ISRAEL Law and Practice Contributed by: Dan Or-Hof, Eran Gandman, Netanel Aharon and Matan Adar, Or-Hof Law
Definition A “Severe Security Incident” is defined by reference to the database’s security classification. For high-security databases, any unauthorised use of data or damage to data integrity triggers notification. For medium-security databases, notification is required where a substantial portion of the database is accessed without authorisation or its integrity is materially compromised. Databases classified at the basic-security level are generally exempt from notification obligations. Security Level Classification Security classification is based on data sensitivity and database scale. Medium security applies to databases containing Data of Special Sensitivity, databases used for direct mar - keting, and databases controlled by public bodies. High security generally applies where medium-level databases grant access permissions to more than 100 individuals or contain records relating to 100,000 individuals or more. Notification Procedures and Timing Where notification is required, organisations must act immediately upon discovery. Notifications are sub - mitted via the PPA’s designated online form and may be filed by legal representatives, including in English. Certain HR databases may qualify for exemptions and fall within the basic-security level. Authority Investigations and Litigation Exposure Following notification, the PPA may initiate inves - tigations and order corrective measures, including mandatory notice to data subjects. Organisations face potential mass privacy litigation, as Israeli law provides civil remedies for privacy violations. This combined regulatory and litigation exposure height - ens compliance and reputational risks, making early assessment and timely notification critical.
• Sectoral overlays – Financial and life sciences regulators require explainability and bias testing. • The “reasonableness” test – The courts apply administrative law principles to assess proportion - ality and non-discrimination in automated public- sector decisions. Transparency and Data Governance Under the 2025 PPA draft AI guidance, organisations are expected to: • disclose AI use and provide meaningful explana - tions of data processing; • conduct privacy impact assessments (PIAs); and • involve boards of directors in approving AI govern - ance, particularly where Data of Special Sensitivity is involved. Human Oversight and Prohibited Categories • Prohibited categories: While no categorical bans exist, practices such as social scoring are likely to be deemed unreasonable or unconstitutional. • Human-in-the-loop: Strong preference exists for human review and appeal mechanisms in high- impact systems. 1.6 Data Breach Requirement Israeli data breach notification requirements are gov - erned by Section 11 of the Security Regulations and further detailed in PPA guidance dated 7 August 2022 (as amended 1 September 2025). Notification Triggers and Assessment Organisations must assess three elements when deter - mining whether notification to the PPA is required: • whether Israeli privacy law applies based on suf - ficient territorial connection; • whether the incident constitutes a “Severe Security Incident”; and • whether any statutory or regulatory exceptions apply. Following notification, the PPA may instruct the organ - isation to notify affected data subjects.
185 CHAMBERS.COM
Powered by FlippingBook