On February 29, 2024, the Personal Data Protection Service (PDPS) released information on data processing for direct marketing purposes, clarifying some aspects of the Data Protection Act 2023.

What clarifications were provided?

The PDPS highlighted that processing data for direct marketing purposes can only be done with the data subject's prior and specific consent. According to the Data Protection Act 2023, consent for direct marketing must also be obtained directly from the data subject and must be preceded by the relevant explanation provided by the person responsible for the processing or the person authorized for the processing in simple and understandable language. It is also mandatory for the data subject to be informed about the right to withdraw consent.

Notably, the PDPS also clarified that if the person responsible for the processing or the person authorized for the processing has obtained consent from data subjects for direct marketing until March 1, 2024, and the form and content of this consent are consistent with the standard established by the Data Protection Act 2023, the processing of data for the purpose of direct marketing will be considered permissible.

Furthermore, the PDPS noted that international best practices strongly recommend that obtaining consent from the data subject for direct marketing purposes should be done in a transparent, voluntary, and free manner. Moreover, the refusal of consent for direct marketing purposes should not limit the exercise of other rights of the data subject.

You can read the press release, only available in Georgian, here.