What you need to know about the new Personal Data Protection Inspector
Georgia has a new government authority that is tasked with protecting people’s right to privacy. Its powers however may not be sufficient to stop the Ministry of Interior’s unchecked systematic surveillance of electronic communication.
We currently enjoy de facto no protection of our private data in Georgia. Companies spam people with unsolicited advertising SMS and the Ministry of Interior continues to carry out systematic real-time surveillance of all electronic communication without sufficient court oversight. If you believe that your personal data is collected, stored and used in a way that is violating the law, there is a new authority that will soon be able to help you to address your privacy complaints and investigate your case – the Personal Data Protection Inspector’s office.
Tamar Kaldani, who previously managed good governance and human rights programs at the Open Society Georgia Foundation (a donor of TI Georgia), was selected to head this new government institution that is tasked with ensuring compliance with the Law on Personal Data Protection.
“Personal data is the new oil of the Internet
and the new currency of the digital world.”
Meglena Kuneva, European Consumer
Commissioner, March 2009
While the Inspector will be able to investigate private companies for violations of the law, its mandate does not cover data that is collected and processed for purposes of public and national security (including economic security), defense purposes, criminal investigations or for court proceedings. Thus, Kaldani may struggle to successfully push for adequate oversight over the Ministry of Interior’s surveillance efforts which include the monitoring of all electronic communication.
What is the role of the Inspector?
The Law on Personal Data Protection, which came into force in May 2012, defines the Inspector’s role in monitoring and enforcing of this law.
The job description of the Inspector includes:
- Providing instructions to the public and the private sector about how to ensure adequate protection of personal data;
- Reviewing data-related complaints and appeals;
- Inspecting public and private entities to ensure that the data processing is carried out in compliance with the law;
- Raising public awareness on the protection of personal data.
Among other powers, the Inspector will eventually be able to order
- that violations during the collection, processing and storage of data are corrected;
- that data that was collected or processed in violation of the law is secured, anonymized, removed or destroyed;
- a temporary or permanent stop on the processing of data if the handler of the data fails to comply with the law.
If the Inspector detects administrative offenses, she is empowered (from 2016 on) to impose sanctions on violators; the decisions are binding and can be appealed in court.
Every year, the Inspector has to issue a public annual report on the state of data protection that documents significant violations and issues recommendations for improvements. The Inspector is entitled to submit proposals to Parliament and government institutions to improve the legal framework regarding data protection.
The Inspector was appointed for three years and was selected by a commission set up by the Prime Minister which included representatives of government, parliament, judiciary, the ombudsman’s office and civil society (including TI Georgia).
In line with conflict of interest rules, the Inspector cannot be an employee of another government body or carry out any other paid activity, with the exception of scientific, educational or artistic activities and must not be a member of a political party or engage in political activities.
How to contact the Personal Data Inspector’s office
A few complaints, including one by a citizen and one from an organization, are already on Kaldani’s desk. Both private and public entities are actively addressing the office for personal data related consultations. Citizens can send electronic letters to inspector’s official email: email@example.com, or call at (+995 32) 21 46 831. You can also visit their official Facebook page. The Personal Data Protection Inspector’s office is currently located at the State Chancellery.
Kaldani, who took office in July, has a team of 6 employees.
The state of privacy protection
Public knowledge about privacy and data protection is very low in Georgia. Most people are not fully aware that every time they go online, write an email, post a status or check-in on Facebook, Tweet their thoughts, use a chip card in a supermarket or simply send a SMS or go somewhere with their mobile phone turned on, they create a track of vast amount of information on who they are, where they are, what they purchase and where they are likely go. Analyzing all this data, which today is often referred as “new oil” and the “new currency of the digital world”, gives governments, companies – anyone with access to it – the ability to analyze, understand and even predict humans’ actions. This basic premise of personal data in the digital world makes it both an asset for positive developments as well as a potential object for misuse.
Despite the fact that the Minister of Internal affairs, Irakli Gharibashvili, found that his very own phone conversations had been recorded illegally, his ministry’s eavesdropping servers – so called black boxes – remain in place at all major telecommunication companies to this day.
The Inspector and her team will hopefully become a prominent and trusted institution that will not only promote an environment where both, state and private entities respect individuals’ privacy rights, but also manage to increase citizens’ awareness of this right.
The G-MEDIA program is made possible by support from the American people through USAID. The content and opinions expressed herein are those of Transparency International Georgia and do not reflect the views of the U.S. Government, USAID or IREX.