Policy of personal data processing by LEPL – National Agency of Public Registry
Personal Data Controller
LEPL under the Ministry of Justice of Georgia – National Agency of Public Registry (hereinafter – the Agency).
Address: Georgia, Tbilisi 0114, N22 Vakhtang Gorgasali St.
Hotline: 2 405 405
E-mail : INFO@NAPR.GOV.GE
Personal Data Protection Officer
Nikita Danko, e-mail: ndanko@napr.gov.ge
Personal Data Processor
LEPL- Public Service Hall (identification number: 204580202; hotline: 2 405 405; e-mail: info@psh.gov.ge), LEPL - Digital Governance Agency (identification number: 204598337; e-mail: info@dga.gov.ge), Authorized persons of the Agency - natural and legal persons authorized by the Agency to maintain the public registry and/or access information based on the contractual relationship. (see https://www.napr.gov.ge/ka/page/authorized-customers)
Personal data subject
For the purposes of this document, the data subject is the applicant and also their representative/parent or other legal representative/supporter, if the applicant applied to the Agency through a representative or the application is submitted on behalf of a support beneficiary/person with disabilities or a minor, as well as individuals specified in the data registered by the National Agency of Public Registry and in the documentation/data stored in the Agency.
Personal data processed by the data controller/data processor
The personal data controller and the personal data processor process the following personal data and special categories of data:
a) The Data Subject’s first name, last name, father's name, personal number, date of birth, place of birth, signature, citizenship, sex, date of death, address of registration, date of registration, date of deregistration, signature, region, series and number and date of issue of all identity documents issued to the person, issuing authority, validity period, photograph, document type, document status (in case of a suspended/cancelled document, indicating the reason), date of document cancellation, phone number, e-mail;
b) Data concerning health - if the application is submitted by or on behalf of the support beneficiary/person with disabilities;
c) Audio/video recording – audio and video is processed when verifying a signature on a transaction by a person who is blind, deaf, hard of hearing or illiterate, also with the purpose of recording of the process of verifying a signature on a contract before the person authorized for the verification of signature using the remote electronic means of communication. Audio can also be processed by the Agency by recording the telephone call for the purpose of quality monitoring;
c1) Facial image (biometric data) – The facial image is processed in the presence of an employee of the Agency authorized to certify signatures when a request is made to certify a signature on a transaction concluded using a remote electronic communication means, for the purpose of verification through an electronic platform for remote identification and verification of individuals;
d) Data related to political views and/or membership of a political union (party) of citizens - in the case of maintaining a register of political unions (parties) of citizens;
e) Data related to religious belief and/or religious association - in cases of submission of application, registration and availability of information in the Register of Entrepreneurs and Non-Entrepreneurial (non-commercial) Legal Entities;
f) Data related to the membership of the professional union - in cases of submission of application, registration and availability of information in the Register of Entrepreneurs and Non-Entrepreneurial (non-commercial) Legal Entities;
g) Data related to criminal records and/or charge/ conviction – for the purpose of registering a right/obligation/subject/public-law restriction in various registers administered by the Agency, when a person himself submits a document containing such data or it is submitted by a court or other administrative bodies;
h) Data of a minor - if the application is submitted on behalf of a person who has reached the age of 16, in case of their consent or the consent of their parent or other legal representative to the processing of the data. Data on minors under the age of 16 are processed with the consent of their parents or other legal representatives, except for the cases expressly provided by law;
i) Special category data of a minor - only on the basis of the written consent of their parent or other legal representative, except for cases expressly provided by law;
j) Data of a deceased person - the data specified in this paragraph about a deceased person are processed if the interested person or the person specified in the registered data/registration documentation is deceased;
k) Any type of personal data and special category data provided by the law, which the interested person himself submits to the agency.
Purpose of processing
The personal data controller and the personal data processor processing process the personal data and special category data listed in paragraph 4 of this document for one or all of the following specific purposes:
a) For the purpose of identifying the interested party, their representative, or the applicant when submitting an application and/or certifying the authenticity of a signature on a transaction, including in cases where a request is made to certify a signature on a transaction concluded using a remote electronic communication means, through an electronic platform for remote identification and verification of individuals. Additionally, for identifying individuals participating in the process of on-site inspection of the immovable property within the framework of systematic and sporadic registration of rights to land plots
b) For the purposes of reviewing the application and other written correspondence, as well as in the administrative proceedings related to the administrative complaint, for the purpose of verifying the data about the applicant/natural person (data subject) participating in the administrative proceedings;
c) For the purpose of verifying the data of the persons specified in the registration documents submitted to the Agency;
d) In order to make appropriate decision regarding the registration of the right/obligation/subject/public-law restriction/economic activity by the Agency in the registers provided for by the law;
e) In order to ensure the availability of data registered by the Agency and documentation/information stored in the Agency;
f) In order to ensure the publicity of the data registered by the agency and the documentation/information stored in the Agency, on the following official websites:
f.a) napr.gov.ge;
f.b) my.gov.ge;
f.c) maps.gov.ge;
f.d) slr.napr.gov.ge.
g) In case of requesting information and/or documentation from other administrative bodies and notary bureaus for the purpose of considering the application of the data subject and making a decision on the case;
h) for written/oral communication with the interested person, as well as to provide the interested person with information about the progress and completion of the proceeding. The phone number of the interested person is processed to deliver the correspondence sent on behalf of the Agency, and also to send the SMS (sender’s name – “Reestri”) for the verification of the interested person;
i) for the creation and administration of an authorized user page - electronic address for the data subject on the unified electronic portal;
j) in order to capture the progress of the process of making a protocol record during an oral hearing or an on-site inspection by an authorized employee of the Agency in connection with the administrative complaint submitted to the Agency;
k) for the purpose of quality monitoring by the Agency.
Legal bases of processing
Law of Georgia on “Personal Data Protection” [1]
A) Article 5 Paragraph 1 Subparagraphs „a“, „b“, „c“, „d“, „e“ and „j“:
Data processing shall be admissible if:
a) the data subject has given consent to the processing of data concerning him/her for one or more specific purposes;
b) data processing is necessary to fulfill the obligation assumed by the contract concluded with the data subject or to enter into a contract at the request of the data subject;
c) data processing is provided for by Law;
d) data processing is necessary for a data controller to perform his/her statutory duties assigned by the legislation of Georgia;
e) according to the Law, data are publicly available or a data subject has made them publicly available;
j) data processing is necessary to review the application of a data subject (to provide services to him/her).
B) Article 6, Paragraph 1, Subparagraphs „a“, „b“ and „j“:
The processing of special categories of data shall be permitted only if the data controller provides safeguards for the rights and interests of the data subject as provided for by this Law and if one of the following grounds exists:
a) the data subject has given consent to the processing of the special category data for one or more specified purposes;
b) the processing of special categories of data is expressly and specifically regulated by law, and their processing is a necessary and proportionate measure in a democratic society;
j) the processing of special categories of data is necessary to protect substantial public interests.
C) Article 7 Paragraphs 1 and 3
„1. The processing of data relating to a minor shall be permitted on the basis of his/her consent if he/she has attained the age of 16, and the processing of data relating to a minor under the age of 16 shall be permitted with the consent of his/her parent or other legal representative, except in cases expressly provided for by law, including where the consent of a minor between the ages of 16 and 18 and his/her parent or other legal representative is required for the processing of data.
3. The processing of special categories of data relating to a minor shall be permitted only on the basis of the written consent of the minor’s parent or other legal representative, except in cases expressly provided for by law”.
D) Article 8 Paragraph 1 Subparagraphs “a” and “d” and Paragraph 2:
„1. After a data subject dies, the processing of data concerning him/her shall be permitted:
a) on the grounds specified in Articles 5 and 6 of this Law;
d)if this is necessary to exercise an inheritance right.
The processing of the name, surname, sex, date of birth and date of death of a deceased person shall be permitted irrespective of the circumstances and grounds as provided for by paragraph 1 of this article“.
D) Article 9 Paragraph 1
“1. Biometric data may be processed only if this is necessary for the purposes of carrying out activities, security, protection of property and prevention of the disclosure of secret information, and these purposes cannot be achieved by other means or involve disproportionate effort, as well as for the purposes of issuing an identity document in accordance with law, identifying a person crossing the state border, combating illegal migration, implementation of international protection, crime prevention, investigation, prosecution, administration of justice, the enforcement of detention and imprisonment, the execution of non-custodial sentences and probation, the re-socialisation and rehabilitation of convicted persons and former prisoners, the coordination of the process of the referral of minors, the conduct of operative and investigative activities, and ensuring information security and cyber security and in other cases expressly provided for by law.”.
F) Articles 10 and 11.
Informing the data subject where data are not collected directly from him/her
According to Article 25 Paragraph 3 Subparagraphs “b” and “c” the Agency is entitled not to provide the data subject with information on the processing of his/her data, if the data is not collected directly from him/her and:
„b) the collection or disclosure of the data is established by law or required for the performance of statutory duties;
c)the information cannot be provided or involves disproportionate effort, or the fulfilment of the obligation under this article would seriously impair or render impossible the achievement of the legitimate purpose(s) of the processing. In such cases, the person responsible for processing shall take appropriate measures to protect the rights and legitimate interests of the data subject, including by making general information about the collection of data publicly available/publishing general information about the collection of data in an easily accessible form.”
In case provided for by Article 25 Paragraph 3 Subparagraph “c” of the Law of Georgia on Personal Data Protection, personal data of the subject is processed through the electronic database of the Public Service Development Agency. Personal data may be processed by the Agency to fulfill its obligations under the law, among them during the systematic and sporadic registration provided by the law of Georgia “on the Improvement of Cadastral Data and the Procedure for Systematic and Sporadic Registration of Rights to Plots of Land” the data of the subject can also be processed based on the indication of the representative of the municipality and/or the owner of another plot of land /person with the right to request the registration of the property right located in the relevant geographical area, or when searching for data within the framework of the registration process by the Agency, in order to fulfill the registration obligation provided by the law.
Mandatory nature of data provision
Provision of data listed in Paragraph 4 of this Document to the data controller and the data processor is obligatory/mandatory.
The provision of data is obligatory/mandatory, since the processing of data by the Agency for the above-mentioned purposes is provided for by the legislation of Georgia in order to consider the application of the data subject/provide services or the data is required to provide the data subject with the information about the progress and completion of the proceeding.
In case of data subject's refusal to provide data, the Agency is entitled not to register the application in the special electronic program (refuse to accept the application) or to make a decision on refusal to register/provide information.
Data recipient or recipient category
In accordance with Article 6 Paragraph 1 of the Law of Georgia on Public Registry data registered in at the Public Registry and kept at a registration body shall be public and available for any person for viewing, except where provided for by the legislation of Georgia. Thus, the data recipient is any person who requests information about data registered by the Agency or documents kept in the agency.
Data retention period
The personal data and special category data listed in paragraph 4 of this document are stored by the Agency in order to fulfill its obligations under the legislation of Georgia according to the time periods specified in “The list of typical governance documents created in the course of the activities of the institutions (indicating their storage periods)" approved by Annex №1 to the Order N72 of 31 March 2010 of the Ministry of Justice of Georgia.
Rights of data subject
The data subject enjoys the following rights provided by Chapter 3 of the Law of Georgia on Personal Data Protection:
a) Right to receive information on the processing of data (Article 13);
b) Right to access data and to obtain a copy (Article 14);
c) Right to the rectification, update and completion of data (Article 15);
d) Right to the termination of the processing, erasure or destruction of data (Article 16);
e) Right to the blocking of data (Article 17);
f) Right to the transmission of data (Article 18);
g) Automated individual decision-making and related rights (Article 19);
h) Right to withdraw consent (Article 20);
i) Right to appeal (Article 22).
The rights listed above are not absolute and may be restricted in the cases provided for by the Law of Georgia on Personal Data Protection and in accordance with the established procedure.
Restriction of the rights of data subjects
a) Data registered by the Agency and/or specified in the documentation kept by the Agency are not subject to deletion, destruction or blocking. Regardless of the request of the applicant, due to fulfillment by the Agency of the duties assigned to it under the legislation of Georgia, it is not allowed to terminate data processing and/or withdraw consent to processing.
b) The data registered by the Agency and/or specified in the documentation kept by the Agency are not subject to transfer to another person responsible for processing, since in accordance with the legislation of Georgia, the Agency is the sole administrative body authorized and responsible for the administration of the public register.
c) According to Article 21 of the Law of Georgia on Personal Data Protection:
„1. The rights of the data subject under Articles 13-20, 24 and 25 of this Law may be restricted if this is expressly provided for by the legislation of Georgia, does not violate fundamental human rights and freedoms, and is a necessary and proportionate measure in a democratic society, and the exercise of these rights may jeopardize:
a) national security, information security and cyber security and/or defence interests;
b) public safety interests;
c) crime prevention, investigation, prosecution, the administration of justice, the enforcement of detention and imprisonment, the execution of non-custodial sentences and probation, and the conduct of operative and investigative activities;
d) interests relating to financial or economic (including monetary, budgetary and taxation), public health and social protection issues of importance to the country;
e) the detection of the data subject’s violations of professional ethical standards, including those of a regulated profession, and the imposition of liability on the data subject;
f) the exercise of the functions and powers of regulatory and/or supervisory bodies in the areas defined by paragraph 1(a), (b), (c), (d), (e), (g) or (i) of this article;
g) the protection of the rights and freedoms, including freedom of expression, of the data subject and others;
h) the protection of state, commercial, professional and other secrets provided for by law;
i) the substantiation of a legal claim or a statement of defence.
A measure under paragraph 1 of this article may be applied only to the extent necessary to achieve the purpose of the restriction.
If the grounds under paragraph 1 of this article exist, the decision of the person responsible for processing to restrict, or to refuse the exercise of, the rights of the data subject shall be notified to the data subject, except where the provision of the information would jeopardise the purpose (purposes) of the restriction of the right stipulated by Paragraph 1 of this Article.
The exercise by the data subject of the rights as provided for by Articles 13-20, 24 and 25 of this Law shall be free of charge, subject to the exceptions established by this Law. Where the data subject makes an unreasonable number of requests, the person responsible for processing may refuse to comply with the request, in which case he/she shall immediately inform the data subject in writing and explain to him/her his/her right to appeal.”
Transfer of data to another state and international organization
The transfer of data to another state or international organization is carried out within the framework of the obligations based on "Convention on Legal Aid and Legal Relations in Civil, Family and Criminal Cases " and other international bilateral and multilateral agreements, in accordance with the referral of authorized bodies and/or if the requirements for data processing provided for by this Law and appropriate safeguards in the relevant state or international organisation are in place for ensuring data protection and the protection of data subjects’ rights.
Right to Appeal
If the rights as provided for and the rules established by the Law of Georgia on Personal Data Protection are violated, the data subject shall have the right to apply to the Agency, Personal Data Protection Service, -and/or to a court in accordance with procedures established by law.
The full version of the Law of Georgia "On Personal Data Protection" of June 14, 2023 No. 3144-XIმს-Xმპ (Legislative Herald of Georgia (www.matsne.gov.ge), 03.07.2023, registration code: 010100000.05.001.020936) is publicly available in the Legislative Herald of Georgia through the following link: https://matsne.gov.ge/document/view/5827307?publication=0
