In 2020, in the pre-election period, one of the political parties stated during the briefing that it had more than 750 000 audio recordings collected in the course of citizen polls, as well as almost 1 200 000 voter polling papers containing respondent’s name, surname, place of residence, profession, information on his/her political views, etc. The party also possessed 10 000 photographs of certain respondents depicting them with a polling paper in their hands. According to the political party, all of the information and documents would be given to various international organizations and the representatives of the diplomatic corps accredited in Georgia. In that way, the party attempted to defend its interests and confirm the results of the poll.

The State Inspector’s Service examined the lawfulness of processing respondents’ personal data by the party in the course of the voter polls, including measures taken to ensure security of collected personal data and issues related to informing the data subjects.

In the process of examination, it was found that:

• the citizen polling paper showed their identification data, as well as information about their political opinions. As information about an individual’s political opinions is classified as a special category of data, the law requires written consent of an individual to obtain it. It was found that the party did not have grounds prescribed by the law to process such categories of data;
• To achieve the purpose set by the political party – to understand public opinion about issues interesting for the party and confirm the validity of the polls – it was not necessary to process such volumes of respondents’ data (for instance, name of the respondent, surname, date of birth, ID number) and this was possible without processing the respondents’ identifying data;
• The political party provided the audio recordings depicting the respondents’ telephone conversations to the Central Elections Commission of Georgia, the Parliament of Georgia and to the embassy of one of the countries in Georgia.

After the examination, it was established that the political party processed voters’ personal data in violation of the requirements laid down by Article 4 (principle of data processing), Article 6 (processing of special categories of data) Article 41 (data transfer to the other states) of the law of Georgia on Personal Data Protection. The political party was found to be an administrative offender and was imposed with an administrative fine. Furthermore, the party was obliged to erase (delete) all the materials existing in physical and electronic form containing personal data (including audio recordings) collected in the course of the polls.

The State Inspector’s Service recommends that political parties process personal data only to the extent necessary for achieving legitimate purposes and erase the data after the purpose is achieved.

The voters as data subjects should know that they have the right to:

• Express consent on data processing only voluntarily and in case of expressing consent, be informed about the purposes of processing their data;
• Request from the political parties to stop processing of unlawfully obtained personal data.