The Personal Data Protection Service of Georgia submitted the Annual Activity Report 2022 to the highest legislative body – the Parliament of Georgia.

The document consists of four parts and includes the Service's activity, inter-organizational and financial reports, as well as the strategic development concept and plan for strengthening the Service. Additionally, the Annual Report includes statistical data on the activities carried out by the Service for the reporting period from March 1 to December 31, 2022.

Statistical Data

Remarkably, according to the statistical data from the previous year, citizens' applications toward the Service and the number of conducted inspections have increased.

During the reporting period, the Service received 447 applications/notifications, out of which 277 (62%) were related to data processing in private institutions, 93 (21%) — in public institutions, and 77 (17%) — in law enforcement bodies.

From March 1, 2022, to December 31, 2022, the Service conducted 149 examinations (inspections) of the lawfulness of the data processing.

The Service identified 157 facts of illegal processing of personal data. 64% (101) of administrative offences revealed by the Service related to unlawful data processing in the private sector, 27% (42) in the public sector, and 9% (14) in law enforcement bodies.

The Service issued 222 instructions and recommendations in total, out of which 53% (119) were addressed to private institutions, 40% (88) — to public institutions, and 7% (15) — to law enforcement bodies.

During the reporting period, the Service provided 3,292 consultations, both orally (via telephone communications and in-person meetings) and in writing.

The Personal Data Protection Service used the suspension mechanism of covert wiretapping and recording of telephone communications (via electronic control system) in 176 cases.

Meetings, Training Sessions and Other Important Projects

The mission of the Service and one of the most important priorities is to establish a culture of personal data protection and raise public awareness in society. To this end, during the reporting period, the Service actively held information meetings, public lectures, and training sessions for the private and public sector representatives and law enforcement bodies. In addition, informational meetings were also held in the regions of Georgia.

In total, during the reporting period, the Service conducted 36 meetings with 1007 attendees, represented by the data subjects as well as data controllers.

It should be noted that for the first time in the history of the Georgian Data Protection Authority, a bilingual scientific periodical publication - "Journal of Personal Data Protection Law" was established.

Also, it should be emphasized that the "Rules of Proceedings of the Personal Data Protection Service" was approved to regulate the document circulation within the Service, creating the necessary conditions for information processing with modern technical means, and increasing the efficiency of the Service. Moreover, in order to exercise the powers defined by Article 40¹⁶ of the Law of Georgia "On Personal Data Protection ", which implies monitoring of the covert investigative actions and the activities carried out in the central databank of electronic communication identification data, the procedure for conducting the relevant measures was approved by the Order № 01/250 of the President of the Personal Data Protection Service of Georgia as of December 28, 2022. In particular, within the framework of the implementation of mentioned power, the functions of the relevant structural units and the issues related to the management of electronic control systems in the Service were defined. The latter will contribute to the smooth implementation of the monitoring of the covert investigative actions and the activities carried out in the central databank of electronic communication identifying data.

International Relations

One of the primary priorities of the Service is to increase international institutional recognition and strengthen cooperation with foreign data protection counterpart supervisory bodies and international organizations in the field of personal data protection.

During the reporting period:

• Memorandums of Understanding were signed with the data protection supervisory authorities of Croatia and Italy;
• The Service, as the accredited member of the "Conference of European Data Protection Authorities", so-called "Spring Conference", was also represented at the 30th Conference of 2022. The Conference was hosted by the Croatian Data Protection Authority, in the scope of which the President of the Service gave a speech at the panel session;
• The Service obtained the observer status to the "International Conference of Information Commissioners";
• The Service became a member of the "Committee on Artificial Intelligence" (CAI) of the Council of Europe and, via a representative, actively participated in the deliberations held at the Committee's plenary sessions;
• A new delegation was represented to the Consultative Committee of the 108th Convention ("T-PD");
• The Service, within the framework of the "Global Privacy Assembly" (GPA), became the Co-chairman of the "Data Protection Metrics Working Group" and a member of the "GPA Secretariat Selection Committee";
• In November 2022, the Personal Data Protection Service of Georgia hosted the "European Case Handling Workshop".

Concerning the strategic development concept and plan for strengthening the Service, in 2023, the Service will continue its institutional development in the following primacy directions:

• Improving national legislation on personal data protection and ensuring compliance with international standards;

• Institutional development of the Service;
• Strengthening the culture of personal data protection in the country and raising public awareness;

• Maintaining the international institutional recognition of the Service and deepening international cooperation.