ISRAEL Law and Practice Contributed by: Dan Or-Hof, Eran Gandman, Netanel Aharon and Matan Adar, Or-Hof Law
The Two Regulatory Pillars Targeted advertising operates under two complemen - tary statutes: • The PPL – Governs profiling and direct mailing, defined as contacting individuals based on data - base segmentation. • The Communications Law (Telecommunications and Broadcasting), 5742-1982 (the “Spam Law”) – Section 30A regulates the transmission of com - mercial messages via electronic means, including email and other electronic messages, mobile text Amendment No 13 expanded Data of Special Sen - sitivity to include location data, financial activity, and biometric identifiers. Mandatory DPO Entities whose core activity is to provide direct mailing services and which process the data of over 10,000 individuals must appoint a DPO. Database registration Registration remains mandatory for databases for the commercialisation of personal data, including data brokers and potentially, ad-tech companies. Consent and Opt-In Requirements Under the PPL, direct mailing notices must disclose the controller’s identity, data source (especially third- party data), opt-out rights and, where applicable, the database registration number. Under the PPA’s 2017 Direct Mailing Guidelines, consent for direct mailing services unrelated to the transaction’s purpose (eg, lead generation or data enrichment) must be obtained through an active and explicit indication of consent. Following Aviv v Meta Platforms (2025), bundling con - sent to privacy practices, particularly advertising uses, with acceptance of general terms of use is likely to invalidate such consent. messages, faxes and automated calls. Profiling and Data of Special Sensitivity By contrast, where an organisation sends direct mail - ing to its own customers regarding products or servic - es related to its core offering, it is generally sufficient to disclose the intended use and provide an opt-out
mechanism, even if opting out results in service ter - mination. Under the Spam Law, prior written or electronic con - sent is required, subject only to the narrow “existing customer” exception. Consent to receive advertising must be separate from consent to terms of use or other privacy practices. Protection of Children and Sensitive Categories Children’s privacy (under 18) Minors generally lack the legal capacity to consent independently. However, legal acts that minors of their age are accustomed to performing, such as routine, low-risk transactions, are generally valid. Platforms targeting children should implement age-assurance mechanisms, and profiling based on children’s sensi - tive data requires verified parental consent. Sensitive profiling Advertising based on Data of Special Sensitivity requires explicit opt-in. The PPA’s 2025 AI Guidance cautions against indirect “inference attacks” designed to deduce sensitive traits. 4.3 Employment Privacy Law The landscape for workplace privacy in Israel is shaped by the PPL and its regulations, together with landmark rulings of the National Labor Tribunal and The main governing principles are as follows. • In Isakov v State of Israel (2011) (“ Isakov ”), the National Labor Tribunal required any employer seeking access to an employee’s mailbox and digi - tal assets on the employer’s computer systems to meet cumulative tests of legitimacy, proportionality, and transparency. • In the New General Federation of Labor (Histadrut) v the Municipality of Kalanswa (2017), the National Labor Tribunal prohibited employers from requir - ing employees to use a fingerprint-based biometric attendance system without authorisation by law, or with the employees’ informed and freely given, separate and explicit consent. additional labour case law. The Core Legal Standards
193 CHAMBERS.COM
Powered by FlippingBook