Personal data, CCTV, data leak: what to do under Georgian law

What to do

1. Who is the controller and on what basis: processing is lawful only on one of the grounds (consent, contract, law, legitimate interest and others); the controller must prove it (Law on Personal Data Protection, Art. 5). Special categories (health, criminal record) are subject to stricter rules.
2. Written demand to the controller: access and free copies, no later than 10 business days (Law on Personal Data Protection, Art. 14); cease processing or delete, no later than 10 business days (or a reasoned refusal) (Law on Personal Data Protection, Art. 16); for published data, demand restriction of access and removal of copies and internet links (Law on Personal Data Protection, Art. 16); direct marketing only with consent, which must be stopped on demand no later than 7 business days (Law on Personal Data Protection, Art. 12).
3. Video surveillance: of employees, only in exceptional cases (Law on Personal Data Protection, Art. 10); prohibited in changing rooms and toilets (Law on Personal Data Protection, Art. 10); in common areas of a building, only with the written consent of more than half of the owners (Law on Personal Data Protection, Art. 10); a camera at the entrance to your own flat must not infringe the legitimate interests of other persons (Law on Personal Data Protection, Art. 10); a sign is required.
4. Leak: the controller notifies the State Audit Office of the incident (leak) no later than 72 hours after detection (Law on Personal Data Protection, Art. 29); where the risk is high, the data subjects are notified immediately as well.
5. Protection: complaint to the State Audit Office of Georgia (სახელმწიფო აუდიტის სამსახური), a court or a superior body (Law on Personal Data Protection, Art. 22); consideration within up to 2 months (+ no more than 1 month) (Law on Personal Data Protection, Art. 50); the Service may order the cessation of processing, deletion of data and impose a penalty (Law on Personal Data Protection, Art. 52); violation of data subject rights: a warning or a fine of GEL 1,000 (turnover up to GEL 500,000; higher for large companies) (Law on Personal Data Protection, Art. 72). A claim against the Service's decision in court is filed within 1 month from familiarisation with it (Administrative Procedure Code of Georgia (APC), Art. 22). Civil route: a claim for protection of private life; where there is fault, harm is also compensated (CivC Art. 18).
6. Where to apply: State Audit Office; district (city) court.
7. Evidence: demand to the controller with proof of sending and the reply; screenshots with URL and date; photos of cameras and their field of view; call and SMS records.
8. Traps: not sending a written demand first, since there is no proof of refusal; confusing data protection with defamation, which are different mechanisms.

Be sure to check

• the lawful basis for processing and the burden of proving it
• the rights of the data subject and the controller's response deadlines
• the supervisory body, the State Audit Office, and the sanctions
• the route of protection: demand → Service → court; compensation of harm