Interview with Personal Data Protection Inspector Tamar Kaldani
ENIGMMA: Personal Data Protection Inspector’s office is a relatively newly established institution. What were the needs that prompted creation of PDPI office?
Ms. Tamar Kaldani: Protection of privacy became a challenge in the modern world. High volume of personal data is processed by different public and private organisations; data is easily exchanged between data controllers and accessed by third parties. Besides, once the data is disclosed and spread in the internet it is difficult to control the consequences of disclosure. The EU Member States are trying to solve these issues by adopting relevant legislation and promoting its implementation in practice and Georgia is following the example. However, only the adoption of relevant regulations will not be effective without mechanisms for their enforcement. This is why, establishing a supervisory authority with the competence to monitor legitimacy of the data processing, such as the Office of the Personal Data Protection Inspector is a perfect tool to ensure protection of privacy. It is very important to have in place a public agency responsible for supervising data controllers, protecting data subject’s rights and raising awareness on data protection issues. Besides, establishing such an institution was perceived by the obligations undertaken by Georgia on international level, such as the Council of Europe Convention (CoE) 108 and its additional protocol, Visa-Liberalisation Action Plan (VLAP) and Association Agreement between Georgia and the EU
ENIGMMA: What is the situation in terms of personal data protection in Georgia now?
Ms. Tamar Kaldani: The Law of Georgia on Personal Data Protection was adopted only by the end of 2011, thus it is still a new area of law. The main challenge we are still facing is the establishment of privacy compliant practices which is a continuous process. In addition, the level of public awareness is still low regarding privacy. The internal regulations of different data controllers are not yet adjusted to the existing legislation. But it should be mentioned that the data protection legislation has significantly improved during the last 2 years and has been harmonised with the European standards. Significant steps have been taken towards establishing appropriate values and practices that largely contributed to managing data protection since 2013, when the Office of the Personal Data Protection was created. Nowadays, the data controllers are more aware of their responsibilities, some of the state institutions have designated responsible persons responsible for data protection within their agencies, and internal regulations have been adopted. The private companies processing data for the purposes of direct marketing have also developed opt-out mechanisms. Lastly, we can say that notwithstanding the existing challenges, reforms undertaken in this area give us opportunity to make optimistic prognosis.
ENIGMMA: Who collects the data on migrants in Georgia or who controls the procedure of their data processing? Are migrants more fragile group in terms of personal data protection?
Ms. Tamar Kaldani: Personal data of every individual is important and should be treated carefully and this especially relates to more vulnerable groups as migrants. The vulnerability of the group is determined by several factors, for example difference of their nationality and occupation. It is necessary to ensure security while transmitting their data to other countries (even to the country of their origin). The personal data of migrants is collected by different public authorities like the Ministry of Internal Affairs, the Ministry of Foreign Affairs, Public Service Development Agency and etc. The Office of the Personal Data Protection Inspector supervises the legitimacy of data processing by all above mentioned institutions, including the personal data of migrants.
ENIGMMA: What does PDPI office do in terms of protecting Migrants’ personal data?
Ms. Tamar Kaldani: Personal Data Protection Inspector monitors data processing by almost all private and public institutions. The Inspector’s Office is focused to guarantee protection of personal data of every individual, notwithstanding his/her citizenship, status and any other characteristic. In 2014 the issue of accessing the databases of the LEPL Public Service Development Agency by of other organisations was examined, In 2014 we have also examined the legitimacy of the processing of data by the Ministry of Internal Affairs of Georgia for the border control purposes. We had a lot of consultations with relevant institutions, on the issues of processing personal data during border crossing, and carried out numerous trainings for the staff of the Consular Department of the Ministry of Foreign Affairs. All these activities are directed to provide them with the information on the issues of how to process personal data, including the data of migrants. There are a lot of consultations provided to the public agencies on the lawfulness of trans-border flows foreign citizens’ personal data that are residing in Georgia.