Translated by IRIS Georgia Updated as of March 2004 Article 43. The procedures for processing personal data A public agency shall: (a) collect, process and store only those data that are expressly provided by law and are necessary for the proper functioning of the agency; (b) not allow collection, processing, storage, or disclosure of personal data relating to a person’s affiliation with any religious, sexual, or ethnic group, or his political beliefs or worldviews; (c) develop and establish the program for controlling the conformity of collection, processing, storage and content of the data with statutory goals and terms; (d) destroy the data that is unrelated to the statutory goal when demanded by a person or required by a court’s decision; destroy inaccurate, unreliable, incomplete and irrelevant data and replace them with accurate, reliable, updated and complete data; (e) store amended data, indicating the date of their use, together with original data for the period of their existence, but note less than five years; (f) during the collection of personal information about any person obtain information directly from that person and other sources, only if all possibilities of obtaining information from an initial source were exhausted, except as provided in Article 28 of this Code, and only if the public agency is expressly authorized by law to collect, process and store personal data about persons of certain category; (g) enter into a public register the information about the collection and processing of personal data and about the request for data by a third person or a public agency; date of a request and the name/title and address of the applicant; (h) immediately notify a concerned person at his current address of the request for his personal data by a third person or a public agency, except as provided in Article 28 of this Code; (i) before transferring personal data to another person/public agency take all reasonable measures for double-checking whether those data are accurate, relevant, updated and complete; (j) during the collection, processing and storage of personal data inform a concerned person about the objectives and legal grounds for processing personal data, whether the person is required to provide personal information, the sources and composition of personal information and third persons who may gain access to it. Article 44. Secrecy of personal data 1. No public agency shall disclose information constituting personal secret, except for personal data of officials (including candidates to such positions), without the consent of the information subject, or a founded decision that was rendered by court pursuant to the law. 2. A person may appeal the agency’s decision to deny access to personal data within one month after the denial. 3. A court may render the decision declassifying personal data only if it is impossible to prove essential facts on the case on the basis of other evidence, and if all possibilities of obtaining this information from other sources were exhausted. Page 15 of 54