Criminal Offence and Health Condition Information as Special Categories of Data, and the Legal Aspects of Processing in Labor Relations under GDPR and Georgian Law

71 Orbeliani Law Review  Vol. 3, No. 1, 2024 Simoni Takashvili* ORCID: 0000-0001-8608-170X Criminal Offence and Health Condition Information as Special Categories of Data, and the Legal Aspects of Processing in Labor Relations under GDPR and Georgian Law ABSTRACT Criminal offence and health condition information as special categories of data present significant legal challenges in labor relations. The new Personal Data Protection Law outlines the general regulations regarding criminal offence and health condition information as special categories of personal data. The prin - ciples governing the processing of this personal information are very specific, and depend on several factors, especially in employment contexts. Employers have access to private data related to candidates during the pre-contractual phase, and to employees during the contractual relationship. This access car - ries a high risk of breaching the principles of processing special categories of personal data. This article provides a comprehensive analysis of the processing of criminal of - fence and health condition information as special categories of data by the em - ployer. This issue is analyzed within the context of the pre-contractual phase and the termination of the employment contract. All aspects are reviewed under both GDPR and Georgian legislation. At the conclusion of this article, some suggestions and recommendations are offered which might be relevant for Georgian legal practice. Keywords: Criminal offence, health condition, private data, special categories of data, data subject. * PhD, Associate Professor, Sulkhan-Saba Orbeliani University, address: 3 Kalistrate Kutateladze st., 0186 Tbilisi, Georgia , email: s.takashvili@sabauni.edu.ge Vol. 3, No. 1, 71-84 Orbeliani Law Review  2024 Received: May 18, 2024 | Accepted: October 27, 2024 | Published: Dec 24, 2024 72 Orbeliani Law Review  Vol. 3, No. 1, 2024 I. Introduction Protection of personal data is a challenge in the realm of modern law, being relevant in almost all contractual and non-contractual relations. One of the most important contractual relationships is employment. The personal data of employees can be eas - ily accessed by employers on the basis of employment contracts, and for this reason the standard of protection should be high. An employee’s personal information as a special category of data is particularly important, and, as such, the law should deter - mine the standard by which special categories of personal data should be processed. In addition, the law must determine the purpose and proportionality required for the processing of specific data. For example, it is generally permissible to use fingerprints to control access to protected rooms or critical systems, but using the same data to supervise employees’ working time or assess their effectiveness may be disproportion - ate in the given context. 1 Accordingly, the law should outline very clear and relevant standards for processing personal data, particularly special categories of data. There are some countries which do not have specific regulations on private data protection for labor relations, Japan being among them. 2 Special categories of data are given in the Law of Georgia “On Personal Data Pro - tection”. The most frequently requested information from the abovementioned data categories in Georgia includes notifications regarding an employee’s criminal offenc - es, as well as details about the type of crime a person is accused of or has been con - victed of. Additionally, employers often request a health certificate, which provides information about the employee’s health. Both of these categories are relevant during the pre-contractual stage, when an interview is conducted, and questions are posed 3 by the employer, as well as throughout the entire employment relationship and termi - nation procedure. An employer may dismiss an employee based on criminal offences or health conditions, which can lead to significant consequences. The aim of this article is to outline major aspects of Georgian law and European approaches to the protection of special categories of personal data, such as criminal 1 Krzysztofek M., GDPR: General Data Protection Regulation (EU) 2016/679, Post-Reform Personal Data Protection in the European Union, Wolters Kluwer, 2019, 103. 2 Kasahara C., Data Protection and Privacy, Jurisdictional Comparisons, Japan, 2 nd Edition, London, 2014, 439. 3 Morris G., Protection of Employees’ Personal Information and Privacy in English Law, in: Protection of Employees’ Personal Information and Privacy, edited by R. Blanpain, Kluwer Law International, 2014, 221. S IMONI T AKASHVILI 73 Orbeliani Law Review  Vol. 3, No. 1, 2024 offences or h ealth conditions, during employment relations. The article analyses the pre-contractual, contractual relations and termination stages. The conclusion at the end of the article offers the main findings and recommendations. II. General Standards of an Employer’s Right to Obtain Information from a Candidate 1. General Overview The right to data protection is increasingly relevant in employment relations, being an area that involves the processing of large amounts of personal data, with employers as the main data processors or data controllers. 4 All organizations collect and process personal data, be they large organizations or small start-ups, and in doing so, they all need to comply with the data protection laws. 5 In general, the employer controls the labor relations and can determine their con - ditions, which results in the subordinate position of the employee. 6 Accordingly, it means that the employer is entitled to choose from amongst applicants so as to organ - ize the work and instruct employees, monitor compliance with instructions, or even to sanction employees. 7 Therefore, personal data protection issues are highly relevant and important in this relationship. The Georgian Labor Code 8 and the Law of Georgia “On Personal Data Protec - tion” 9 stipulate the legal standards of both parties – employers and employees. More specifically, the Labor Code prohibits discrimination and stipulates that differenti - ating between individuals, based on the essence or specific nature of the work or its conditions, and when it serves a legitimate objective, shall not be considered discrim - ination 10 provided that it is a necessary and proportionate means of achieving that 4 Hendrickx F., Article 8 – Protection of Personal Data, in: The Charter of Fundamental Rights of the European Union and the Employment Relation, edited by F. Dorssemont, K. Lorcher, S. Clauwaert and M. Schmitt, Hart Publishing, 2019, 250. 5 Lambert P., Data Protection, Privacy Regulators and Supervisory Authorities, Bloomsbury Professional, 2020, 211. 6 Lukacs A., Employees’ Right to Privacy and Right to Data Protection on Social Network Sites, Szeged, 2021, 78. 7 Ibid., 78-79. 8 Labor Code of Georgia, 27 December 2010. 9 Law of Georgia “On Personal Data Protection”, 14 June 2023. 10 Labor Code of Georgia, 27 December 2010, Art., 6. S IMONI T AKASHVILI 74 Orbeliani Law Review  Vol. 3, No. 1, 2024 objective. An employer may obtain information about a job candidate, aside from that which is not related to the performance of the job or which is not designed to evaluate the ability of a candidate to perform a specific job and to make an appropriate decision in respect thereof. Accordingly, the Georgian Labor Code prohibits discrimi - nation; however, if the specifics of the job are important and the employee is required to perform specific activities, information regarding the employee’s health, criminal offences, etc., should not be considered discrimination. The Law of Georgia “On Personal Data Protection” stipulates the definition of special categories of data, which might be data connected to a person’s racial or ethnic origin, political views, religious, philosophical or other beliefs, membership of profes - sional unions, health, sex life, status as an accused, convicted or acquitted person or a victim in criminal proceedings, biometric and genetic data, etc. 11 Accordingly, the employer is able to obtain only that information which does not breach the personal data protection law. However, as mentioned, there may arise some exceptions. For example, infor - mation on the criminal records of job applicants and employees is particularly im - portant in sectors where the risk of employing persons without adequate verification is high, e.g., in the financial sector. 12 Therefore, it is very important to analyze, on a case-by-case basis, whether the employer really needs the information requested on an employee. In the European Union, personal data protection is very important in labor rela - tions. The General Data Protection Regulation GDPR 13 entered into force on May 25, 2018. The GDPR allows EU member states to adopt specific rules for employers and employees in processing private data. Before the introduction of the GDPR, there was no specific legal framework in the EU in the context of data protection in labor rela - tions. 14 The scope of data processing cannot extend beyond the employee’s personal data related to their labor relations, even if consent was freely given in a particular case. The employer must prove that this does not invalidate the data minimization 11 Law of Georgia “On Personal Data Protection”, 14 June 2023, Art. 3.b. 12 Krzysztofek M., GDPR: General Data Protection Regulation (EU) 2016/679, Post-Reform Personal Data Protection in the European Union, Wolters Kluwer, 2018, 103. 13 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the Protection of Natural Persons with Regard to the Processing of Personal Data and on the Free Movement of Such Data, and Repealing Directive 95/46/EC (General Data Protection Regulation). 14 The EU General Data Protection Regulation (GDPR), a Commentary, edited by C. Kuner, L. A. Bygrave, and C. Docksey, Oxford, 2020, 1230. S IMONI T AKASHVILI 75 Orbeliani Law Review  Vol. 3, No. 1, 2024 requirement. 15 A rticle 88 in the GDPR allows member states to accommodate their requirements with the needs and peculiarities of their own legal system, which means that states are able to set standards for processing data during the labor relations, but that employers cannot derogate from the minimum standard imposed by the GDPR. 16 2. Criminal Offences and Health Condition Records in the Pre-Contractual Relationship In general, an employment relationship is deemed a subordinate contractual relation - ship. Subordination means that the employee is under the authority of the employer, which is manifested in the employer’s power to give orders and the employees’ correl - ative obligation to obey those orders. 17 When an employer receives applications, they can collect a huge amount of personal information on the applicants. 18 Accordingly, at the first stage, the employer has the power to demand any documents which are deemed necessary by said employer to conclude an employment agreement. After concluding the contract, the employer also has the authority to monitor the employ - ees’ work activities. However, at both stages, the employer is obliged not to breach the personal data protection law. When an employer invites a candidate for an interview, an amount of person - al information/documents might be needed. In Georgia, the most common stage at which special categories of data are received from a candidate for employment is the pre-contractual stage. As a rule, employers tend to request health and/or criminal records before concluding an employment contract. These two pieces of information count as special categories of data, and the legal protection standards established in this case are thus rather strict. The Law of Georgia “On Personal Data Protection” stipulates that the processing of special categories of data shall be permitted only if the controller (employer) pro - 15 Krzysztofek M., GDPR: General Data Protection Regulation (EU) 2016/679, Post-Reform Personal Data Protection in the European Union, Wolters Kluwer, 2018, 103. 16 The EU General Data Protection Regulation (GDPR), a Commentary, edited by C. Kuner, L. A. Bygrave, and C. Docksey, Oxford, 2020, 1237. 17 Lukacs A., Employees’ Right to Privacy and Right to Data Protection on Social Network Sites, Szeged, 2021, 83. 18 Lee S., Protection of Employees’ Personal Information and Privacy at a crossroads in Korea, in: Protection of Employees’ Personal Information and Privacy, edited by R. Blanpain, Kluwer Law International, 2014, 151. S IMONI T AKASHVILI 76 Orbeliani Law Review  Vol. 3, No. 1, 2024 vi des safeguards for the rights and interests of the data subject, as provided for by this Law, and only if the processing of special categories of data is necessary due to the nature of the labor obligations and relations, including in order to make decisions on employment and/or assess the working capacity of the employee. 19 Accordingly, the law allows the employer to process the candidates’ and employees’ special categories data. It should be noted that the controller has the obligation to justify the legal basis for the processing of special categories of data, meaning that the burden of proof for processing employees’ personal data falls on the employer. At the first stage, the employer has the right to demand of a job candidate their health and criminal records. This regulation is grounded in the GDPR. The GDPR’s commentary says that companies such as credit scoring agencies, insurance compa - nies and other businesses screening prospective employees may also seek to process data concerning criminal convictions and offencies, and the storing of such data by them is only permissible if EU or Member State law allows it and provides safe - guards. 20 It is also important that an infrigement of Article 10 can result in a claim for compensation under Article 82 of the GDPR. 21 In the pre-contractual employment relationship, following the interview with the candidate, the employer might ask the candidate for information about their health, medical status 22 or criminal history. In Georgian legal literaure, committing a crime is part of a person’s personal, private life. However, it becomes essential to consider if a candidate for employment has violated any laws protected by the Criminal Code, es - pecially when such violations are directly related to the work they will be performing, as stipulated by their employment contract. 23 Employers also need legitimate grounds to demand information/records or doc - uments regarding health from a candidate. 24 The aim is lawful when the work which 19 Law of Georgia “On Personal Data Protection”, 14 June 2023, Art. 6(h). 20 The EU General Data Protection Regulation (GDPR), a Commentary, edited by C. Kuner, L. A. Bygrave, and C. Docksey, Oxford, 2020, 389. 21 Ibid., 390. 22 Forsyth A., a Thin Wall of Privacy Protection, with Gaps and Cracks: Regulation of Employees’ Per - sonal Information and Workplace Privacy in Australia, in: Protection of Employees’ Personal Infor - mation and Privacy, edited by R. Blanpain, Kluwer Law International, 2014, 18. 23 Kereselidze T., Legal Consequences of Discriminatory Question of Employer to Candidate Before Conclusion of Employment Contract, Employment Law (Collection of Articles), edited by V. Zaal - ishvili, Tbilisi, 2011, 204-205; Also, Forsyth A., a Thin Wall of Privacy Protection, with Gaps and Cracks: Regulation of Employees’ Personal Information and Workplace Privacy in Australia, in: Pro - tection of Employees’ Personal Information and Privacy, edited by R. Blanpain, Kluwer Law Interna - tional, 2014, 21. 24 Kereselidze T., Legal Consequences of Discriminatory Question of Employer to Candidate Before S IMONI T AKASHVILI 77 Orbeliani Law Review  Vol. 3, No. 1, 2024 s hould be performed is specific, with the employee obliged to provide detailed infor - mation regarding their health in such cases where the work may be harmful to their health. The processing of such data should be fair and lawful. 25 Employers need the consent of the candidate or employee to obtain the above - mentioned information. In order to inform the data subject about the purpose of per - sonal data use, the controller needs to determine the purpose as precisely as possible. 26 The subordination of the employee to the employer is one of the fundamental features of labor relations, and the employee might feel informally presured to give their con - sent when requested to do so by their employer. 27 This means that there is a high probability that the voluntary nature of the employees’ consent could be questioned, 28 because, as mentioned, the employee is particularly vulnerable in the workplace and, due to their subordination to the employer, may feel pressured to accept restrictions on their privacy rights. 29 As such, if the work is very specific and necessitates that the employees’ inform the employer regarding their criminal or health records, the Labor Code and the Law of Georgia “On Personal Data Protection” allows the employer to obtain these infor - mation/documents. If the employer does not have a legitimate reason or violates the law, the candidate can demand compensation. The discriminated candidate has the right to various claims for damages: reimbursement of costs incurred for concluding the contract, compensation for material damages, and compensation for non-material (moral) damages. 30 The employee should be clearly notified of, among other things, the purpose of giving consent and the voluntary nature of giving that consent. 31 Ac - Conclusion of Employment Contract, Employment Law (Collection of Articles), edited by V. Zaalishvili, Tbilisi, 2011, 207. 25 For more details see: Bygrave L. A., Data Privacy Law, an International Perspective, Oxford, 2014, 146-147. 26 Bussche A. F., Voigt P., Data Protection in Germany, Including EU General Data Protection Regulation 2018, 2 nd Edition, München, 2017, 13. 27 Krzysztofek M., GDPR: General Data Protection Regulation (EU) 2016/679, Post-Reform Personal Data Protection in the European Union, Wolters Kluwer, 2018, 104. 28 Ibid., 104. 29 Moura Vicente D., De Vasconcelos Casimiro S., Data Protection in the Internet: General Report, in: Data Protection in the Internet, edited by Moura Vicente D., De Vasconcelos Casimiro S., Springer, 2020, 22; Also, Bussche A. F., Voigt P., Data Protection in Germany, Including EU General Data Protection Regulation 2018, 2 nd Edition, München, 2017, 52. 30 Takashvili S., Discrimination under Political or other Opinions in Precontractual Labor Relationship, Journal of Legal Studies, 2024, Vol. 33, No. 47, 106. 31 Krzysztofek M., GDPR: General Data Protection Regulation (EU) 2016/679, Post-Reform Personal Data Protection in the European Union, Wolters Kluwer, 2018, 104. S IMONI T AKASHVILI 78 Orbeliani Law Review  Vol. 3, No. 1, 2024 co rdingly, the general right of privacy of the employee has to be weighed against the legitimate interests of the employer in the processing of said employee’s data for the purposes outlined above. 32 III. Processing Criminal Offences and Health Condition Records for an Employee’s Dismissal 1. Processing a Criminal Offence Record/Information for Dismissal The protection of special cat egories data is essential during labor relations, and in the process of termination in particular. The possibility of terminating an employment relationship based on criminal offense or health condition information is problematic in Georgian legislation, as both types of data are considered special categories of data. Therefore, it is unclear whether an employer can obtain this information in order to terminate a employment relationship with an employee. According to the Labor Code of Georgia, an employment contract can be termi - nated if the entry into force of a court judgment or other decision precludes the possi - bility of the employee carrying out the work they have been contracted for. The reason for this might be grounded in information/documents which are special categories of data. The Law of Georgia “On Personal Data Protection” regulates the employment relationship when it stipulates that “processing of special categories of data is nec - essary due to the nature of the labor obligations and relations, including for making decisions on employmen t and assessing the working capacity of the employee”. 33 Does this mean that during the employment relationship, the employer is able to demand the employee provide information regarding past offences and dismiss said employee on the basis of this information? Of course, if the employee is in prison, it is clear they will be una ble to continue working. The problematic issue is when there is a criminal judgement against the employee but they are not in prison, as the informa - tion regarding the data subject’s criminal offences is highly sensitive and thus classed as a special category of data. As such, the employer is unable to obtain this informa - tion legally without the consent of the employee. According to the Civil Procedure 32 Breunig C., Schmidt-Kessel M., Data Protection in the Internet: National Report Germany, in: Data Protection in the Internet, edited by Moura Vicente D., De Vasconcelos Casimiro S., Spring - er, 2020, 193. 33 Law of Georgia “On Personal Data Protection”, 14 June 2023, Art. 6(1)(h). S IMONI T AKASHVILI 79 Orbeliani Law Review  Vol. 3, No. 1, 2024 Code of Georgia, evidence that has been obtained in violation of the law shall ha ve no legal force. 34 Accordingly, even if an employer has information on a personal data subject’s criminal offences, it does not mean that it will be valid in the eyes of the law when the court reviews any employment dispute. This issue is very strictly regulated in the GDPR, where personal data relating to criminal offences, where its processing is not expressly allowed under EU or member state law, may only be processed under the control of an official authority. 35 In legal literature there is a view that the term “con - viction” (in the GDPR) does not include acquittals or judgements of the conditional or unconditional discontinuation of proceedings, and that crimes which have not re - sulted in convictions may arguable be classified as offences. 36 Based on the aforementioned, an employer’s handling of such a special category of personal data should be reserved for very rare and exceptional circumstances. The Law of Georgia “On Personal Data Protection” does not stipulate that the employer is able to process criminal offence record/information for the aim of dismissing an em - ployee; however, if an employee has comm itted a crime and there is a criminal court judgment, such as where an accountant is found guilty in a financial matter, it might be reasonable for the employer to request either the full court judgment, or a sum - marized version of the court’s conclusion, or information thereof. In this situation, the legitimate interest might be the future work activities and continuing the work process with this employee. The employer is in each case obliged to prove that the processing of the data relat - ed to the criminal offence records/information is needed for their legitimate interest, and is vital to the potential continuation or termination of the employment relation - ship. 37 Furthermore, even if the employer possesses the information or document, it does not mean that the dismissal is fair. The burden of proof lies with the employer, 34 Civil Procedure Code of Georgia, 14 November 1997, Art. 103(3). 35 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the Protection of Natural Persons with Regard to the Processing of Personal Data and on the Free Move - ment of Such Data, and Repealing Directive 95/46/EC, Art. 10. 36 Krzysztofek M., GDPR: General Data Protection Regulation (EU) 2016/679, Post-Reform Personal Data Protection in the European Union, Wolters Kluwer, 2018, 116. 37 See: the judgement of the Supreme Court of Georgia as-169-2020, October 13, 2021, which says that a loss of trust when the employee commits a crime might be a ground for dismissal. However, the burden of proof is on employer to prove that this crime and the action of the employee contradicts the employer’s business and is very harmful for its reputation. S IMONI T AKASHVILI 80 Orbeliani Law Review  Vol. 3, No. 1, 2024 m eaning that if the employer dismisses the employee, even with a court judgment on the employee, the employer must prove the legality of the dismissal. 38 2. Processing Health Condition Record/Information for Dimissal Article 9 of the GDPR outlines the processing of special categories of personal data, with health data being one of the main concerns. The special categories of data out - lined in Article 9 are subject to much stricter principles due to their particular im - portance for the right to privacy. 39 It should be noted that the GDPR provision covers all types of medical or social care, including diagnosis, treatment and prevention. 40 Accordingly, the GDPR allows the employer to process the employee’s health informa - tion as a special category of personal data during labor relations. However, it should be emphasized that this processing must be justified and based on the legitimate in - terest of the work and the employer. As mentioned, the Law of Georgia “On Personal Data Protection” allows the controller to process personal data related to the employee’s health, but this must be lawful and based on legitimate interest. It is clear that an employer can request infor - mation from an employee regarding their health to ensure they are fit for the work. However, there is no specific legal ground for using the employee’s health condition as a reason for dismissal. If the employee’s health is not compatible with performing the work, the Labor Code of Georgia stipulates that this may be considered a long-term incapacity for work, unless otherwise specified in the employment agreement. This applies if the incapacity period exceeds 40 consecutive calendar days, or if the total incapacity period exceeds 60 calendar days within a 6-month period. Additionally, there is another, more specific and problematic ground stating that the contract may be terminated on the basis of other objective circumstances justifying the termination of an employment agreement. Accordingly, if there is no a long-term incapacity for work but the employer thinks or somehow knows that the employee has health issues, is the employe r able 38 For more details regarding the allocation of burden of proof in employment relationship, please, see the several court judgements of the Supreme Court of Georgia: No. as-1230-2021 of 28 June 2022; No. as-1355-2021 of 28 June 2022; No. as-283-2022 of 27 July 2022, etc. 39 Krzysztofek M., GDPR: General Data Protection Regulation (EU) 2016/679, Post-Reform Personal Data Protection in the European Union, Wolters Kluwer, 2018, 114. 40 The EU General Data Protection Regulation (GDPR), a Commentary, edited by C. Kuner, L. A. Bygrave, and C. Docksey, Oxford, 2020, 379. S IMONI T AKASHVILI 81 Orbeliani Law Review  Vol. 3, No. 1, 2024 t o obta in information or documentation regarding the employee’s health? This is a very problematic issue because health information is highly sensitive and the em - ployer may not be able to obtain this information, even if they have the employee’s initial consent. 41 In practice, at the very beginning of the labor relations, the employee signs the employment contract and gives consent for the employer to process all information related to the employee, including health data. However, it becomes problematic whether this consent remains valid 1-2 years after the start of the employment rela - tionship. The primary requirement for consent is that it must be freely given, specific, informed and unambiguous. 42 If these criteria are met, the consent is valid throughout the entire duration of the employment contract , including during the dismissal stage. Nevertheless, the employer is obligated to prove that the employee’s health informa - tion is critical to work performance and sometimes to the employee as well. Other - wise, the processing of such special categories of personal data will be unlawful. As for dismissal, termination of the labor relations due to health conditions should be a last resort. Therefore, the employer should have no other option but to dismiss the employee, and the health condition should be the direct reason for the employee’s inability to perform the work. If the health condition record indicates even a severe illness that does not prevent the employee from performing their work, it cannot serve as grounds for dismissal. Accordingly, the burden of proof in this situa - tion also lies with the employer. IV. Conclusion Based on the reasoning presented, several important issues can be identified. First, it should be noted that both the GDPR and Georgian law are based on a common principle: the protection of the personal data of the data subject. The article focuses on the issue of protecting special personal data, such as providing the employer with information or documentation regarding health and criminal convictions, consider - ing the context of the subordination relationship between the employer and employee in labor relations. 41 Compare: Carey P., Data Protection, A Practical Guide to UK and EU Law, 5 th Edition, Oxford, 2018, 86. 42 The EU General Data Protection Regulation (GDPR), a Commentary, edited by C. Kuner, L. A. Bygrave, and C. Docksey, Oxford, 2020, 181. S IMONI T AKASHVILI 82 Orbeliani Law Review  Vol. 3, No. 1, 2024 One of the most problematic issues in labor relations is the processing of per - sonal information at the pre-contractual stage and during contract termination. At the pre-contractual stage, the employer may violate the personal data of a job can - didate by asking questions during the interview or obtaining information in oth - er ways. It is significant that both the GDPR and Georgian legislation allow the employer to process special personal data for the purpose of hiring an employee. Accordingly, the research reveals that if the work is very specific and requires em - ployees to inform the employer about their criminal or health records, the Labor Code and the Law of Georgia “On Personal Data Protection” allow the employer to obtain such information or documents. If the employer does not have a legitimate reason or violates the law, the candidate can demand compensation. The discrimi - nated candidate has the right to various claims for damages. Therefore, the general right to privacy of the employee must be weighed against the legitimate interests of the employer in processing the employee’s data. Regarding the processing of criminal offence and health condition records for employee dismissal, it should be noted that an employee’s criminal convictions and records should be reserved for very rare and exceptional circumstances. The Geor - gian law does not specifically stipulate that an employer can process criminal offence records for the purpose of dismissing an employee. However, if an employee has com - mitted a crime and there is a criminal court judgment which is highly relevant to the work performance, it may be reasonable for the employer to request either the full court judgment, a summarized version of the court’s conclusion, or only relevant information. In such a situation, the legitimate interest could be the employee’s future work activities and continuation of the work process. The same standard applies to health condition information. The burden of proof in both cases lies with the employer. The employer should prove both the legal grounds of processing s uch special categories of personal data, and that the health condition or criminal offence record are crucial for the employer and for the performing of work obligations. Accordingly, in both cases, taking into account the nature and specificity of the work, there must be a reasonable basis to suggest that maintaining the labor relationship with the employee will be harmful to the employer with relation to the criminal history, and in relation to health, that continuing work will be directly harmful to the health or life of the employee. These circumstances must exist in order for such a special category of data to be processed S IMONI T AKASHVILI 83 Orbeliani Law Review  Vol. 3, No. 1, 2024 and the l abor relations to be thus terminated. If the employer is unable to prove the mentioned circumstances, the employer will be held responsible under Labor Code and the Law of Georgia “On Personal Data Protection”. References Krzysztofek M., GDPR: General Data Protection Regulation (EU) 2016/679, Post-Reform Personal Data Protection in the European Union, Wolters Kluwer, 2018. Kasahara C., Data Protection and Privacy, Jurisdictional Comparisons, Japan, 2 nd Edition, London, 2014. Morris G., Protection of Employees’ Personal Information and Privacy in English Law, in: Pro - tection of Employees’ Personal Information and Privacy, edited by R. Blanpain, Kluwer Law International, 2014. Hendrickx F., Article 8 – Protection of Personal Data, in: The Charter of Fundamental Rights of the European Union and the Employment Relation, edited by F. Dorssemont, K. Lorcher, S. Clauwaert and M. Schmitt, Hart Publishing, 2019. Lambert P., Data Protection, Privacy Regulators and Supervisory Authorities, Bloomsbury Profes - sional, 2020. Lukacs A., Employees’ Right to Privacy and Right to Data Protection on Social Network Sites, Sze - ged, 2021. The EU General Data Protection Regulation (GDPR), a Commentary, edited by C. Kuner, L. A. Bygrave, and C. Docksey, Oxford, 2020. Lee S., Protection of Employees’ Personal Information and Privacy at a crossroads in Korea, in: Protection of Employees’ Personal Information and Privacy, edited by R. Blanpain, Kluwer Law International, 2014. Forsyth A., a Thin Wall of Privacy Protection, with Gaps and Cracks: Regulation of Employees’ Per - sonal Information and Workplace Privacy in Australia, in: Protection of Employees’ Personal Information and Privacy, edited by R. Blanpain, Kluwer Law International, 2014. Kereselidze T., Legal Consequences of Discriminatory Question of Employer to Candidate Before Conclusion of Employment Contract, Employment Law (Collection of Articles), edited by V. Zaalishvili, Tbilisi, 2011. Bygrave L. A., Data Privacy Law, an International Perspective, Oxford, 2014. Bussche A. F., Voigt P., Data Protection in Germany, Including EU General Data Protection Regu - lation 2018, 2 nd Edition, München, 2017. Moura Vicente D., De Vasconcelos Casimiro S., Data Protection in the Internet: General Report, in: Data Protection in the Internet, edited by Moura Vicente D., De Vasconcelos Casimiro S., Springer, 2020. Takashvili S., Discrimination under Political or other Opinions in Precontractual Labor Relationship, Journal of Legal Studies, 2024, Vol. 33, No. 47. DOI: https://doi.org/10.2478/jles-2024-0007 Breunig C., Schmidt-Kessel M., Data Protection in the Internet: National Report Germany, in: Data Protection in the Internet, edited by Moura Vicente D., De Vasconcelos Casimiro S., Springer, 2020. Carey P., Data Protection, A Practical Guide to UK and EU Law, 5 th Edition, Oxford, 2018. S IMONI T AKASHVILI 84 Orbeliani Law Review  Vol. 3, No. 1, 2024 Legal Acts Labor Code of Georgia, 27 December 2010. Law of Georgia “On Personal Data Protection”, 14 June 2023 Civil Procedure Code of Georgia, 14 November 1997. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the Protection of Natural Persons with Regard to the Processing of Personal Data and on the Free Movement of Such Data, and Repealing Directive 95/46/EC (General Data Protection Regulation). Case Law Judgement No. as-1230-2021 of the Supreme Court of Georgia, 28 June 2022. Judgement No. as-1355-2021 of the Supreme Court of Georgia, 28 June 2022. Judgement No. as-169-2020 of the Supreme Court of Georgia, 13 October 2021. Judgement No. as-283-2022 of the Supreme Court of Georgia, 27 July 2022. S IMONI T AKASHVILI