clarity may potentially create additional obstacles to the access of information. IDFI pointed out this issue in its opinions submitted to the Parliament of Georgia. However, unfortunately, the Parliament has not taken into account this recommendation.
The new law “On Personal Data Protection” defines one of the grounds for processing special category data as follows: "the data subject has made their data publicly available without explicitly prohibiting its use." IDFI considers that the mere act of the data subject voluntarily disclosing their own data should, by itself, be the basis for processing without any additional requirements ("express prohibition of their use"). This derives from the constitutional standard set by the Constitutional Court of Georgia, according to which when a person has no interest in protecting the information about him from disclosure (when they voluntarily made data public), there is no need to protect the confidentiality of their personal data (Decision of the First Board of the Constitutional Court of Georgia No. 1/4/693,857 on the case “The Media Development Foundation” and “Institute for Development of Freedom of Information” against the Parliament of Georgia" II-31).
Despite these remarks, the expansion of the grounds for processing special category data and the elimination of blanket prohibitions must be regarded as a positive development. As practice shows, previous regulations created normative barriers that made it impossible to obtain special category data (such as information about officials' convictions, crimes, etc.) as public information. The new law has addressed and resolved this issue.
The practice of refusing to issue judicial acts with reference to personal data protection has been at place since October 2015. In the conflict between availability of public information and the protection of personal data, per se preference was given to the latter. On June 2019, in the case of “N(N)LE "Media Development Foundation" and N(N)LE "Institute For Development of Freedom of Information" v. The Parliament of Georgia” the Constitutional Court of Georgia recognized the norms of the law “On Personal Data Protection” that excluded the availability of judicial acts adopted in open hearings as unconstitutional. According to the decision, there is, by itself, an increased public interest towards the availability of judicial acts, regardless of the legal issue it concern, to whom it is adopted and what importance does the act have in each individual specific circumstances of the case. The Constitutional Court, having recognized the disputed norms as unconstitutional and having considered the need for legislative amendments to properly implement the newly established constitutional standards, postponed the execution of the decision until May 1, 2020.
The law regulating above mentioned issue was adopted only on June 13, 2023 by the Parliament of Georgia. Namely, the latest amendments to the organic law of Georgia “On General Courts” recognized the accessibility of judicial act as a default rule: “The full text of the judicial act shall be public information immediately after the final decision of the court on the relevant case enters into legal force and shall be issued as public information according to the rules established by the General Administrative Code of Georgia".
In the opinions of August 22, 2019, IDFI indicated that it was essential to adopt legislative amendments that would reflect the standard established by the Constitutional Court. This recommendation was taken into account by the parliament and the new law “On Personal Data Protection” determined that "special category data is processed in accordance with the Organic Law of Georgia "On General Courts" in order to issue as a public information or publish the judicial acts adopted in open hearings, and after processing such data they shall be issued in the form of public information in accordance with the Organic Law of Georgia "On General Courts". In other words, the normative regulation that, for many years, restricted the access to judicial acts adopted during the open hearing, has been changed and decided in favor of publicity of judicial acts. IDFI welcomes these changes as they would promote freedom of information and effective public oversight of the judiciary.
The new law also regulates the issue of openness of archival documents. The previous law “On Personal Data Protection” did not include research/archiving purposes as a basis for personal data processing, and disclosure of data for historical, statistical and research purposes was available only after a person is deceased and they have not restricted disclosure of their data.
In other words, a researcher could obtain archival document only if:
a) they had subject’s written consent
b) A subject is deceased and they have not writtenly prohibited disclosure of their data
This situation imposed a heavy burden of proof on a researcher. In particular, they had to obtain the consents of the data subjects or prove that they are deceased.
In this regard, the new law introduced important changes. Namely, the purposes of archiving and scientific research were defined as a new basis for processing of special category personal data: "The processing of special category data is necessary for archiving, scientific or historical research or statistical purposes, for public interest and in accordance with the law”. Therefore, the legislator took into account IDFI’s recommendation and the new law established the openness of archival documents containing special category data (legal possibility of processing/disclosure), which should be considered as a positive development.
Nevertheless, it remains problematic that the legal possibility of processing/disclosure of data for research/scientific/archiving purposes has been established only in relation to special categories of personal data, while it is not determined as a basis for processing ordinary category data. The law, in this regard, is somewhat paradoxical – the processing of special category data for research purposes is allowed, and the ordinary is not, while, by its very nature, special categories of personal data should enjoy a much higher level of protection than other types of personal data.
Even within this regulation, if the law is interpreted in the spirit of its purpose, the rule of openness of archives must be applied to ordinary data as well – if the law allows the disclosure of a special category data, it should, even more so, allow the disclosure of ordinary data as well (method of interpretation of the law: Argumentum a fortiori - ( arg a majore ad minus od a minore ad maius - from greater to lesser and from lesser to greater, the so-called "the greater conclusion" method). However, to eliminate ambiguity, it is better to determine research/scientific/archiving purposes as the basis for processing ordinary personal data as well. It should be noted that IDFI proposed this recommendation to the Parliament of Georgia on August 22, 2019, but the Parliament, unfortunately, did not take it into account.
Also, another positive development is that under the new law, archival documents will be open in any case (even if the person prohibited disclosure of the data) if 30 years have passed since the person is deceased.
The new law significantly changed the balance between the personal data protection and the transparency and established new standards of publicity, which should be considered a positive development. The parliament took into account a number of IDFI’s recommendations and the norms, which in many cases were the basis for limiting access to information by public institutions, were changed and replaced with unambiguous regulations.
It should also be noted that the amendments adopted on June 14, 2023 significantly change the personal data protection regime in the country. In the near future, IDFI will present a more comprehensive analysis of the adopted law, which will include, among other things, issues related to the priority of data coverage, the right to be forgotten, new obligations of the business (private) sector, the basis and requirements of audio monitoring, the institution of personal data protection officer and other important issues. Most regulations of the new law will enter into force on March 1, 2024.
Subscribe to Our News
