Guide to Israel’s Protection of Privacy Law

In this guide:

Summary of Israel’s Protection of Privacy Law

The Israeli government created the Protection of Privacy Law (“the Privacy Law”) to establish clear parameters for the collection and use of personal and sensitive data. The Privacy Law affords individuals with enumerated rights to control their data and creates obligations for all parties collecting and using that data, including security requirements mandating effective steps are taken to safeguard any information held. To ensure entities are compliant with these stipulations, the Privacy Protection Authority (PPA) was created to be part of the Ministry of Justice as the sole Data Protection Authority (DPA). This guide to Israel’s Protection of Privacy Law will help you understand your rights as a resident, how to keep your business compliant and how data privacy helps individuals and organizations prevent data breaches and other malicious attacks every day.

Because the Privacy Law does not specifically define its jurisdiction, it can be assumed that the data subjects, or those individuals whose data is being collected, must be a resident or citizen of Israel. It is still to be determined if this applies to external organizations processing the personal information of individuals located in Israel, but this should reasonably be assumed since most other global data privacy laws do include an extraterritorial scope.

It is also worth noting Israel’s Privacy Law does distinguish between personal and sensitive data while affording the latter with even more stringent protections. Personal data is any information regarding the personality, status, health, finances, professional qualifications, opinions, and beliefs of an individual. Sensitive data includes all of the same information except status and professional qualifications, and any of this information can receive additional protection if designed by the Minister of Justice.

To grant individuals with the power to own their own personal data, the Privacy Law establishes the following rights:

• Right to be informed: Before any data collection occurs, the individual has the right to be informed about the purpose and type of collection occurring.
• Right to access: Individuals have the right to access and review information about them held by an entity.
• Right to rectification: Individuals can request the correction of any inaccurate, incomplete, unclear or outdated information being held about them.
• Right to erasure: Individuals have the right to request the erasure of their personal data, unless there is a compelling legal reason for keeping it.
• Right to object: Unique to Israel, a data subject can only object to the processing of their data by means of a civil suit despite this being granted as a right today.

Compared to other similar laws around the world, this is notably lacking in two protections: the right to data portability and the right to not be subjected to automated decision-making.

At the same time, businesses and any other entity collecting and processing personal data are obligated to comply with numerous mandates to ensure these rights can be exercised. Violations can result in fines costing millions of dollars, with increasing costs for every day the issue remains unresolved.

The key facets of the Privacy Law that organizations must consider include:

• Obtaining consent: Businesses must obtain explicit consent from individuals, before collecting their personal information, in the language of their choosing (limited to Hebrew, Arabic or English).
• Purpose limitation: Businesses must collect personal information for a specified, legitimate purpose and must not use it for any other purpose without the individual’s consent.
• Data minimization: Businesses must only collect the personal information that is necessary for the specified purpose.
• Data security: Businesses must take appropriate security measures to protect personal information from unauthorized access, use, disclosure, alteration, or destruction.
• Data retention: Businesses must only retain personal information for as long as is necessary for the specified purpose.
• Transparency: Businesses must be transparent about how they collect, use, and store personal information.

The Protection of Privacy Law plays a crucial role in safeguarding the privacy rights of individuals in Israel. By establishing clear guidelines for data handling and empowering individuals with control over their personal information, the law strives to maintain a balance between the legitimate use of personal data and the protection of individual privacy.

Source: Israeli Government Website (Unofficial Translation)

Guide your business to compliance

The Protection of Privacy Law (POPI) is a comprehensive data privacy law that applies to all businesses that collect, use, or store personal information about residents and citizens of Israel. In 2017, Israel implemented additional Data Security Regulations to expand upon the provisions in the Privacy Law, so organizations must consider the following best practices to ensure legal compliance today:

• Establish a system to gather and record informed consent from a data subject prior to data collection, with processes in place to quickly react to Data Subject Access Requests (DSARs) to access, rectify, or erase a person’s data, or opt-out from future data collection.
• Implement effective security measures covering at least the minimum requirements outlined in the Data Security Regulations.
• Create a database settings document, similar to the processing record required by other global legislation, to describe data collection and processing procedures of the organization.
• Take reasonable measures to verify employee access is appropriate and authorized for each individual.
• Train and inform employees about the requirements of the Privacy Law and Data Security Regulations to ensure proper handling of personal information within the organization.
• Appoint an Information Security Officer (ISO) to oversee data protection compliance, document security incidents and maintain effective business practices. For larger organizations, it is recommended to appoint a Data Protection Officer (DPO) as well to monitor business practices even more closely, although this is not required.
• Regularly review and verify compliance using a third-party organization, not the ISO, and conduct a data protection impact assessment (DPIA).
• Register the database with the Registrar prior to managing or holding data, unless the organization has been specifically permitted to perform these acts prior to registration.
• Avoid transferring held data (“the database”) to any organization outside of the country. For transfers to another organization within the country, notification must be submitted to the Registrar.
• Notify the PPA promptly following a data breach incident.

Data privacy is a fundamental human right, and investing in it ensures that individuals have control over their personal information and are protected from unauthorized access, misuse, or disclosure. Organizations that demonstrate a strong commitment to data privacy gain the trust of their customers, fostering loyalty and encouraging repeat business. Plus, a strong data privacy posture can enhance a company’s reputation, making it more attractive to partners, investors, and potential employees while reducing the risk of a data breach and the ensuing financial losses.

In today’s data-driven world, organizations that effectively manage and protect data gain a competitive advantage in the market. At the same time, a robust data privacy framework can foster innovation, enabling organizations to develop new products and services while protecting the privacy of individuals. By investing in data privacy, organizations contribute to a more secure and trustworthy digital ecosystem, where individuals can interact online with confidence.

Investing in data privacy is not just a compliance exercise; it’s a strategic investment that protects individuals’ rights, enhances business reputation, and drives innovation. Organizations that prioritize it will be better positioned to thrive in the increasingly data-driven world.

Why data protection is vital

Protecting personal data and providing details about data usage is imperative for businesses engaged in online service delivery. New regulations are sprouting up around the word, necessitating more stringent opt-in and opt-out policies and granting consumers more rights to review, revise and remove their data.

Despite the proliferation of these regulations, the onus primarily falls on the individual to oversee, assess, and request the removal of their personal data wherever it may be exposed across the internet. The task becomes even larger when applied across an entire operation, which typically makes it impossible for a single person or small team to manage without professional assistance. Yet the identification and subsequent elimination of this data plays a pivotal role in deterring cybercriminals, as it substantially reduces a company’s attack surface and mitigates the looming threat of a data breach. This is where Privacy Bee emerges as the optimal solution, simplifying the time-consuming process of monitoring and eradicating employee personal data for business leaders. It’s especially effective for executives who are highly visible to the general public.

Privacy Bee both minimizes the proliferation of your organization’s personal data across the vast digital landscape and extends its protective umbrella to vendors, helping you ensure 3rd party partners do not serve as the weak link in your security defenses in the future. If you already conduct risk assessments and vendor surveys, kudos to you! However, it is still essential to recognize vendors are most susceptible to a breach via subpar data privacy management, which you wouldn’t want to lead to undue exposure for your organization.

In the ever-expanding, billion-dollar surveillance industry, Data Brokers and People Search Sites have assumed pivotal roles, reaping profits by trading your organization’s information with obscure and uncontrollable entities. The consequences of private data exposure on the internet are far-reaching and pose significant threats when obtained by malicious hackers.

A solitary data breach can lead to a loss in productivity, expensive remediation efforts, and recurring breach incidents—a predicament that plagues the majority of businesses following an initial breach. The first data breach sets off a chain reaction that not only inflicts short-term damage on your bottom line but also erodes brand value and customer trust over time. Furthermore, there are ripple effects to consider, such as heightened employee turnover due to poaching and a substantial decline in productivity due to more sophisticated spam attacks.

Privacy Bee combats threat actors lurking beyond your organization’s perimeters proactively. By meticulously pinpointing every nook and cranny of the internet where your data resides and swiftly purging it, Privacy Bee closes the data security gap. The service even encompasses dark web monitoring and provides timely data breach notifications if another company falls victim to an exploitation incident and potentially exposes your information in the process. When a breach happens, the quickest possible time to discovery and remediation is critical.

Our unwavering commitment is deeply rooted in the belief that privacy is an inalienable human right that transcends political discourse and negotiations. This is the reason why Privacy Bee vigilantly monitors user data for security vulnerabilities while holding the surveillance industry accountable. We compel Data Brokers, People Search Sites, and more than 150,000 additional websites to expunge your stored data and opt out of further data collection.

Privacy Bee protection covers a wide range of potential threats, including:

• Data breaches
• Social engineering attacks
• Phishing
• Doxxing
• Identity theft
• Spam emails
• Telemarketing calls
• Cyberstalking
• Swatting
• Blackmail

Our service is a powerful tool for business leaders who want to protect their employees’ and customers’ data. In today’s world, where privacy is more important than ever, Privacy Bee is your trusted partner in the fight to preserve personal and organizational integrity.