ISRAEL Law and Practice Contributed by: Dan Or-Hof, Eran Gandman, Netanel Aharon and Matan Adar, Or-Hof Law
declining enforcement. If no arguments are submitted within the statutory period, the notice of intent auto - matically becomes a payment demand. Enhanced Penalties for Continuing and Repeat Violations For continuing violations, an additional 1% of the base fine accrues daily following issuance of a payment demand, excluding appeal periods unless otherwise ordered. Repeat violations, defined as breaches of the same provision within two years of a prior fined violation, result in doubling of the penalty. Reduced Fine Provisions Administrative fines below statutory minimums may be imposed only in limited circumstances and subject Appeals against administrative enforcement actions must be filed with the magistrate’s court within 45 days. Appeals do not automatically stay enforcement unless approved by the PPA director or ordered by the court. The courts may affirm, modify, annul, or remit the decision with instructions. Where a fine is paid and the appeal succeeds, the refund includes index-linked interest from payment to refund. 1.9 Enforcement Trends Amendment No 13 The enactment of Amendment No 13 to the PPL in August 2025 represents the most significant reform of Israeli privacy law since 1981. The amendment substantially expands the PPA’s enforcement powers, including the authority to impose administrative fines, suspend database operations, and conduct criminal investigations. to strict statutory conditions. Appeal Rights and Timelines It also introduced mandatory appointment of DPOs and enhanced transparency obligations, and it broad - ened the PPA’s regulatory authority. Adequacy Status Reaffirmation In January 2024, the European Commission reaffirmed Israel’s GDPR adequacy status, ensuring uninter -
rupted data flows between Israel and the EEA. While reinforcing Israel’s attractiveness as a data hub, the decision maintains heightened compliance expecta - tions for databases containing EEA-originated per - sonal data. Surge in Cyber-Related Enforcement Following the October 2023 conflict, Israel experi - enced a rise in cyber-attacks. In response, the PPA intensified enforcement, managing 282 supervisory files and handling 224 Severe Security Incident reports in 2024. Enforcement actions included violation deter - minations and administrative fines against municipali - ties and medical centres for inadequate data security. Cross-Sectoral Supervision Expansion In 2024, the PPA expanded proactive, sector-wide audits across six additional industries, examining 175 entities in sectors including fintech, real estate, and mental health services. This supervision model, now embedded in Amendment No 13, aims to identify systemic risks at an early stage. Practical Takeaways Organisations should prepare for expanded DPO obligations, enhanced security testing (typically on an 18-month cycle), strengthened consent and trans - parency mechanisms, and continuous data mapping. Early enforcement actions, including an ILS70,000 fine imposed on HOT Telecommunication Systems Ltd, signal the PPA’s intention to actively exercise its expanded powers.
2. Privacy Litigation 2.1 Privacy Litigation Overview
Over the past 24 months, privacy and data-related litigation in Israel has increased markedly, with a rise in both individual claims and attempted class actions against private corporations and public bodies. Along - side regulatory enforcement by the PPA, courts are increasingly called upon to resolve civil disputes aris - ing from data breaches and unauthorised processing of personal information.
187 CHAMBERS.COM
Powered by FlippingBook