ISRAEL Law and Practice Contributed by: Dan Or-Hof, Eran Gandman, Netanel Aharon and Matan Adar, Or-Hof Law
materials, and assessment data used in recruit - ment. • Right to rectification (correction) and a minimised deletion right: Incorrect, incomplete, or outdated data must be corrected or deleted upon request. • Limited right to erasure: From 1 January 2025, indi - viduals may request deletion of unlawfully obtained or no-longer-necessary EEA-originating data, sub - ject to statutory exceptions. • Opt out of direct marketing: Individuals have an absolute right to demand removal from direct mail - ing lists. Failure to comply can lead to an immedi - ate administrative fine of ILS15,000 per violation. • Withdrawal of consent: While not statutory, PPA draft guidance encourages controllers to respect consent-withdrawal requests. Main Compliance “To Do’s” for Organisations To mitigate exposure to the PPA’s enhanced enforce - ment powers, organisations should prioritise the fol - lowing. • Assess whether they need to appoint a DPO: This is required of public bodies and service providers to such public bodies, data brokers, providers of direct mailing services, and organisations engaged in “systematic monitoring” or large-scale process - ing of Data of Special Sensitivity. • Data mapping: Maintaining up-to-date mapping of databases, systems, data categories, security levels, and EEA-originating data is required. • Database definitions document: It is necessary to prepare and maintain a database definition docu - ment, which underpins Israeli data protection governance and compliance. • Security compliance: Cybersecurity policies should be aligned with the Security Regulations, includ - ing non-standard requirements such as extended access-log retention. 1.3 Special Categories of Personal Data Definition Amendment No 13 changed “sensitive data” to “Data of Special Sensitivity”. The Israeli definition is broader than the GDPR’s “Special Categories of Data”, cover - ing political opinions, religious beliefs, medical and genetic data, sexual orientation, intimate family life, biometric identifiers, criminal records, personality
assessments, certain location data, payroll, financial transactions, and legally confidential data. Enhanced Processing and Security Requirements The PPL applies a unified consent model, coupled with heightened operational obligations. • Consent: Under the 2025 PPA Guidelines, explicit consent is preferable, and it should also be informed, clear and accessible. • Security tiers: Databases are classified as basic, medium or high security. Databases containing sensitive data fall under medium or high security, triggering enhanced safeguards such as security assessments and automated access monitoring. • Mandatory appointment of a DPO: Organisations engaged in large-scale processing of Data of Spe - cial Sensitivity are required to appoint a DPO. Processing Data of Minors Israel does not have a standalone children’s privacy statute. Protection derives from multiple sources. • Legal Capacity and Guardianship Law, 5712-1962: Minors lack full legal capacity; consent generally requires parental or guardian approval. • PPA Guidelines on “Sharenting” and Social Media: These emphasise the best interests of the child, particularly in online exposure. • Age assurance: Platforms targeting minors are expected to implement age-gating or age-assur - ance where sensitive profiling is involved. Criminal Convictions and Foreclosures Criminal data is tightly regulated by the Criminal Record and Rehabilitation of Offenders Law, 5779- 2019, and the PPL. Private organisations cannot request or use this information, and the PPA bans unauthorised “blacklists” related to criminal history or foreclosures. Sectoral Overlaps: Health and AI Health data: This is subject to strict confidentiality, with PPA guidance requiring a Privacy Impact Assess - ment before deploying new digital health tools. Artificial intelligence: Draft 2025 PPA guidance requires heightened transparency, explainability, and
183 CHAMBERS.COM
Powered by FlippingBook