The examination revealed that the doctor had posted the photos of the patient (the applicant) disclosing the patient’s conditions after and before the rhinoplasty, with the text describing health conditions on his private Facebook and Instagram accounts. Despite blurring the eyes of the patient on the photos, other facial features made it easy to identify her.

In the course of the investigation of the case, it was revealed that at the opening of medical history, the patient (the applicant) expressed written consent on publishing his/her photos on social media. However, later, before the surgery, she refused that her photos be used for advertising purposes through same means (in writing).

The doctor could not provide the legal basis prescribed by the law for disclosing photos and information revealing the patient’s (applicant) health data. He appealed on the patient’s initial consent based on which he/she had stored the photos in the computer folder in which he had stored patients’ photos who had expressed consent on the use of their photos for marketing purposes. Additionally, according to the doctor’s explanations, the text attached to the photograph had not referred to the particular patient but was rather a medical-scientific-popular description of the information about nose surgery which was identical to the texts on other patients’ photos posted by him on social media.

Based on the inspection carried out by the State Inspector’s Service, it was established that the doctor was not permitted (nor was he instructed) to post the mentioned information on social media by the medical institution, thus acted independently of the clinic conducting the medical procedures.

According to the State Inspector, protection of health data is important both for protecting privacy and data of the patient and maintaining public trust towards the medical profession and the healthcare system. It is mentioned in the decision of the State Inspector that individuals are especially sensitive to the issue of disclosing information about rhinoplasty to third parties, especially to publishing in a form accessible to everyone. Additionally, the law of Georgia on Personal Data Protection obliges everyone to observe the principle laid down by the law – to process data subject’s accurate and real data. Since in this case, the text on the photograph did not refer to the patient, it was not accurate and real.

In the light of the above, a fine in the amount of 1 000 (thousand) Lari was imposed on a doctor as a form of an administrative liability prescribed by paragraphs 1 of Articles 44 and 44 of the law of Georgia on personal data protection for disclosure of patient’s (applicant) health data without a legal basis and violating the principles laid down by the law during processing patient’s data (processing patient’s inaccurate data).