Policy of personal data processing by LEPL – National Agency of Public Registry
Personal Data Controller
LEPL under the Ministry of Justice of Georgia – National Agency of Public Registry (hereinafter – the Agency).
Address: Georgia, Tbilisi 0114, N22 Vakhtang Gorgasali St.
Hotline: 2 405 405
E-mail : INFO@NAPR.GOV.GE
Personal Data Protection Officer
Nikita Danko, e-mail: ndanko@napr.gov.ge
Personal Data Processor
LEPL- Public Service Hall (identification number: 204580202; hotline: 2 405 405; e-mail: info@psh.gov.ge), LEPL - Digital Governance Agency (identification number: 204598337; e-mail: info@dga.gov.ge), Authorized persons of the Agency - natural and legal persons authorized by the Agency to maintain the public registry and/or access information based on the contractual relationship. (see https://www.napr.gov.ge/ka/page/authorized-customers)
Within the framework of providing local and international postal and courier services to the Agency - "Georgian Post" LLC (identification number 203836233); Telephone: +995 (32) 224 09 09.
Within the scope of the "smart contract" service, Identomat Inc. (Reg. Number: SR 20204194256); Email: info@identomat.com; zk@identomat.com; Phone: +13048044050; +14352137667.
Personal data subject
For the purposes of this document, a data subject is:
a) the applicant or interested person;
b) the representative of the applicant or interested person, including a parent, other legal representative, or supporter;
c) the natural person on whose behalf the application is submitted (including a minor, a recipient of support, or a person with disabilities);
d) a natural person specified in the data or documentation registered, submitted, or stored with the Agency.
Personal data processed by the data controller/data processor
The personal data controller and the personal data processor process the following personal data and special categories of data:
a) The Data Subject’s first name, last name, father's name, personal number, date of birth, place of birth, signature, citizenship, sex, date of death, address of registration, date of registration, date of deregistration, signature, region, series and number and date of issue of all identity documents issued to the person, issuing authority, validity period, photograph, document type, document status (in case of a suspended/cancelled document, indicating the reason), date of document cancellation, phone number, e-mail;
b) Data concerning health - if the application is submitted by or on behalf of the support beneficiary/person with disabilities;
c) Audio/video recording – audio and video is processed when verifying a signature on a transaction by a person who is blind, deaf, hard of hearing or illiterate, also with the purpose of recording of the process of verifying a signature on a contract before the person authorized for the verification of signature using the remote electronic means of communication. Audio can also be processed by the Agency by recording the telephone call for the purpose of quality monitoring;
c1) Facial image (biometric data) – The facial image is processed in the presence of an employee of the Agency authorized to certify signatures when a request is made to certify a signature on a transaction concluded using a remote electronic communication means, for the purpose of verification through an electronic platform for remote identification and verification of individuals;
d) Data related to political views and/or membership of a political union (party) of citizens - in the case of maintaining a register of political unions (parties) of citizens;
e) Data related to religious belief and/or religious association - in cases of submission of application, registration and availability of information in the Register of Entrepreneurs and Non-Entrepreneurial (non-commercial) Legal Entities;
f) Data related to the membership of the professional union - in cases of submission of application, registration and availability of information in the Register of Entrepreneurs and Non-Entrepreneurial (non-commercial) Legal Entities;
g) data related to criminal convictions, charges, or sentencing – in cases of registration/accounting of a right, obligation, subject, public-law restriction, and/or prohibition in various registries maintained by the Agency, where the person personally submits a document containing such data or where such document is submitted by a court or another administrative authority;
h) Data of a minor - the data specified in this paragraph concerning a minor shall be processed if the data subject is a minor;
i) Special category data of a minor - only on the basis of the written consent of their parent or other legal representative, except for cases expressly provided by law;
j) Data of a deceased person - the data specified in this paragraph concerning a deceased person shall be processed if the data subject is deceased;
k) the above-mentioned data registered and stored with the Agency, as well as any other personal data provided for by law, which the data subject or another person/administrative authority personally submits to the Agency.
Purpose of processing
The personal data controller and the personal data processor processing process the personal data and special category data listed in paragraph 4 of this document for one or all of the following specific purposes:
a) For the purpose of identifying the interested party, their representative, or the applicant when submitting an application and/or certifying the authenticity of a signature on a transaction, including in cases where a request is made to certify a signature on a transaction concluded using a remote electronic communication means, through an electronic platform for remote identification and verification of individuals. Additionally, for identifying individuals participating in the process of on-site inspection of the immovable property within the framework of systematic and sporadic registration of rights to land plots
b) for the purpose of reviewing applications and other written correspondence, as well as for verifying the data of the applicant/data subject participating in administrative proceedings related to an administrative complaint;
c) For the purpose of verifying the data of the persons specified in the registration documents submitted to the Agency;
d) for the purpose of making an appropriate decision or carrying out registration/accounting by the Agency regarding a right, obligation, subject, public-law restriction and/or prohibition, or economic activity in the registries provided for by legislation;
e) In order to ensure the availability of data registered by the Agency and documentation/information stored in the Agency;
f) In order to ensure the publicity of the data registered by the agency and the documentation/information stored in the Agency, on the following official websites:
f.a) napr.gov.ge;
f.b) my.gov.ge;
f.c) maps.gov.ge;
f.d) slr.napr.gov.ge.
g) In case of requesting information and/or documentation from other administrative bodies and notary bureaus for the purpose of considering the application of the data subject and making a decision on the case;
h) for the purpose of written and oral communication with the interested person, as well as for providing information regarding the progress and completion of proceedings, the telephone number indicated by the interested person shall also be processed for the purpose of delivering correspondence sent on behalf of the Agency, sending short text messages on behalf of the Agency (sender name – “Reestri”) for the verification of the interested person, as well as for providing such information to an administrative body involved in the administrative proceedings for the purpose of reviewing the application/correspondence of the interested person;
i) for the creation and administration of an authorized user page - electronic address for the data subject on the unified electronic portal;
i1) with the consent of the data subject, for the purpose of providing the selected bank(s) with a request to open a bank account and the contact telephone number, together with the data registered in the Registry of Entrepreneurs and Non-Entrepreneurial (Non-Commercial) Legal Entities;
j) in order to capture the progress of the process of making a protocol record during an oral hearing or an on-site inspection by an authorized employee of the Agency in connection with the administrative complaint submitted to the Agency;
k) for the purpose of quality monitoring by the Agency.
Legal bases of processing
Law of Georgia on “Personal Data Protection” [1]
a) Subparagraphs “a”, “b”, “c”, “d”, “e”, “g”, and “k” of Paragraph 1 of Article 5:
Data processing shall be admissible if:
a) the data subject has given consent to the processing of data concerning him/her for one or more specific purposes;
b) data processing is necessary to fulfill the obligation assumed by the contract concluded with the data subject or to enter into a contract at the request of the data subject;
c) data processing is provided for by Law;
d) data processing is necessary for a data controller to perform his/her statutory duties assigned by the legislation of Georgia;
e) according to the Law, data are publicly available or a data subject has made them publicly available;
g) data processing is necessary for the protection of an important public interest;
j) data processing is necessary to review the application of a data subject (to provide services to him/her).
B) Article 6, Paragraph 1, Subparagraphs „a“, „b“ and „j“:
The processing of special categories of data shall be permitted only if the data controller provides safeguards for the rights and interests of the data subject as provided for by this Law and if one of the following grounds exists:
a) the data subject has given consent to the processing of the special category data for one or more specified purposes;
b) the processing of special categories of data is expressly and specifically regulated by law, and their processing is a necessary and proportionate measure in a democratic society;
j) the processing of special categories of data is necessary to protect substantial public interests.
C) Article 7 Paragraphs 1 and 3
„1. The processing of data relating to a minor shall be permitted on the basis of his/her consent if he/she has attained the age of 16, and the processing of data relating to a minor under the age of 16 shall be permitted with the consent of his/her parent or other legal representative, except in cases expressly provided for by law, including where the consent of a minor between the ages of 16 and 18 and his/her parent or other legal representative is required for the processing of data.
3. The processing of special categories of data relating to a minor shall be permitted only on the basis of the written consent of the minor’s parent or other legal representative, except in cases expressly provided for by law”.
D) Article 8 Paragraph 1 Subparagraphs “a” and “d” and Paragraph 2:
„1. After a data subject dies, the processing of data concerning him/her shall be permitted:
a) on the grounds specified in Articles 5 and 6 of this Law;
d)if this is necessary to exercise an inheritance right.
The processing of the name, surname, sex, date of birth and date of death of a deceased person shall be permitted irrespective of the circumstances and grounds as provided for by paragraph 1 of this article“.
D) Article 9 Paragraph 1
“1. Biometric data may be processed only if this is necessary for the purposes of carrying out activities, security, protection of property and prevention of the disclosure of secret information, and these purposes cannot be achieved by other means or involve disproportionate effort, as well as for the purposes of issuing an identity document in accordance with law, identifying a person crossing the state border, combating illegal migration, implementation of international protection, crime prevention, investigation, prosecution, administration of justice, the enforcement of detention and imprisonment, the execution of non-custodial sentences and probation, the re-socialisation and rehabilitation of convicted persons and former prisoners, the coordination of the process of the referral of minors, the conduct of operative and investigative activities, and ensuring information security and cyber security and in other cases expressly provided for by law.”.
F) Articles 10 and 11.
Informing the data subject where data are not collected directly from him/her
According to Article 25 Paragraph 3 Subparagraphs “b” and “c” the Agency is entitled not to provide the data subject with information on the processing of his/her data, if the data is not collected directly from him/her and:
„b) the collection or disclosure of the data is established by law or required for the performance of statutory duties;
c)the information cannot be provided or involves disproportionate effort, or the fulfilment of the obligation under this article would seriously impair or render impossible the achievement of the legitimate purpose(s) of the processing. In such cases, the person responsible for processing shall take appropriate measures to protect the rights and legitimate interests of the data subject, including by making general information about the collection of data publicly available/publishing general information about the collection of data in an easily accessible form.”
In case provided for by Article 25 Paragraph 3 Subparagraph “c” of the Law of Georgia on Personal Data Protection, personal data of the subject is processed through the electronic database of the Public Service Development Agency. Personal data may be processed by the Agency to fulfill its obligations under the law, among them during the systematic and sporadic registration provided by the law of Georgia “on the Improvement of Cadastral Data and the Procedure for Systematic and Sporadic Registration of Rights to Plots of Land” the data of the subject can also be processed based on the indication of the representative of the municipality and/or the owner of another plot of land /person with the right to request the registration of the property right located in the relevant geographical area, or when searching for data within the framework of the registration process by the Agency, in order to fulfill the registration obligation provided by the law.
Mandatory nature of data provision
Providing the data listed in Paragraph 4 of this document to the person responsible for processing and the person authorized to process the data may be necessary/mandatory for the processing purposes.
In case of data subject's refusal to provide data, the Agency is entitled not to register the application in the special electronic program (refuse to accept the application) or to make a decision on refusal to register/provide information.
Data recipient or recipient category
In accordance with Article 6 Paragraph 1 of the Law of Georgia on Public Registry data registered in at the Public Registry and kept at a registration body shall be public and available for any person for viewing, except where provided for by the legislation of Georgia. Thus, the data recipient is any person who requests information about data registered by the Agency or documents kept in the agency.
Data retention period
The personal data and special category data listed in paragraph 4 of this document are stored by the Agency in order to fulfill its obligations under the legislation of Georgia according to the time periods specified in “The list of typical governance documents created in the course of the activities of the institutions (indicating their storage periods)" approved by Annex №1 to the Order N72 of 31 March 2010 of the Ministry of Justice of Georgia.
Biometric data used in the remote identification and verification process within the Smart Contract service is not stored.
Rights of data subject
The data subject enjoys the following rights provided by Chapter 3 of the Law of Georgia on Personal Data Protection:
• Right to receive information about data processing (Article 13) — The data subject has the right to request confirmation of whether their data is being processed and whether such processing is justified. They also have the right to receive, free of charge, other information related to the processing;
• Right of access to data and to obtain a copy (Article 14) — The data subject has the right to access their personal data and obtain copies of such data;
• Right to rectification, updating, and completion of data (Article 15) — The data subject has the right to request correction, updating, and/or completion of inaccurate, incorrect, and/or incomplete data concerning them;
• Right to restriction of processing, deletion, or destruction of data (Article 16) — The data subject has the right to request the restriction of processing, deletion, or destruction of their personal data;
• Right to data blocking (Article 17) — The data subject has the right to request blocking of data, i.e., temporary suspension of data processing (except for storage);
• Right to data portability (Article 18) — Where technically feasible, the data subject has the right to receive their provided data in a structured, commonly used, and machine-readable format or request that such data be transferred to another data controller;
• Rights related to automated individual decision-making (Article 19) — The data subject has the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significant consequences;
• Right to withdraw consent (Article 20) — The data subject has the right to withdraw consent for the processing of personal data at any time, without providing any explanation or justification;
• Right to lodge a complaint (Article 22) — The data subject has the right, in case of violation of their rights and the rules established by the Law on Personal Data Protection, to apply to the Agency, the State Audit Office, and/or the court.
The rights listed above are not absolute and may be restricted in the cases provided for by the Law of Georgia on Personal Data Protection and in accordance with the established procedure.
Restriction of the rights of data subjects
a) Data registered by the Agency and/or specified in the documentation kept by the Agency are not subject to deletion, destruction or blocking. Regardless of the request of the applicant, due to fulfillment by the Agency of the duties assigned to it under the legislation of Georgia, it is not allowed to terminate data processing and/or withdraw consent to processing.
b) The data registered by the Agency and/or specified in the documentation kept by the Agency are not subject to transfer to another person responsible for processing, since in accordance with the legislation of Georgia, the Agency is the sole administrative body authorized and responsible for the administration of the public register.
c) According to Article 21 of the Law of Georgia on Personal Data Protection:
„1. The rights of the data subject under Articles 13-20, 24 and 25 of this Law may be restricted if this is expressly provided for by the legislation of Georgia, does not violate fundamental human rights and freedoms, and is a necessary and proportionate measure in a democratic society, and the exercise of these rights may jeopardize:
a) national security, information security and cyber security and/or defence interests;
b) public safety interests;
c) crime prevention, investigation, prosecution, the administration of justice, the enforcement of detention and imprisonment, the execution of non-custodial sentences and probation, and the conduct of operative and investigative activities;
d) interests relating to financial or economic (including monetary, budgetary and taxation), public health and social protection issues of importance to the country;
e) the detection of the data subject’s violations of professional ethical standards, including those of a regulated profession, and the imposition of liability on the data subject;
f) the exercise of the functions and powers of regulatory and/or supervisory bodies in the areas defined by paragraph 1(a), (b), (c), (d), (e), (g) or (i) of this article;
g) the protection of the rights and freedoms, including freedom of expression, of the data subject and others;
h) the protection of state, commercial, professional and other secrets provided for by law;
i) the substantiation of a legal claim or a statement of defence.
A measure under paragraph 1 of this article may be applied only to the extent necessary to achieve the purpose of the restriction.
If the grounds under paragraph 1 of this article exist, the decision of the person responsible for processing to restrict, or to refuse the exercise of, the rights of the data subject shall be notified to the data subject, except where the provision of the information would jeopardise the purpose (purposes) of the restriction of the right stipulated by Paragraph 1 of this Article.
The exercise by the data subject of the rights as provided for by Articles 13-20, 24 and 25 of this Law shall be free of charge, subject to the exceptions established by this Law. Where the data subject makes an unreasonable number of requests, the person responsible for processing may refuse to comply with the request, in which case he/she shall immediately inform the data subject in writing and explain to him/her his/her right to appeal.”
Transfer of data to another state and international organization
The transfer of data to another state or international organization is carried out within the framework of the obligations based on "Convention on Legal Aid and Legal Relations in Civil, Family and Criminal Cases " and other international bilateral and multilateral agreements, in accordance with the referral of authorized bodies and/or if the requirements for data processing provided for by this Law and appropriate safeguards in the relevant state or international organisation are in place for ensuring data protection and the protection of data subjects’ rights.
Right to Appeal
The data subject has the right, in case of violation of the rights and established rules provided for by the Law of Georgia "On Personal Data Protection", to apply to the Agency, the State Audit Office and/or the court in accordance with the procedure established by law.
The full version of the Law of Georgia "On Personal Data Protection" of June 14, 2023 No. 3144-XIმს-Xმპ (Legislative Herald of Georgia (www.matsne.gov.ge), 03.07.2023, registration code: 010100000.05.001.020936) is publicly available in the Legislative Herald of Georgia through the following link: https://matsne.gov.ge/document/view/5827307?publication=0
