Journal №1-2 (2025)

Welcome Letter

∘ Lela Janashvili ∘


We are pleased to present the combined first and second editions of the Journal of Personal Data Protection Law for the current year, dedicated to the 33rd European Conference of Data Protection Authorities – the Spring Conference and the 75th meeting of the International Working Group on Data Protection in Technology (“Berlin Working Group”, “IWGDPT”). Notably, in the current year, the Personal Data Protection Service served as the host institution for both international events. See in ...
2025-12-12
Journal №1-2 (2025)

Facial Recognition Technology: Navigating Privacy Rights and Regulatory Challenges

∘ Sharon Azarya ∘


Abstract

Facial recognition technology has rapidly evolved from a futuristic concept to an everyday reality, permeating both public and private sectors across the globe. While proponents highlight its potential to enhance security and streamline services, critics warn of unprecedented threats to privacy, human rights, and social equity. The International Working Group on Data Protection in Technology, commonly known as the Berlin Group, has produced a comprehensive working paper that examines these competing concerns and proposes a framework for responsible governance of this transformative technology. See in ...
2025-12-12
Journal №1-2 (2025)

Data Protection and Privacy in Smart Cities: A Critical Analysis of the IWGDPT Working Paper

∘ Sharon Azarya ∘


Abstract

The rapid digitalization of urban environments has transformed cities into complex ecosystems of data collection, analysis, and automated decision-making. The International Working Group on Data Protection in Technology (IWGDPT) addresses this transformation in their working paper "Smart Cities," which provides a comprehensive framework for understanding the data protection challenges inherent in smart city development. This essay examines the paper's key contributions to the discourse on urban digitalization, analyzing its tripartite framework of data collection, analysis, and decision-making, while evaluating the practical implications of its recommendations for cities, industry, and regulators. See in ...
2025-12-12
Journal №1-2 (2025)

The Historical Roots of Data Protection – How It Came About!

∘ Norbert Bernsdorff ∘


Abstract

The article discusses the historical roots of data protection, which trace back literally to antiquity. It introduces the foundations of data protection terminology, early and modern-day forms of data protection and its progress throughout the years. Special emphasis is put on the emergence of data protection regulatory frameworks since 1970, from Germany to modern-time legal instruments that form the EU and Council of Europe’s frameworks on data protection and privacy. See in ...
2025-12-12
Journal №1-2 (2025)

The “State of Play” of Data Protection in Georgia – 2024 Communication on EU Enlargement Policy

∘ Norbert Bernsdorff ∘


Abstract

The article discusses the main findings of the EU Commission’s recent staff-working document “Georgia 2024 Report”, which assesses the country’s progress since December 2023, when the European Council granted Georgia candidate status. The paper aims to contemplate the main findings and assessments concluded in the Report regarding Georgia’s progress in aligning the data protection legal framework with the EU acquis. Furthermore, the paper suggests a legal analysis of the EU Commission’s conclusions on Georgia’s legal compliance with the Council of Europe’s legal instruments on data protection. Lastly, a specific chapter is dedicated to discussing the Georgian data protection authority’s effectiveness in ensuring the protection of personal data and its supervisory role. See in ...
2025-12-12
Journal №1-2 (2025)

Privacy, Ethics and Collaboration: the Roles of DPAs in AI development

∘ Maxime Gennart ∘


Abstract

First of all, I would like to thank the personal data protection service of Georgia for this very interesting three days and the warm welcome in Batumi. I also would like to thank them for giving me the opportunity of presenting with such a distinguished panel of speakers on the topic of Privacy, Ethics, and Collaboration: the roles of DPAs in AI development. For those of you whom I have not had the honor to meet, my name is Maxime Gennart, I am a legal advisor at the Belgian data protection authority and a member of its AI task force. In this role, I am involved in setting up the Belgian national framework for AI governance, and it is on this topic I wanted to talk to you today. See in ...
2025-12-12
Journal №1-2 (2025)

Reconciling Data Minimization with Model Maximization: Regulatory and Ethical Tensions in AI Development

∘ Agnieszka Grzelak ∘


Abstract

The rapid advancement of large-scale artificial intelligence (AI) systems, particularly large language models (LLMs), has created profound regulatory tensions in the realm of data protection. Central to this discourse is the conflict between the principles of data minimization, as enshrined in the General Data Protection Regulation (GDPR), and the data-intensive logic underpinning AI model development. This article explores some aspects of the legal, practical, and ethical implications of this tension from the perspective of data protection authorities (DPAs), analyzing current enforcement trends, regulatory guidance, and the prospective impact of the EU Artificial Intelligence Act. It argues that DPAs must evolve beyond traditional enforcement roles to become ethical stewards and proactive coordinators of AI governance in Europe to ensure that the fundamental principles are not weakened or ignored in the name of innovation. See in ...
2025-12-12
Journal №1-2 (2025)

Personal Data Protection in the Activities of Law Enforcement Bodies

∘ Koba Grialashvili ∘


Abstract

Globalization has introduced new challenges in the field of personal data processing, significantly increasing its overall scale. In this context, it is particularly important to highlight the extensive processing of personal data by law enforcement bodies. In order to fulfil their legally assigned powers, these agencies are authorized to obtain data from both open and covert sources and to process it through various means. Technological advancements have further enabled law enforcement bodies to process personal data on an unprecedented scale. This article will focus on data processing standards, taking into account the specific nature of law enforcement activities. Such processing requires maintaining an appropriate balance between the objectives of protecting public security interests and safeguarding the rights of data subjects.   This paper will examine Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of ...
2025-12-12
Journal №1-2 (2025)

Group Privacy, Data and AI: Collective Forms of Privacy and Its Relationship to Technology and Policy Frameworks

∘ Pam Dixon ∘


Abstract

Collective privacy refers to the privacy interests of a group of people. As AI systems have advanced in capacity to analyze and segment people into groups with predictable behaviors, collective privacy has become increasingly relevant. However, there is a governance gap: while some indigenous governance frameworks such as those of the Māori acknowledge a right to collective privacy, the majority of privacy laws effectuate privacy primarily at an individual level, not a collective level. Europe's GDPR, adopted in some form in most regions of the world, exemplifies an individual privacy approach. This paper defines group privacy and analyzes the complex socio-technical environments underlying the collective privacy gap. The paper examines key case studies highlighting diverse aspects of collective privacy: the Māori algorithm charter with the New Zealand government, the All of US genetic data biobank policies, and the European Court of Human Rights case Lewit v. Austria. See in ...
2025-12-12
Journal №1-2 (2025)

A Framework for Privacy-Enhancing Technologies Implementations in Trustworthy Data Sharing

∘ Giuseppe D’Acquisto ∘ Ludovica De Benedetti ∘


Abstract

Data represent essential assets for organizations, enabling them to pursue their specific objectives and to generate direct value. For instance, data may be collected and analyzed to improve customer experiences, optimize business operations, or foster innovation in the organization’s interest. However, the value of data frequently extends beyond the organizations that originally collect and use them. When combined with other sources, data can generate new insights, support the development of novel products and services, and stimulate both social and economic growth. In this way, additional value can be extracted from the same dataset, beyond its initial purpose. See in ...
2025-12-12
Journal №1-2 (2025)

Working Paper on Large Language Models (LLMs)

∘ David Weinkauf ∘


Abstract

Large language models (LLMs) are extremely large, complex machine learning systems capable of routinely generating highly articulate, plausible-sounding—but not necessarily true—linguistic content in response to queries. This paper provides an in-depth, multifaceted analysis of LLMs to help data protection authorities effectively regulate and respond to the challenges of this new technology. The analysis is undertaken from three perspectives: (1) the technology itself, that is, how LLMs fundamentally work and are developed; (2) the privacy and data protection risks raised by them; and (3) the emerging set of best practices to reduce or eliminate these risks. See in ...
2025-12-12
Journal №1-2 (2025)

Selected Aspects of International Cooperation under the New Swiss Federal Act on Data Protection

∘ Petru Emanuel Zlătescu ∘


Abstract

The totally revised Swiss Federal Act on Data Protection (FADP) aims at strengthening the data protection of individuals in Switzerland, in particular through the alignment with the latest developments in data protection law at international level on the one hand, as well as through the adaptation to the latest technological developments on the other. This also extends to the enhancement of the powers of the Federal Data Protection and Information Commissioner (FDPIC). In addition to the consolidation of independence and autonomy from external instruction, the new FADP has also equipped the FDPIC with a range of new competencies in the domain of international cooperation. The cornerstones of this area are the international administrative assistance between data protection authorities and the direct delivery of documents abroad. The two legal concepts under discussion are both based fundamentally on the principle of reciprocity. See in ...
2025-12-12
Journal №1-2 (2025)

International Cooperation: Expanding Capacity, Amplifying Impact

∘ Rachel Masterton ∘


Abstract

The processing of personal data is often on a global scale with global impacts. Regulation, on the other hand, has been constructed according to geographical boundaries.  International cooperation can be the resolution to those geographical differences and by engaging with the four modalities of regulation identified by Lawrence Lessig in his ‘Pathetic Dot Model’ this cooperation can serve to expand the capacity and amplify the impact of data protection and privacy authorities. See in ...
2025-12-12
Journal №1-2 (2025)

Brussels Effect, Data Protection and AI Act

∘ Giovanni Maria Riccio ∘


Abstract

This article explores the role of comparative law in understanding and addressing the legal challenges posed by emerging technologies. It addresses the following issues: the reasons why the European Union sets global regulatory standards, illustrated by the example of the GDPR; the factors behind the United States’ capacity for innovation; and the potential future circulation of the EU legal model. See in ...
2025-12-12
Journal №1-2 (2025)

From a Data Protection Authority to a Data Controller ― Experiences within Eurostat

∘ Endre Győző Szabó ∘


Abstract

Moving from a supervisory role to advising a data controller involves a shift in responsibility and perspective. When advising a data controller, further to general knowledge, the legal experts need sector-specific knowledge to advice data controllers effectively. Networking with other experts is crucial to ensure that high level of expertise is available. Even if not expressly mandated, privacy professionals have a prominent role in building data protection culture in the given organization. This includes prominently raising awareness of data protection among staff members. Statistical confidentiality naturally aligns with data protection needs. Successful enforcement involves constructive collaboration with respondents and feasible solutions. The EU has introduced significant changes in the statistical framework in 2024 through the amendments to the Regulation on European statistics. In recent years, the emphasis shifted from survey data to administrative data and new technologies. ...
2025-12-12
Journal №1-2 (2025)

The European Health Data Space (EHDS)

∘ Júlia Sziklay ∘


Abstract

The European Health Data Space (EHDS) regulation was accepted on 11 February 2025, the full applicability will be achieved from 26 March 2031. The Regulation has double aims, firstly to improve the patients’ access to and control over their personal electronic health data in the context of healthcare and secondly to better achieve other purposes that would benefit society, such as to support research, patient safety, personalised medicine, health threats (including pandemics), innovation, policymaking, official statistics or regulatory activities. The EHDS is the first EU common dataspace with many promises, expectations and challenges. See in ...
2025-12-12
Journal №1-2 (2025)

Data Subject Consent as a Legal Basis: Theoretical and Practical Perspectives

∘ Tamar Samniashvili ∘


Abstract

The article discusses the data subject consent institution as a legal basis for the processing of personal data. It analyzes the criteria of lawful consent, including voluntariness, active expression of will, specificity, and clarity. The particular importance of consent in the processing of children’s personal data and special category data is emphasized. The study examines the peculiarities of consent formulation in documents, contracts, and online environments, emphasizing the mandatory protection of transparency and informed consent principles. The article is based on a comparative analysis of Georgian national legislation and international law, particularly the European Union’s General Data Protection Regulation (GDPR).  Key challenges and risks in the practical implementation of the consent institution are identified. The article presents the criteria necessary for the effective functioning of consent, whose implementation in practice contributes to the ...
2025-12-12
Journal №1-2 (2025)

Governing Artificial Intelligence through Data Protection: The Strategic Role of Independent Authorities in the Age of Algorithmic Power

∘ Ginevra Cerrina Feroni ∘


Abstract

Artificial Intelligence (AI) represents not only a technological shift but also a constitutional challenge. As AI systems become more involved in social, economic and legal decisions, the role of Data Protection Authorities (DPAs) is becoming increasingly important. This short essay, based on the speech held by the Vice President of the Italian Data Protection Authority, Prof. Cerrina Feroni at the 33rd European Conference of Data Protection Authorities, examines the structural interdependence between AI and personal data, placing data protection at the core of AI governance. Drawing from the experience of the Italian DPA and comparative international examples, it analyses four critical areas: legal bases, data transfers, automated decision-making, and protection of vulnerable individuals, where DPAs are establishing the normative boundaries of AI systems. It further suggests that DPA’s role might benefit from evolution from reactive enforcers to proactive institutional actors ...
2025-12-12
Journal №1-2 (2025)

Legal Aspects of Artificial Intelligence and Personal Data Protection Regulation: An Overview of National and International Practice

∘ Otar Chakhunashvili ∘ Salome Sigua ∘


Abstract

The rapid development of information technologies and the integration of artificial intelligence (AI) into the public and private sectors have significantly expanded data processing activities. This process is accompanied by important legal and ethical challenges related to data protection. The article aims to analyze the legal framework governing the processing of personal data by artificial intelligence systems in both international and national legislation. It examines the existing regulations, their effectiveness, and their compliance with the realities of modern technology. Particular attention is given to the adequacy of current legal norms in addressing the unique capabilities and risks of AI, including issues of algorithmic bias, transparency, and the protection of users’ rights. See in ...
2025-12-12
Journal №1-2 (2025)

Processing of Personal Data of a Data Subject through Disclosure on Social Networks

∘ Giorgi Khorbaladze ∘


Abstract

The development of information technologies, while offering numerous opportunities, has also introduced significant risks, particularly those affecting the right to privacy. Data processing in the online environment is becoming increasingly widespread. Of particular importance is the processing of personal data through disclosure on various social networks and digital platforms. Such processing is not considered unlawful provided that it complies with the requirements of personal data protection legislation. The purpose of this paper is to examine, through practical examples, the specific characteristics of data processing by means of disclosure on social networks and to identify the conditions and criteria under which such processing may be deemed lawful. See in ...
2025-12-12

Contact Us

7, Vachnadze Str. 0105, Tbilisi, Georgia
2421000
office@pdps.ge

Social Network