ISRAEL Law and Practice Contributed by: Dan Or-Hof, Eran Gandman, Netanel Aharon and Matan Adar, Or-Hof Law
processing of Israeli residents’ data has a material privacy impact. In summary, key application triggers include: • targeting the Israeli market (eg, Hebrew interface, local marketing); • databases containing significant volumes of Data of Special Sensitivity relating to Israelis; and • processing activities conducted within Israel (such as by local servers or R&D centres). Interplay With AI, Cyber, and Non-Personal Data The PPL increasingly intersects with other specialised regimes. • AI: Israel follows a sector-based approach. The 2025 PPA draft AI Guidelines (published 28 April 2025) apply the PPL across the AI life cycle, requir - ing privacy by design, transparency for automated decisions, and prohibiting unlawful scraping. • Cybersecurity: The Israel National Cyber Direc - torate (INCD) manages national and critical infra - structure security, issues voluntary cyber guide - lines, and handles cybersecurity incidents in Israel, often alongside the PPA for data breaches involv - ing personal information. • Non-personal data: The low “reasonable effort” re- identification threshold means that most datasets capable of re-identification are treated as personal data and are subject to the PPL. An anonymisation process applied to personal data would be regard - ed as a processing activity covered by the PPL, thereby subject to the supervision of the PPA. 1.2 Rights and Obligations Processing of personal data under Israeli law is now governed by a strict “consent or authority” model, fol - lowing Amendment No 13 to the PPL, bolstered by substantial administrative enforcement powers. General Principles for Data Processing The Israeli framework, particularly after Amendment No 13, is based on several core principles applicable to all organisations. • Informed consent: Processing personal data with - out the data subject’s informed consent constitutes
a violation of the law. Under current PPA guid - ance, consent must be granular and specific, and “bundled” consent (eg, service use combined with third-party marketing) is increasingly viewed as invalid. • Lawfulness of processing: Processing personal data for purposes other than those lawfully estab - lished, or beyond the controller’s authorisation, constitutes a violation of the PPL. • Purpose limitation: Data collected for a specific purpose (eg, contract performance) may not be reused for a different purpose (eg, AI training) with - out new, separate consent. • Transparency and disclosure: Section 11 of the PPL requires a “notice of collection” specifying – (a) whether the provision of the data is legally required; (b) the specific purposes of the collection; (c) the identity of the controller; (d) reasons for disclosing the identity of third-party data recipients; (e) the consequences of refusal; (f) the data subject’s access and rectification rights; and (g) the EEA-originated Data Regulations and PPA guidance on transparency and AI include ad - ditional disclosure requirements. • Proportionality and data minimisation: Databases may contain only information that is strictly neces - sary for the declared purpose, and organisations must conduct periodic reviews to delete excess or outdated data. • Confidentiality: Breach of confidentiality relating to personal data constitutes a serious criminal offence, punishable by up to five years’ imprison - ment. • Security: The Security Regulations impose detailed, risk-based obligations on database own - ers and holders. Data Subject Rights Individual rights have expanded significantly, particu - larly for databases containing EEA-originating data not directly provided by the data subject. • Access: Individuals may inspect personal data held about them, including digital records, audio-visual
182 CHAMBERS.COM
Powered by FlippingBook