ISRAEL Law and Practice Contributed by: Dan Or-Hof, Eran Gandman, Netanel Aharon and Matan Adar, Or-Hof Law
• Under the Security Regulations, subject to cer - tain conditions, databases containing employees’ personal data are subject to a low level of security (the basic level), even though they contain Data of Special Sensitivity. • Use of CCTV in the workplace environment is sub - ject to substantial governance rules and limitations under the PPA Guideline 5/17. • Use of location-based (eg, through GPS) monitor - ing of employees is restricted to necessary use cases and only during work time, pursuant to sev - eral Labor Tribunal decisions. • Employers do not have access to employees’ and job candidates’ criminal records and are forbidden to take into consideration any criminal proceedings related to employees and job candidates, even if the information is received indirectly, including from media and online resources. Monitoring and Time Tracking Monitoring is permitted only for legitimate business purposes and with maximum transparency: • Email and IT monitoring – Employers may monitor professional mailboxes only. Access to personal mailboxes requires a court order. Mixed mailboxes may be accessed only with employee consent and under strict limitations. • Video surveillance – Under Mark Friedman Ltd v Elkner (2025) and PPA guidance, cameras near individual workstations are generally prohibited; surveillance is permitted only in common areas for security purposes and pursuant to a written policy. • Biometric identification – As biometric data is high - ly sensitive, employers must provide non-biometric alternatives and may not disadvantage employees who refuse biometric identification. Remote Work and IT Systems The PPL contains no specific provisions on employee monitoring; the applicable framework is derived pri - marily from Isakov and PPA Guideline 5/17 (Use of Surveillance Cameras in the Workplace). Monitoring of digital activity is considered a signifi - cant intrusion and is permitted only where it serves a defined and legitimate purpose, complies with pro -
portionality, is conducted under a clear policy, and is supported by informed consent. In remote or hybrid work environments, monitoring must therefore be narrowly tailored, limited in scope and duration, and designed to minimise intrusion into employees’ private content, whether employer sys - tems or personal devices are used. Background Checks and Recruitment The processing of applicant data is governed by the PPL, the Equal Opportunities in Employment Law, 5748-1988, and the Criminal Information and Reha - bilitation of Offenders Law, 5741–1981. Employers are generally prohibited from requesting criminal record certificates, except where expressly authorised by law and strictly relevant to the position. Even then, processing remains subject to necessity, proportionality and purpose limitation. PPA Guideline 2/2012 requires transparency regarding assessment methods, informed consent, proportional data collection, and deletion of applicant data once no longer required. These principles apply to assessment centres and technology-assisted recruitment tools to the extent personal data is processed. 4.4 Data Protection in M&A The intersection of privacy law and M&A in Israel is governed by the modernised PPL, following Amend - ment No 13, and PPA Directive 2/2024 on the Transfer of Ownership in a Database. Pre-Closing and Due Diligence Any disclosure of personal data during due diligence is subject to strict proportionality: • Data minimisation – Sellers should avoid shar - ing identifiable data (such as full employee files or unmasked customer lists). The PPA expects the use of clean rooms, and anonymised or aggre - gated datasets. • Confidentiality agreements – Disclosures must be covered by NDAs containing dedicated data pro - tection clauses, strictly limiting use to transaction evaluation.
194 CHAMBERS.COM
Powered by FlippingBook