Why State Wants to Collect Sensitive Personal Data

Netgazeti

Netgazeti interviewed the member of Georgian Young Lawyers Association (GYLA) Tamar Kordzaia on the issue of adoption of Georgian Law on Protection of Personal Data.

- Parliament adopted Law on Protection of Personal Data through third hearing. Could you elaborate on the essence of the Law in brief?

- Adoption of the Law on Protection of Personal Data is a positive development in itself. However, adopting law in this form and with this pace is categorically unacceptable. In 2010 GYLA presented critical remarks regarding this draft law. At the stage of negotiations, the initiators agreed to consider our remarks and the draft law was going to go through certain modification. After the negotiations started after the first hearing they stated that this topic is closed and nothing is happening over this issue.

GYLA expected that the initiators of the draft law would contact them and consider their remarks at least in one paragraph. However, the Georgian Parliament adopted exactly that version which was adopted through the first hearing. Georgian Parliament did not consider any of our proposals.

- Why do you think Parliament had to consider your remarks, why is it a problem?

- There are issues in this law which might come in contradiction with the Constitution, especially the provision regarding the personal data which contains sensitive information i.e. sexual orientation and religious belief. According to the current Administrative Code, even processing such information is not admissible. The draft law envisages this possibility.

- Is it an obligation? They have to process this data?

- This is not an obligation, but they are authorized to process such data. There are certain criteria when this data can be processed. We think that these criteria are too broad i.e. it is possible to process sensitive data if there is high public interest. The term “public interest” is too broad and creates threat of leaving person without protection in the name of “public interest.” Besides, the Constitution states that everyone is equal before law regardless race, color, sexual orientation and religious belief. If discrimination is inadmissible in this regard, the concrete aim to why the state wants to process such data is uncertain. We thought that this law needed to be reconsidered and adopted afterwards. Nobody paid attention to our proposals.

I think introducing the post of inspector for personal data is principally unacceptable. According to the law, this person is selected by the commission selected by Prime Minister of Georgia. The main thing is that this person is selected by executive branch of government as if he was part of executive government which is unacceptable for us since protection of personal data belongs to the category of human right protection and implies human rights protection. Thus, the control on human rights protection should not belong to the competence of executive branch considering its essence. Executive branch executes the protection of human rights but the control of human rights protection belongs to the function of another branch. We offered the examples of different countries where this person can be selected by the Parliament or the President not as the head of executive branch of government but the head of state who represents state and protects its interests. According to our Constitution, President of Georgia is no longer the head of executive branch of government. He is the head of state thus it is principally unacceptable when the executive government selects and determines who can be the human rights defender.

Inspector for personal data is individual who has the functions of Public Defender in one concrete direction. He/she oversees the protection of personal data in any department of Georgia. We are not talking about only public departments. The protection of personal data by banks or public and civil registry is also very important.

- Do these rules apply to private sector?

- Yes, it applies to any company where there are employees. They will have obligation to collect and protect this data and the inspector will have to oversee the protection. We think that this person should not be selected by the executive branch of government and should not be accountable before the executive branch. This principally contradicts with the principle of separation of powers since the executive government, as a rule, executes the decisions of Georgian Parliament in other words conducts the protection of those rights which are determined by the legislative body of Georgia. The right of protection of personal data represents a guarantee for the right enshrined in Constitution and it would be desirable if the Parliament oversees its fulfillment.

- In the beginning you noted that the adoption of this law is a positive development. Why is it so?

- It is positive because the only law which regulated these issues was the General Administrative Code of Georgia and specifically its third chapter where several articles regard the processing of personal data and their subsequent protection. Of course it does not regulate all issues comprehensively and there are rather interesting positive provisions but there are risks also which might lead to violation of right of personal data protection and inviolability of private life.

- Let us go back to the articles which are sensitive in your opinion and contradict with Constitution. Parliament already adopted law through third hearing. What mechanisms can you address? What are you going to do?

- Since the law has been adopted already, our organization cannot take any measure in this regard. Articles 5 and 6 are particularly alarming. They create possibility for processing data of special category and determine the conditions. Unfortunately, we do not have other legal mechanisms of reacting. The only thing our organization can do is monitor how the personal data is protected. However, it cannot do it in relations with private individuals since the General Administrative Code does not apply to them and we do not have right to monitor them. The only possibilities are hoping for conscientious fulfillment of duties by the inspector of personal data and possibility to monitor the public departments. However, it would be very hard for the civil sector to do this because this is a protected sphere and we cannot demand much transparency from them.

- Can it become grounds for Constitutional complaint?

- It can only if there is a sufferer and the data of special category has been disseminated. But, in order to submit constitutional complaint there has to be an individual who suffered by the law.

- How can the law be administered? Especially in case of personal data such as political opinion, religious belief, and sexual life? Can the employees be questioned about their sexual life?

- This is a borderline which is hard to establish. Let us take any media organization which hires an employee. This organization does not need information regarding the political opinion, religious belief and other sensitive data. According to the Labor legislation, employer does not have right to request more documentation and information than needed for the employment. But after the adoption of this law, the employer might say that religious belief of the employee is important for him/her so not to violation their religious rights and determine the labor rights i.e. determine the holidays accordingly. On the one hand, this might be good if I, as a representative of different religion address the employer by my initiative that I want to take days off on certain days. However, this must be my initiative since my religion requires me to take day off on a day different from others. The employer will become obliged to protect my interest if it is my will and desire to disclose information. Otherwise, employer should not be able to obtain this information. According to this law, it is vague to establish this borderline.

- Can this law become the grounds for discrimination when hiring on a certain job?

- This law can become grounds for discrimination of labor rights. However, it is hard to say it singlehandedly. Besides labor agreements, there are other types of relations i.e. civil relations and not only. We think that this law carries a risk. Reacting for each single case is very hard and it will be very hard to prove that discrimination facts occurred in real practice. By presenting our remarks we tried to avoid these risks.

- When you worked on this inference, did you study international practice and what does it say in this regard? Do employers ask for this type of information?

- As a rule, this is a discrimination and it is unacceptable. It is inadmissible to collect this type of information without grounds. Generally, processing this type of information does not have any legitimate aim because it is singlehandedly inadmissible to discriminate in this form. If it is inadmissible, it means that you do not need it for anything and when you have it the danger that it can be used for the discrimination increases.