In 2020, the State Inspector’s Service received several applications from citizens. They stated that the representatives of one of the political parties contacted them by phone, addressed them by name and asked them to take part in a poll. The citizens were interested in the sources of obtaining their personal data (phone number, name, surname), but did not get proper information from the initiator of the call.

Based on the citizens' applications, the State Inspector’s Service examined the lawfulness of obtaining voters’ phone numbers and informing voters by the political party.

In the process of examination, it was revealed that:

• the representatives of the political party contacted the citizens to conduct polls;
• usually, the representatives of the political party obtained phone numbers from the web pages and/or social networks. Furthermore, to obtain their name and surname, they used a publicly available mobile application, through which the identity of the owner of the phone number was revealed through a combination of 9 different digits;
• In some cases, following the interest expressed by the citizens, the representatives of the political party explained to the citizens that their personal data was obtained from the “database”, which instead of informing the data subjects (the voters) caused ambiguity about the sources of obtaining their phone numbers. Although it is the right of the data subject to get such information, the political party did not provide the voters with the information and the sources properly, causing doubt in the citizens regarding the lawfulness of obtaining the data;
• The representatives of the political party had not received appropriate instructions the observance of which would ensure prevention of violation of the right to personal data protection of the voters.

In order to ensure that voters are informed when conducting polls, the political party was instructed to establish written rules and procedures for registering personal data and information (what data was obtained, when, by what means, grounds and purposes) obtained by the representatives of the party to conduct polls. Additionally, the party was instructed to draw up a rule for conducting voter polls defining issues of personal data processing, including what types of information to be collected in the course of the telephone poll, how to register received information, the type of information to be provided to the citizens before carrying out the poll, etc.

Given the identified circumstances, the political parties should take the following measures to prevent unlawful processing of personal data when conducting polls:

• for the purpose of conducting polls, voters’ data shall be obtained only if there are legal grounds provided for by the law of Georgian on Personal Data Protection;
• during personal data processing, in case of a request by the voters, provide them with the information about how they process their personal data: from where they obtained data, which organization collects the data and for what purposes, whether it is mandatory or voluntary to provide data, on what legal basis is data processed, is data transferred to third parties, etc.;
• develop detailed rules/instructions regulating voter data processing during the election process;
• raise awareness of the persons involved in the election process.

The voters as data subjects should know that they have the right to:

• express consent on data processing only voluntarily and in case of expressing consent, be informed about the purposes of processing their data;
• request from the political parties to stop processing unlawfully obtained personal data.