GeorgiaLaw on Personal Data Protection, special categories of data
Law of Georgia on Personal Data Protection, Law No. 3144-XI, Art. 6
In force since .
A sensitive categories rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app that processes special-category data, including biometric or genetic data, from a person in Georgia must rely on one of Art. 6's 20 lawful grounds, most commonly the data subject's explicit consent.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- When does a third party's reposting of special category data count under Article 6(1)(i) of the Law on Personal Data Protection as the data subject having "made his/her data publicly available without an explicit prohibition of their use"?
What it makes you log
Logging duty
Article 6(3) obliges the controller to justify the legal basis for processing special categories of data, which cannot be done without a record of the basis relied on. Article 6(1)(a) requires written consent as one ground, a condition of processing that does not itself oblige the controller to keep a consent record. The article names no log or register and sets no retention period.
- Kind
- Implicit
- As of
- Provision
- Article 6(3)
- Trigger
- personal_data_processing
What this law does
Art. 6 lists special categories of data as race or ethnicity, political, religious, or philosophical belief, professional-union membership, health, sexual life, criminal-proceeding status, conviction or criminal record, trafficking or domestic-violence-victim status, and detention, plus biometric and genetic data processed to allow unique identification of a natural person, with 20 lawful grounds (a through t) for processing such data, far more elaborate than a bare consent-only rule; two of those twenty, Art. 6(1)(r) and Art. 6(1)(s), each carry their own later commencement date fixed by Article 90 of this Law, distinct from the date the rest of Art. 6 took effect on.
One of those grounds, Art. 6(1)(i), permits processing where the data subject has made the data publicly available without explicit prohibition of its use. Georgia's biometric-specific Art. 9 regime applies independently on top of any Art. 6 basis, so a biometric identifier is never governed by Art. 6 alone.
When LexLint raises it
When your app profile says your app processes biometric data.
Back to the example · Lint your app
Page updated .