ISRAEL Law and Practice Contributed by: Dan Or-Hof, Eran Gandman, Netanel Aharon and Matan Adar, Or-Hof Law
1.7 Regulators The PPA, operating as an independent authority pur - suant to Government Decision No 1890, serves as Israel’s principal data protection regulator. Following the entry into force of Amendment No 13 to the PPL on 14 August 2025, the PPA has emerged as a highly active regulator with significantly expanded powers. The PPA’s mandate extends beyond classic data pro - tection to encompass all privacy matters, including physical intrusions into privacy, and applies to both public bodies (including government ministries and municipalities) and private entities. It oversees compli - ance with the PPL and its implementing regulations, enforces regulatory guidance as binding obligations, and exercises authority over database registration and notification, data brokers, DPOs, and cross-border data transfers. Investigative Workflow and Triggers Enforcement proceedings may be initiated through multiple channels. Mandatory breach notifications trigger investigations in cases of Severe Security Inci - dents affecting medium or high-security databases. In parallel, the PPA conducts proactive, cross-sector inspections, particularly in industries handling Data of Special Sensitivity. Media reports and public com - plaints increasingly prompt investigations, alongside routine audits of organisations processing large vol - The PPA now wields extensive administrative powers. It may impose monetary sanctions reaching millions of shekels, issue orders suspending unlawful process - ing, initiate criminal investigations for serious viola - tions, and mandate corrective measures, including notification to affected individuals. Co-Ordination Mechanisms umes of personal data. Enforcement Powers Cross-border co-ordination is facilitated through Israel’s EU adequacy status, requiring alignment with GDPR standards for databases containing EEA-orig - inated data.
Binding Nature of Guidance In practice, the PPA treats its directives as binding norms. PPA officials have stated that guidance will be enforced as if it were statutory, creating a quasi- legislative compliance layer beyond the text of the PPL and its regulations. 1.8 Enforcement Proceedings and Fines Initiation and Conduct of Enforcement Proceedings The PPA initiates enforcement proceedings through proactive and reactive channels. Proactive enforce - ment includes systematic monitoring, while reac - tive investigations are triggered by information from regulatory bodies, public institutions, media reports, complaints from individuals or competitors, and intel - ligence tools. Once potential violations are identified, the PPA applies a graduated enforcement toolkit tailored to the severity and nature of the breach. Authorised investi - gators and supervisors may demand documents and information, enter premises where databases are rea - sonably believed to operate, conduct searches, and seize items pursuant to the Criminal Procedure Ordi - nance (Arrest and Search) [New Version], 5729-1969. Computer investigations, particularly in residential premises, require prior judicial authorisation from a magistrate court’s judge, and all PPA investigators are The enforcement framework comprises criminal, administrative, and supervisory measures. Criminal investigations may lead to indictments. Administrative tools include supervised remediation, suspension or revocation of database registration, formal determina - tions of violations, and administrative fines for specific breaches of the PPL. Administrative Fine Decision Process After considering arguments submitted under Sec - tion 23 (kh) of the PPL, the PPA determines whether to impose an administrative fine and may reduce its amount. The authority must issue either a reasoned payment demand specifying the fine, payment peri - od, and 45-day appeal right, or a reasoned decision certified in computer investigations. Available Sanctions and Remedies
186 CHAMBERS.COM
Powered by FlippingBook