Personal data protection

The Law of Georgia on Personal Data Protection (subsequently referred to as the Personal Data Protection Law) was adopted in December 2011 and, with some exemptions, entered into force on 1 May 2012 (Articles 43-55 entered into force on 1 January 2013; Articles 34, 35 and 39 with regard to the private sector shall enter into force on 1 January 2016). The Office of the Personal Data Protection Inspector was established in Georgia in 2013. This state institution is responsible for monitoring the legality of data processing in Georgia. The main functions of the institution include:

  • providing instructions to the public and the private sector about how to ensure adequate protection of personal data
  • reviewing data-related complaints and appeals
  • inspecting public and private entities to ensure that data processing is carried out in compliance with the law
  • raising public awareness on personal data protection

A significant part of the EU-Georgia Visa Liberalisation Action Plan (VLAP) is devoted to the personal data protection issues in Georgia. Personal data protection is mentioned in the following areas of the EU Visa Dialogue:

  • document security, including biometrics
  • integrated border management
  • migration management

Thus, the protection of personal data in the area of migration management comprises one of the significant components of ICMPD ENIGMMA project. Accordingly, the ENIGMMA project has initiated capacity building support to the Office of Personal Data Protection Inspector (PDPI) and all key Georgian state institutions involved in migration management:

1.In August 2014, additional amendments to the Law on Personal Data Protection were adopted. The amendments included extension of legal provisions to the police sector. Thus, a need for aligning existing procedures with the current PDP Law in terms of data protection regulations in migration-related areas of the Ministry of Internal Affairs (MIA), as well as all other areas, has emerged. Therefore, the ENIGMMA project recruited an EU MS expert from Czech Republic that provided specific recommendations to the MIA based on the analysis of Ministry’s organisational practice and its compatibility with the national Personal Data Protection Law.

As a form of continued support to the MIA, a training cycle was agreed with the Personal Data Protection Inspector’s Office and MIA to cover the specific provisions of “the Law of Georgia on Personal Data Protection” and its practical implementation. Overall, five trainings have been planned and implemented during July 2015-February 2016 with the involvement of relevant departments of the MIA.

pxoto

Training Cycle on PDP for MIA

Training of Trainers on PDP for MIA

  1. A “Baseline Study on Personal Data Protection in the Area of Migration Management in Georgia” was implemented from August 2014 – March 2015 by the Georgian NGO, Innovations and Reforms Centre (IRC) in close cooperation with the ICMPD/ENIGMMA project team and an Austrian expert appointed by the project.

The objectives of the study were:

  • to study and analyse how the benchmarks provided by the PDP Law are implemented in Georgia by public institutions in the area of migration management
  • to study and analyse the extent to which the PDP Law has changed data protection in the field of migration management in Georgia compared to the situation before the PDP Law entered into force (in 2013 and earlier)
  • to study and analyse the extent to which the changes brought about by the PDP Law have led to greater harmonisation and compliance with the Council of Europe 1981 Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data
  • to identify the aspects of data processing in the field of migration management in Georgia which are either not covered by the requirements of the PDP Law or are inadequately covered by it and to propose recommendations for further implementation of the PDP Law in the area of migration management in Georgia.

The results of the study are used by the Personal Data Protection Inspector to further monitor the implementation of the Personal Data Protection Law in the field of migration management in Georgia, to propose concrete steps and recommendations on further improvement, and to inform the public on the current situation concerning personal data protection in the area of migration management in Georgia.

The study report includes recommendations for each Georgian state institution working on migration issues and dealing with the personal information of data subjects on a regular basis. Based on the study recommendations, the Ministry of Internally Displaced Persons from the Occupied Territories, Accommodation and Refugees of Georgia (MRA) requested a follow-up support to regulate data protection mechanisms at the Ministry and align their implementation to the Law of Georgia on Data Protection and international standards. In this regard, ENIGMMA project plans to provide tailored support to the MRA with the involvement of national and EU MS experts. The activity will be ongoing until summer 2016.

Summary of the Report on Baseline Study on PDP in the area of Migration Management in Georgia

3.Awareness raising on PDP in the area of Migration Management

  • Data Protection Day – the ENIGMMA project has been supporting the celebration of Data Protection Day in Georgia in year 2014 and 2016. A high-level event is initiated and led by the PDPI Office with the aim to bring the importance of the right to privacy to public attention and recognise the achievements in the PDP field undertaken by the Georgian Government;
  • Trainings on PDP and Migration – the ENIGMMA project in cooperation with the Secretariat of State Commission on Migration Issues (SCMI) and the PDPI Office provides tailored trainings to target groups jointly identified by the stakeholders. Three trainings took place in October-December 2015 and June 2017 one targeting the leading media outlets in Georgia, while the other was tailored for the Court system.
  • Winter School on PDP – the ENIGMMA project in cooperation with the PDPI Office with the assistance of the UN and EU joint project “Human Rights for All” and in partnership with the Training Center of Justice organised a Winter School on Data Protection for students. The main objective of the Winter School was to raise awareness of the students on personal data protection and inform them about the challenges related to the protection of privacy in the modern, digital era.

Additionally, the Office of Personal Data Protection Inspector has introduced prospective amendments to the Georgian PDP Law including the clause on developing and implementing of a Unified Migration Analytical System (UMAS) in line with the data protection standards. UMAS is a mechanism foreseen by the Migration Strategy of Georgia 2016-2020 that has been developed with the support of the ICMPD ENIGMMA project in partnership with the SCMI Secretariat.

Winter School on PDP

Training on PDP and Migration Management to Media

Training on PDP and Migration Management to Judges

International Data Protection Day in Georgia

  1. Capacity building of the PDPI Office
  • Training on Data Security for the Personal Data Protection Inspector’s Office staff was organised by the ENIGMMA project with the involvement of the STE expert from Germany on Data Security
  • Training on Research Methodology was organised for the Personal Data Protection Inspector’s Office staff aimed at the improved abilities of PDPI Office to conduct a professional desk and field research what in turn supports the development of new strategic and policy documents in line with the international standards.

Training on Data Security for the PDPI Office

Training on Research Methodology for the PDPI Office