Support Centre

You have out of 5 free articles left for the month

Signup for a trial to access unlimited content.

Start Trial

Continue reading on DataGuidance with:

Free Member

Limited Articles

Create an account to continue accessing select articles, resources, and guidance notes.

Free Trial

Unlimited Access

Start your free trial to access unlimited articles, resources, guidance notes, and workspaces.

Georgia: PDP imposes fine on politcal party for multiple violations of Data Protection Law

The Office of the Personal Data Protection Inspector ('PDP') published, on 7 September 2021, a statement setting out its findings following an investigation into the collection, storage, and proposed dissemination of personal information by a political party, in violation of Articles 4, 6, and 41 of the Law of Georgia on Personal Data Protection of 28 December 2011 No. 5669 ('the Data Protection Act').

Background to the statement

In particular, the PDP outlined in its statement that in 2020, in the pre-election period, one of the political parties stated during a briefing that it had more than 750,000 audio recordings collected in the course of citizen polls, as well as almost 1,200,000 voter polling papers containing respondent's name, surname, place of residence, profession, and information on political views, among other things. In addition, the PDP noted that the party also possessed 10,000 photographs of individuals with a polling paper in their hands. Specifically, the PDP noted that according to the political party, all of the information and documents would be given to various international organisations and the representatives of the diplomatic corporations accredited in Georgia, and in that way, the party attempted to defend its interests and confirm the results of the poll.

Findings of the PDP

More specifically, the PDP found that:

  • The polling papers belonging to individals showed their identification data, as well as information about their political opinions. As information about an individual's political opinions is classified as a special category of data, the Data Protection Act requires the written consent of an individual to obtain it. Furthermore, it was found that the party did not have grounds prescribed by the Data Protection Act to process such categories of data.
  • To achieve the purpose set by the political party – to understand public opinion about issues interesting for the party and confirm the validity of the polls – it was not necessary to process such volumes of respondents' data and this was possible without processing the respondents' identifying data.
  • The political party provided the audio recordings depicting the respondents' telephone conversations to the Central Elections Commission of Georgia, the Parliament of Georgia, and to the embassy of one of the countries in Georgia.

Following the examination, the PDP established that the political party processed voters' personal data in violation of the requirements laid down by Article 4 (principle of data processing), Article 6 (processing of special categories of data), and Article 41 (data transfer to the other states) of the Data Protection Act.

Outcomes

Given the above, the PDP had found the political party to be an administrative offender and imposed it with an administrative fine. Furthermore, the party was obliged to delete all the materials existing in physical and electronic form containing personal data (including audio recordings) collected in the course of the polls.

You can read the statement here.

Feedback