A company leaked my data: compensation: what to do under Georgian law

What to do

1. Qualification: an obligation was breached. The controller must take technical and organisational measures against loss and unlawful disclosure of data (Law of Georgia on Personal Data Protection, Art. 27). If a bank employee issued the statement, banking secrecy has also been breached: no one may allow access to a client's confidential information or disclose it (Law of Georgia on Commercial Banking Activities, Art. 17). The first step is a written request to the company: the data subject has the right to learn what data is processed and to whom it has been transferred (Law on Personal Data Protection, Art. 13); the response is due no later than 10 business days (extension for no more than 10 business days) (Law on Personal Data Protection, Art. 13).
2. Check whether the company has complied with its obligation: where there is a risk of significant harm, the company must itself notify the data subject of the incident without delay (Law on Personal Data Protection, Art. 30). Silence is a separate argument in a complaint and claim.
3. Complaint: a complaint to the State Audit Office of Georgia (სახელმწიფო აუდიტის სამსახური), a court or a superior body (Law on Personal Data Protection, Art. 22). Do not delay: a violator may be sanctioned no later than 4 months from the violation (from detection for continuing violations) (Law on Personal Data Protection, Art. 65). Sanction: for a data security breach by a company with turnover above GEL 500,000, a warning or a fine of GEL 4,000 (Law on Personal Data Protection, Art. 76). The Service fines and issues instructions, but does not award money to the victim.
4. Compensation is available only through a civil claim against the company: a person who unlawfully and intentionally or negligently causes harm must compensate it (CivC Art. 992); the company is liable for harm caused by the unlawful acts of an employee in performing their duties (CivC Art. 997). Note: moral damage is recoverable only in cases expressly provided by law (CivC Art. 413); for culpable violation of private life, moral damage is also recoverable (CivC Art. 18). Limitation: 3 years from when you learned of the harm or of the liable person (CivC Art. 1008).
5. Intentional leak by an employee: report to the police. A leak of data by a person who is obliged to protect it by virtue of their service is an aggravated crime (CC Art. 157).
6. Where to apply: the company (data protection officer) → State Audit Office → district (city) court; intentional leak: police.
7. Evidence: the request to the company and its reply; the incident notification; screenshots and call records of fraudsters with dates; expenses and other harm.
8. Traps: expecting compensation from the Audit Service, since only a court awards money; looking for a compensation provision in the Personal Data Protection Law, where there isn't one: the basis is the Civil Code; failing to prove the link between the leak and the fraud and the amount of harm.

Be sure to check

• a written request to the company: what leaked and to whom it was transferred, with a reply within 10 business days
• the company's obligation to ensure security and notify the affected persons
• complaint to the State Audit Office: fine and instructions, but no compensation
• compensation (including moral damage) through a civil claim against the company, which is liable for its employee too; limitation of 3 years
• an intentional leak by an employee is a criminal offence; police report