GeorgiaLaw on Personal Data Protection, data subject rights
Law of Georgia on Personal Data Protection, Law No. 3144-XI, Chapter III (Arts. 13-22) and Art. 23
In force since .
A data subject rights rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app holding the personal data of a person in Georgia must give that person a way to withdraw consent and to appeal, and must act on a request to exercise their Chapter III rights on demand.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.MT-P7Policies, processes, and procedures for receiving, tracking, and responding to complaints, concerns, and questions from individuals about organizational privacy practices are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does a human review of an automated output, as in Article 19(2) of the Law on Personal Data Protection, take a decision outside the words "based solely on automated processing" in Article 19(1)?
What it makes you log
Logging duty
Article 23(1) obliges the controller, on a data subject's request, to ensure the exercise of the Chapter III rights, taking all measures to comply and, if necessary, to demonstrate them, which presupposes a record of what was done. Article 17(4) also requires a decision to block data to be attached to the data where technically feasible. Chapter III names no log or register and sets no retention period for such a record.
- Kind
- Implicit
- As of
- Provision
- Article 23(1)
- Trigger
- personal_data_processing
What this law does
Chapter III of the Law (Arts. 13-22) sets out the data subject's rights: to obtain information on the processing of their data (Art. 13), to access the data and obtain a copy (Art. 14), to have erroneous, inaccurate or incomplete data rectified, updated or completed (Art. 15), to have the processing terminated and the data erased or destroyed (Art. 16), to have data blocked (Art. 17), to receive their data in a structured, commonly used and machine-readable format or have it transmitted to another controller (Art. 18), not to be subject to a decision based solely on automated processing, including profiling (Art. 19), to withdraw consent at any time and without explanation (Art. 20), and to apply to the State Audit Office of Georgia, to a court or to a superior administrative body when the Law is violated (Art. 22).
Art. 21 allows these rights to be restricted where the legislation of Georgia expressly provides for it, the restriction does not violate fundamental human rights and freedoms, and it is a necessary and proportionate measure in a democratic society, and the exercise of the rights may jeopardise interests such as national security or public safety.
Art. 23, in Chapter IV, obliges the controller, at the data subject's request, to ensure the exercise of the rights provided for by Chapter III and to demonstrate that it has taken the measures the Law requires, and extends that obligation to the processor.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions or processes personal data.
Back to the example · Lint your app
Page updated .