Material Applicability Factors

The Law on Protection of Personal Data (LPDP) in Georgia applies to various data processing activities, with several key factors determining its material applicability. These factors include:

1. Automated Means Criterion
2. Filing System Criterion
3. Prospective Filing System Inclusion
4. National Security and Law Enforcement Exemption
5. Judicial Proceedings and Court Records Exemption
6. Exemption for Specific Purposes of Processing
7. Data Held by Professional Order of a Political Party and Nonprofit Organization Exemption

Automated Means Criterion

The LPDP applies to data processing through automatic or semi-automatic means within Georgia. This is evident in Article 3(1) of the law:

LPDP Article 3(1):

"This Law shall apply to the processing of data through automatic or semi-automatic means, and to the processing of data through non-automatic means within the territory of Georgia, which data form part of the filing system or are intended to form part of the filing system."

This provision ensures that the law covers a wide range of data processing activities, including those carried out using digital or electronic systems.

Filing System Criterion and Prospective Filing System Inclusion

The law also applies to non-automatic data processing if the data forms part of a filing system or is intended to do so. This is clear from the same Article 3(1):

"This Law shall apply to the processing of data through automatic or semi-automatic means, and to the processing of data through non-automatic means within the territory of Georgia, which data form part of the filing system or are intended to form part of the filing system."

This criterion extends the law's scope to cover systematically arranged personal data on paper or other non-digital formats, as well as data intended for future inclusion in such systems.

National Security and Law Enforcement Exemption

The LPDP provides exemptions for certain national security and law enforcement activities. Article 3(3)(c) states:

LPDP Article 3(3)(c):

"This Law shall not apply to: [...] processing of the data defined as a state secret for the purposes of state security (including economic security), defence, intelligence and counter-intelligence activities;"

This exemption allows government agencies and security services to operate with greater flexibility in matters of national security and defense. However, it's important to note that the exemption is narrowly defined, applying only to state secrets and specific purposes.

Judicial Proceedings and Court Records Exemption

The law provides an exemption for certain judicial proceedings, as stated in Article 3(3)(b):

LPDP Article 3(3)(b):

"This Law shall not apply to: [...] data processing for court proceedings as far as it may prejudice the proceedings before the final decision of the court;"

This exemption ensures that the law does not interfere with ongoing court proceedings, allowing for the proper administration of justice.

Exemption for Specific Purposes of Processing

The LPDP provides exemptions for data processing in specific fields, as outlined in Article 3(4):

LPDP Article 3(4):

"This Law (except for Article 17) shall not apply to processing of data by media for public information, also to processing of data in the fields of art and literature."

This exemption recognizes the need for freedom of expression in media, art, and literature, balancing data protection with other fundamental rights.

Data Held by Professional Order of a Political Party and Nonprofit Organization Exemption

The law provides a partial exemption for certain organizations processing data of their members, as stated in Article 3(5):

LPDP Article 3(5):

"Articles 19 and 20 of this Law shall not apply to processing of data by political parties, professional and other unions, and religious organisations with respect to their members."

This exemption recognizes the special nature of data processing within these organizations, particularly concerning their members.

Territorial Applicability Factors

The territorial applicability of the LPDP is primarily determined by the Use of Equipment Within Jurisdiction factor.

Use of Equipment Within Jurisdiction

The LPDP extends its applicability to data processors not registered in Georgia but using equipment within the country for data processing. This is outlined in Article 3(2)(b):

LPDP Article 3(2)(b):

"This Law shall also apply to: [...] activities of a data processor who is not registered in the territory of Georgia but employs technical means existing in Georgia for data processing, except when these technical means are used only for data transfer. In this case, the data controller must appoint/designate a registered representative in Georgia."

This provision effectively extends the LPDP's reach beyond Georgia's borders, capturing foreign entities that interact with Georgian infrastructure for data processing purposes. However, it provides an exception for cases where the technical means are used solely for data transfer.

Conclusion

The Georgian Law on Protection of Personal Data has a broad scope of application, covering both automated and non-automated data processing within the country. It extends to foreign entities using equipment in Georgia and provides specific exemptions for national security, judicial proceedings, and certain types of organizations.