ISRAEL Law and Practice Contributed by: Dan Or-Hof, Eran Gandman, Netanel Aharon and Matan Adar, Or-Hof Law
5. International Considerations 5.1 Restrictions on International Data Transfers Legal Framework Cross-border data transfers are governed by the Data Transfer Regulations and the PPL. • Personal data: Regulation 1 prohibits transfers from Israel unless the destination ensures a level of protection no less than that provided under Israeli law. • Non-personal data: This is generally outside the ambit of the PPL, though sectoral regimes (eg, banking, insurance, defence and export control) may restrict transfers of sensitive industrial or state-related data. What Counts as a “Transfer” The PPL and PPA guidelines do not define “transfer”. However, as with the GDPR, it is likely that the inter - pretation of transfer will include: • physical or digital relocation of data to foreign serv - ers (eg, Cloud storage); and • remote access. Mechanisms for Lawful Transfer Transfers are permitted where adequacy exists (Reg - ulation 1) or an exemption applies (Regulation 2), including: • the data subject having given informed consent for the transfer; • transfer to a country that has ratified Convention 108; • transfer to a country recognised as “adequate” by the EU Commission; • contractual safeguards binding the recipient to Israeli-equivalent data protection standards; • intra-group transfers to controlled affiliates (eg, subsidiaries) subject to guaranteed protections; • vital interests, where the transfer is necessary for the data subject’s health or physical well-being and consent cannot be obtained; • public availability, where data was lawfully made public or opened for public inspection;
• Risk assessment – Buyers should review the target’s Database Definition Document and con - firm whether a DPO was appointed where legally required. Change of Control and Notification Requirements PPA Directive 2/2024 treats database transfers as events affecting data subjects’ rights: • Mandatory notification – Data subjects must be informed of the change in ownership and the iden - tity of the new controller, and allowed to exercise their rights, including deletion prior to transfer. • Consent v notice – Where the new owner’s charac - teristics differ substantially from those of the origi - nal owner in a manner likely to affect data subjects’ rights or expectations, notice alone may be insuf - ficient and prior consent may be required, even if processing purposes remain unchanged. Circumstances Requiring Explicit Opt-In Consent Explicit consent is required where there is a: • change of purpose and the buyer intends second - ary use beyond the original purpose (eg, AI training or cross-selling); and/or • material difference in the nature of the owner, and the buyer’s activities or ethical profile differ sub - stantially from those of the seller. Post-Closing Integration and Compliance After closing, the buyer assumes full controller respon - sibility for: • Database registration and notification – assessing whether notification or registration obligations are triggered. • Updating governance documents – updating the Database Definition and Database Structure Docu - ments and applying the buyer’s security regime in accordance with the Security Regulations. • Statutory liability – buyers may inherit liability for past violations. Enhanced privacy due diligence and contractual indemnities have therefore become standard in Israeli M&A transactions.
195 CHAMBERS.COM
Powered by FlippingBook