GYLA has presented its conclusion to the Parliament of Georgia concerning the amendment to the Law of Georgia “On Information Security” initiated by Irakli Sesiashvili, Member of Parliament.
According to the draft law, entities of the critical information system will be divided into three categories: the first category will include public agencies, the second category - internet providers (e.g. Magti, Silknet), and the third category - legal entities of private law. The initiative stipulates that the first and second categories will be supervised by the LEPL Operative-Technical Agency supervised by the State Security Service, and the third category by the LEPL Data Exchange Agency under the Ministry of Justice of Georgia.
According to the initiative, the Operative -Technical Agency is authorized to have direct access to the information and data assets of the first category entities, as well as to network sensors. As for the second category, the Agency is entitled to require the installation of a network sensor and have access thereto with the consent of a provider. Although the draft law envisages the consent of the entity (provider) to access the network sensor, this entails the risk that the Agency will have access to the sensor to conduct monitoring even if the provider does not consent. The configuration of the network sensor and the extent of information that the Agency may access shall be determined by a joint decree between the Agency and the Data Exchange Agency. In addition, the Agency may require the second category entities to ensure access to information and data assets where the entity's consent is not mandatory.
Thus, pursuant to the draft law, the Operative -Technical Agency will be equipped with direct access to data of public institutions, including personal information and network sensors, and indirect access to information exchanged through Internet providers allowing the Agency to control any information disseminated through the Internet.
It is also noteworthy that the process of discussing the draft law is held with substantial violations, as it entails important grounds for restricting fundamental rights, and the Committee on Human Rights and Civil Integration, as a mandatory committee, is not involved in the process.
In view of the above, we urge the Parliament of Georgia to conduct the legislative process with the involvement of all relevant committees, not to allow the draft to be adopted in the proposed form and discuss the draft only through broad public participation and discussion.