VPNs with servers in Georgia

Article 8⁵, added by Law No 3148 of 14 June 2023, entitles a company to keep a user’s identity and contact data for no more than four years after the contract ends, and traffic identification data and billing records for no more than four years after the communication. It must delete them at expiry, with automatic destruction within 30 days. It sets a maximum, not a minimum.

The Operative and Technical Agency may copy operators’ identification databases (art. 8³) and install systems that obtain real-time communication without the company’s involvement (art. 8¹). Whether a VPN operator is an “authorised person” providing electronic communication services is not established.

The Communications Commission controls observance of age-marking rules for software, films and games placed on the internet, so as to protect children from harmful information (art. 11).

Article 239¹ of the Criminal Code punishes public incitement to violence, orally, in writing or by other means, to cause discord between groups on racial, religious, national, ethnic, social, political, linguistic or other grounds, where it poses a clear, direct and substantial risk of violence: a fine, 200 to 400 hours of community service, and/or up to three years’ imprisonment.

Unauthorised access to a computer system (art. 284) carries a fine, corrective labour or imprisonment up to two years, rising to two to five years for groups, officials, repetition or substantial damage, and to three to six years where the target is a critical information system subject. An account is identified through a company’s duty under article 8(4) of the Law, with an article 136 order.

Decision No 1/1/625,640 of 14 April 2016 of the Constitutional Court appears in the Law’s amendment history. According to OCCRP, citing Civil.ge, it held that the security agency’s unrestricted access to operators’ networks was unconstitutional, that the safeguards were not a sufficient and effective mechanism of external oversight, and that the existing rules on metadata retention were unconstitutional.

According to the same report, new legislation was due by 31 March 2017; the Law’s amendment notes list Law No 480 of 22 March 2017 against articles 8, 8¹ and 8³. The order of the rows is the security score, and a server’s location is not a recommendation.