From: Nino Kvernadze
Sent: Thursday, July 16, 2020 10:41 AM
To: Volkan Cetinkaya
Cc: n.gagua@mof.ge; Prachi Shrikant Tadsare ; mehek.marwaha@aiib.org; Alicia C. Marguerie ; nino_moroshkina@yahoo.com; Nino Patarashvili ; Lia Tavadze ; Maddalena Honorati ; Tamar Gabunia ; Tamar Barkalaia
Subject: RE: Project restructuring - new deadlines for the dated covenant on personal data protection

Dear Maddalena,

I am writing on behalf of the Ministry. The issue on setting up more realistic deadlines on Data Covenants, has been discussed internally. Given the circumstances, to be on a safe side, we propose to set new deadlines, as  provided below:

1. no later than hundred and twenty  (120) days after the Signature Date provide the Bank a proposed plan (“Plan of Action”)
2. no later than hundred and fifty (150) days after the Signature Date adopt the Plan of Action

However, despite the proposed timeline, the Ministry, in coordination with the PIU team, will have more tight deadlines internally.  

In the meanwhile, we will continue the implementation arrangements of the Component 2, in accordance with the Law of Georgia on Personal Data Protection.

We hope for your understanding,

Kind regards,

ნინო კვერნაძე

პროექტის მენეჯერი,

მსოფლიო ბანკის COVID-19-ის წინააღმდეგ სწრაფი რეაგირების

პროექტის განმახორციელებელი ჯგუფი (PIU), 

საქართველოს ოკუპირებული ტერიტორიებიდან დევნილთა, შრომის, ჯანმრთელობისა და სოციალური დაცვის სამინისტრო 

www.moh.gov.ge  

Nino Kvernadze

Project Manager, PIU – World Bank

Emergency COVID-19 Response Project Implementation Unit

Ministry of Internally Displaced Persons from the Occupied Territories, Labour, Health and Social Affairs of Georgia

www.moh.gov.ge 

Email: ninokvernadze@moh.gov.ge

Cell: +995 599 18 46 44

Dear Tamar and Tamila,

As discussed yesterday a project restructuring is required as some dated legal covenants have not been met. It was agreed yesterday to  restructure the project through a contractual waiver conditional on new timelines rather than an amendment which would require parliament’s ratification.

I am writing to follow up on the new deadlines for the following 2 dated covenants in the signed LA:

(a)                no later than sixty (60) days after the Signature Date [hence June 30, 2020], provide the Bank a proposed plan (“Plan of Action”) setting out the timeline and steps for carrying out the recommendations set out in the 2018 and 2019 reports from the State Audit Office of Georgia pertaining to the information system of the social assistance program and the pension program respectively, being implemented by the Social Service Agency, and such other actions necessary for the effective implementation of an information security management systems of the Social Service Agency, all in accordance with the Law of Georgia on Personal Data Protection and good international practice; and

(b)                no later than ninety (90) days after the Signature Date [hence July 31, 2020], adopt the Plan of Action, after taking into account recommendations of the Bank, and thereafter begin to implement the Plan of Action in accordance with its terms, in a manner satisfactory to the Bank.

We are pleased that MOH is working on the plan of action in follow up to the State Audit Office recommendations. Since the agreed deadline of June 30, 20 has passed, please let us know what would be a new realistic deadline for covenant (a) above so we can proceed  with the contractual waiver.

Please also confirm whether it would be safer to change the deadline for the dated covenant (b)  and specify the new deadline to avoid other project restructuring.

We trust your assessment of a realistic new timeline for the two covenants above, noting that the achievement of the two covenants will have implication on the implementation of component 2 of the project which entails the collection and use of large volumes of personal data, personally identifiable information and sensitive data.

Looking forwrad to hearing from you to move the project restructuring

Maddalena