ISRAEL Law and Practice Contributed by: Dan Or-Hof, Eran Gandman, Netanel Aharon and Matan Adar, Or-Hof Law
IP and Trade Secret Protection of Non-Personal Data Purely non-personal data is protected primarily under trade secret and contract law. • The “reasonable measures” test: Courts assess trade secret protection by reference to technical and organisational safeguards, increasingly aligned with the Security Regulations. • Contractual protection: For IoT and life sciences datasets, contractual restrictions (such as no- scraping and no-derivation clauses) remain the principal IP protection mechanism. The Interaction: the Identifiability Boundary The key friction point arises where privacy obligations override IP interests. • Reasonable effort: Data is treated as personal where re-identification is reasonably feasible. • Regulatory consequence: Where proprietary datasets contain insufficiently anonymised Data of Special Sensitivity, the PPA may order deletion or “unlearning” of trained models, effectively negating the underlying IP. 3.3 Rights and Obligations Under Applicable Data Regulation Following the full implementation of Amendment No 13 and the publication of multiple PPA Guidelines, Israeli data protection law has shifted from a technical registration-based regime to an accountability-driven framework. The PPL now provides a comprehensive set of rights and obligations broadly aligned with international standards, while preserving distinct Israeli features and remaining materially different from a GDPR-style regime. • Enhanced access and rectification: Data subjects have a statutory right to access their personal data and request correction of inaccurate or outdated information. Non-compliance may result in admin - istrative fines and statutory damages without proof of harm. • The right to deletion (erasure): Israeli law recognis - es a limited right to deletion. Deletion is mandatory
guishes between controllers and holders, with cloud providers often acting as holders. Even non-personal cloud data is scrutinised where it forms part of mixed datasets containing personal data, triggering height - ened safeguards under the EEA transfer regime. 3.2 Interaction of Data Regulation and Data Protection The interaction between these frameworks has been clarified by Amendment No 13 and the 2025 PPA Guidelines. Data processing in Israel is now viewed as a continuous spectrum in which privacy, confiden - The primary legal basis for processing personal data remains informed consent or statutory authorisation. Amendment No 13 has tightened the standard for a “lawfully established purpose”: • Granular transparency – Under the 2025 PPA Guidelines, consent for complex processing (including AI training and IoT telemetry) must be explicit, separate from general terms, and assessed across the data life cycle. • Purpose limitation – Section 8 (b) of the PPL strictly limits secondary use. In 2026, the PPA actively enforces this against “data creep”, particularly where consumer data is repurposed for AI devel - opment without renewed consent. Statutory and Professional Confidentiality Confidentiality obligations apply cumulatively, even where a lawful basis exists. tiality and proprietary rights intersect. Legal Basis and Purpose Limitation • Section 16 of the PPL: Prohibits disclosure of data obtained through one’s role or database access except for work purposes or by court order; breaches give rise to civil and potential criminal liability. • Holder (processor) obligations: Cloud providers and other holders bear direct statutory duties, preventing reuse of client data unless expressly authorised and disclosed.
190 CHAMBERS.COM
Powered by FlippingBook