Extracts :

Extract :

The notification obligation is also not novel in Israeli data protection law. The novelty is that the notification obligation under Section 11 of the PPL applies only to the entity collecting the personal information prior to, or at the time of, collection and does not apply to a processor receiving personal information from a controller. Equally, the level of transparency in the Regulations is broader than under Section 11 of the PPL (for further information, see also: Israel: PPA's new opinion regarding disclosures and transparency). This addition will most probably be implemented primarily through imposing these requirements on the EEA transferor of the personal data, by incorporating them in its privacy notice, which in any event needs to list the third-party recipients of the data and cross-border transfer aspects. Otherwise, it is doubtful how an Israeli controller, who is not collecting the personal information di- rectly from EEA data subjects, will be able to notify each individual EEA data subject about the processing, whereby the implementation costs may well increase the cost of service. In addition, the Regulations add to the legal definition of 'sensitive information' under Section 7 of the PPL (which is the Israeli equivalent of the GDPR's 'special categories of data'), only for data subjects whose personal information is transferred from the EEA, information about a person's origin, and information about trade union membership. Irrespective of the Regulations, in relation to trade union membership, there is a difference between the Israeli and the EU legal systems: in Israel, trade union membership would not be deemed as sensitive personal information unless such membership reveals opinions or beliefs of the data subject. Nevertheless, a person's origin should indeed be regarded as sensitive personal information, also for an Israeli data subject (and such proposal is included in the Protection of Privacy Bill (Amendment No. 14), 2022 (Bill No. 14) (Amendment 14) that was introduced in the former Parliament, passed initial reading, and will be heard in continuity in the current Parliament). To put things in perspective, it should be noted that the amended definition is relevant mostly to determine if the entity collecting such types of personal information is required under the PPL to register a database (Section 8(c)(2) of the PPL). Databases with EEA and non-EEA personal information In compliance with the purpose of their adoption, the Regulations apply to personal information transferred to Israel from the EEA. Nevertheless, in the hearing held on April 23, 2023, on the approval of the Regulations by the Constitution, Law and Justice Committee of the Parliament, the chairman of the committee proposed to award the same rights to Israeli personal information if such personal information is maintained in the same database as personal information originating from the EEA. This proposal was a partial attempt to overcome the numerous objections raised against the draft Regulations, claiming that they create a different regime for Israeli data subjects who will not enjoy these additional rights and therefore rendering Israeli data subjects inferior. Therefore, the final text of the Regulations was amended to apply to any kind of personal information included in a database in Israel, which covers personal information transferred from the EEA, meaning also personal information originating in Israel. Personal information of Israeli data subjects not included in a database, together with personal information originating from the EEA, will not be subject to the rights under the Regulations (although some rights can be applied through the existing pur- pose limitation principle and the obligation to delete excess data).

Reference :

Israel Data protection overview | DataGuidance

Information on Israel data protection

Extracts :

Extract :

Notification obligation A controller is required to inform data subjects whose personal information is transferred from the EEA, as soon as possible after receiving the personal information and no later than one month thereafter, that it is processing such data subject's personal data, including all of the following: • the controller's and the database's manager identity, addresses, and contact information; • purposes for which the personal information was transferred; • the type of personal information transferred; and • the data subject's rights of deletion under the Regulations, as well as access and correction rights under Sections 13 and 14 of the PPL. The controller must also notify such data subject, as soon as possible and no later than upon transfer of the personal information, when the latter is transferred to a third party, including the identity and contact information of the third party or the types of third parties, purposes of the transfer, types of personal information transferred, and data subject rights. The notification may be satisfied through the entity exporting the personal information from the EEA. A controller is exempt from the notification obligation if one of the exceptions listed in the Regulations apply (as required, and in a proportionate manner under the circumstances), which include that: • the controller has a reasonable ground to assume that the data subject is aware of the details regarding the transfer of personal information; • the controller does not know the data subject's contact details; • implementing the notification obligation involves an unreasonable burden on the controller; • there is a statutory confidentiality obligation or a legal prohibition on disclosing the details under the Regulations; • there is a statutory provision already governing disclosure of such details; • the implementation of the notification obligation may harm the life or well-being of an individual; and • the implementation of the notification obligation is more harmful to the rights of an individual than non-disclosure of the details under the Regulations.

Reference :

Israel Data protection overview | DataGuidance

Information on Israel data protection

Extracts :

Extract :

Obligation to delete information upon request (right to be forgotten) The Privacy Protection Law 5741-1981 (PPL) does not award a right to be forgotten, but rather a limited right to amend or delete personal information if it is incorrect, incomplete, unclear, or outdated (Section 14(a) of the PPL). According to the Regulations, a controller will be obligated to delete or anonymize (so that the data subject could not be identified with reasonable means) personal information upon the request of a data subject whose personal information is transferred from the EEA if: • the personal information was created, received, accumulated, or collected contrary to the provisions of any applicable law; • the continued use of such personal information violates any applicable law; or • the personal information is no longer needed for the original purposes. A controller may refuse the deletion request if the personal information is used for one of the purposes listed in the Regulations (as required, and in a proportionate manner for such purpose), which include exercising freedom of speech or the public right to be informed, fulfilling a legal duty, performance of a legally authorized act, protecting a public interest including archive, scientific, or statistical research, managing a legal process or debt collection, fraud and theft prevention, prevention of other actions that may affect the accuracy or reliability of the personal information, and exercising obligations under an international agreement to which the Israeli Government is party. Although the PPL does not include a right to be forgotten as such, the purpose limitation principle is part of the PPL (Sections 2(9) and 8(b) of the PPL). To that effect, its practical enforcement would be the deletion of personal infor- mation which is no longer needed for the original purposes. In addition, there are specific laws mandating the deletion of specific information in certain circumstances or after a certain time period (only available in Hebrew here). Deletion of excess personal information The controller is required to implement an organizational, technological, or another mechanism to ensure that it does not process personal information which is no longer required for the original purpose or for another legally permitted purpose, and to delete such excess information at the earliest time possible under the circumstances. The obligation does not apply if the personal information has been anonymized (so that the data subject cannot be identified with reasonable means) or if the personal information is used for one of the purposes listed above as exceptions to the right to be forgotten, excluding the case of fulfilling a legal duty or performance of a legally authorized act which does not apply here.

Reference :

Israel Data protection overview | DataGuidance

Information on Israel data protection

Extracts :

Extract :

Obligation to delete information upon request (right to be forgotten) The Privacy Protection Law 5741-1981 (PPL) does not award a right to be forgotten, but rather a limited right to amend or delete personal information if it is incorrect, incomplete, unclear, or outdated (Section 14(a) of the PPL). According to the Regulations, a controller will be obligated to delete or anonymize (so that the data subject could not be identified with reasonable means) personal information upon the request of a data subject whose personal information is transferred from the EEA if: • the personal information was created, received, accumulated, or collected contrary to the provisions of any applicable law; • the continued use of such personal information violates any applicable law; or • the personal information is no longer needed for the original purposes. A controller may refuse the deletion request if the personal information is used for one of the purposes listed in the Regulations (as required, and in a proportionate manner for such purpose), which include exercising freedom of speech or the public right to be informed, fulfilling a legal duty, performance of a legally authorized act, protecting a public interest including archive, scientific, or statistical research, managing a legal process or debt collection, fraud and theft prevention, prevention of other actions that may affect the accuracy or reliability of the personal information, and exercising obligations under an international agreement to which the Israeli Government is party. Although the PPL does not include a right to be forgotten as such, the purpose limitation principle is part of the PPL (Sections 2(9) and 8(b) of the PPL). To that effect, its practical enforcement would be the deletion of personal infor- mation which is no longer needed for the original purposes. In addition, there are specific laws mandating the deletion of specific information in certain circumstances or after a certain time period (only available in Hebrew here).

Reference :

Israel Data protection overview | DataGuidance

Information on Israel data protection

Extracts :

Extract :

A controller is required to inform data subjects whose personal information is transferred from the EEA, as soon as possible after receiving the personal information and no later than one month thereafter, that it is processing such data subject's personal data, including all of the following: • the controller's and the database's manager identity, addresses, and contact information; • purposes for which the personal information was transferred; • the type of personal information transferred; and • the data subject's rights of deletion under the Regulations, as well as access and correction rights under Sections 13 and 14 of the PPL. The controller must also notify such data subject, as soon as possible and no later than upon transfer of the personal information, when the latter is transferred to a third party, including the identity and contact information of the third party or the types of third parties, purposes of the transfer, types of personal information transferred, and data subject rights. The notification may be satisfied through the entity exporting the personal information from the EEA. A controller is exempt from the notification obligation if one of the exceptions listed in the Regulations apply (as required, and in a proportionate manner under the circumstances), which include that: • the controller has a reasonable ground to assume that the data subject is aware of the details regarding the transfer of personal information; • the controller does not know the data subject's contact details; • implementing the notification obligation involves an unreasonable burden on the controller; • there is a statutory confidentiality obligation or a legal prohibition on disclosing the details under the Regulations; • there is a statutory provision already governing disclosure of such details; • the implementation of the notification obligation may harm the life or well-being of an individual; and • the implementation of the notification obligation is more harmful to the rights of an individual than non-disclosure of the details under the Regulations.

Reference :

Israel Data protection overview | DataGuidance

Information on Israel data protection

Extracts :

Extract :

A controller is required to inform data subjects whose personal information is transferred from the EEA, as soon as possible after receiving the personal information and no later than one month thereafter, that it is processing such data subject's personal data, including all of the following: • the controller's and the database's manager identity, addresses, and contact information; • purposes for which the personal information was transferred; • the type of personal information transferred; and • the data subject's rights of deletion under the Regulations, as well as access and correction rights under Sections 13 and 14 of the PPL. The controller must also notify such data subject, as soon as possible and no later than upon transfer of the personal information, when the latter is transferred to a third party, including the identity and contact information of the third party or the types of third parties, purposes of the transfer, types of personal information transferred, and data subject rights. The notification may be satisfied through the entity exporting the personal information from the EEA. A controller is exempt from the notification obligation if one of the exceptions listed in the Regulations apply (as required, and in a proportionate manner under the circumstances), which include that: • the controller has a reasonable ground to assume that the data subject is aware of the details regarding the transfer of personal information; • the controller does not know the data subject's contact details; • implementing the notification obligation involves an unreasonable burden on the controller; • there is a statutory confidentiality obligation or a legal prohibition on disclosing the details under the Regulations; • there is a statutory provision already governing disclosure of such details; • the implementation of the notification obligation may harm the life or well-being of an individual; and • the implementation of the notification obligation is more harmful to the rights of an individual than non-disclosure of the details under the Regulations.

Reference :

Israel Data protection overview | DataGuidance

Information on Israel data protection

Extracts :

Extract :

Obligation to delete information upon request (right to be forgotten) The Privacy Protection Law 5741-1981 (PPL) does not award a right to be forgotten, but rather a limited right to amend or delete personal information if it is incorrect, incomplete, unclear, or outdated (Section 14(a) of the PPL). According to the Regulations, a controller will be obligated to delete or anonymize (so that the data subject could not be identified with reasonable means) personal information upon the request of a data subject whose personal information is transferred from the EEA if: • the personal information was created, received, accumulated, or collected contrary to the provisions of any applicable law; • the continued use of such personal information violates any applicable law; or • the personal information is no longer needed for the original purposes. A controller may refuse the deletion request if the personal information is used for one of the purposes listed in the Regulations (as required, and in a proportionate manner for such purpose), which include exercising freedom of speech or the public right to be informed, fulfilling a legal duty, performance of a legally authorized act, protecting a public interest including archive, scientific, or statistical research, managing a legal process or debt collection, fraud and theft prevention, prevention of other actions that may affect the accuracy or reliability of the personal information, and exercising obligations under an international agreement to which the Israeli Government is party. Although the PPL does not include a right to be forgotten as such, the purpose limitation principle is part of the PPL (Sections 2(9) and 8(b) of the PPL). To that effect, its practical enforcement would be the deletion of personal infor- mation which is no longer needed for the original purposes. In addition, there are specific laws mandating the deletion of specific information in certain circumstances or after a certain time period (only available in Hebrew here).

Reference :

Israel Data protection overview | DataGuidance

Information on Israel data protection

🇮🇱 Israel

Data subject classification

Citizens outside their jurisdiction are considered as data subjects : No

Persons within their jurisdiction are considered as data subjects : Yes

Legal entities are considered as data subjects : No

Data controller definition and responsibilities

Organizations located outside the jurisdiction processing regulated subjects data are considered as data controllers within the personal data legislation : No

Organizations with economic activities within the jurisdiction are considered as data controllers within the personal data legislation : Yes

Organizations located outside the jurisdiction monitoring regulated subjects data are considered as data controllers within the personal data legislation : No

Differentiation between how data controller and data processor are defined : Yes

Special/sensitive personal data definition

Definition of personal data that are "special" or "sensitive": financial data : Yes

Definition of personal data that are "special" or "sensitive": biometric data : Yes

Definition of personal data that are "special" or "sensitive": genetic data : Yes

Definition of personal data that are "special" or "sensitive": medical/health data : Yes

Definition of personal data that are "special" or "sensitive": criminal records data : Yes

Definition of personal data that are "special" or "sensitive": racial/ethnic origin : Yes

Definition of personal data that are "special" or "sensitive": political opinions : Yes

Definition of personal data that are "special" or "sensitive": religious/philosophical beliefs : Yes

Definition of personal data that are "special" or "sensitive": trade union membership : Yes

Definition of personal data that are "special" or "sensitive": geo-location data : No

Legal bases for data processing

Potential legal bases for processing personal data: appropriate notice has been provided to or made available to the data subject : Yes

Potential legal bases for processing personal data: the data subject has provided consent to the processing for the identified purposes : No

Potential legal bases for processing personal data: the personal data is necessary to perform a contract with the data subject : No

Potential legal bases for processing personal data: the personal data is necessary to comply with a legal obligation : Yes

Potential legal bases for processing personal data: the personal data is necessary to protect the vital interests of a natural person : No

Potential legal bases for processing personal data: the personal data is necessary for a public interest : Yes

Potential legal bases for processing personal data: the personal data is necessary to fulfil a legitimate interest of the controller or third party : No

Enforcement and penalties

Provision of administrative penalties by laws : No

Consideration of turnover rates for penalties? : No

Provision of criminal penalties - fines : No

Subject private remedies - presence of individual personal actions? : No

Subject private remedies - representative actions? : No

Subject private remedies - class actions? : No

Subject private remedies - file complaints with Data Protection Authorities? : No

Provision of criminal penalties - imprisonment : No

Data processing and security controls

Requirement of a DPIA : No

Ensuring encryption/pseudonymisation as a security control : Yes

Requirement for Controller to notify subjects of a data breach : Yes

Requirement for Controller to notify DPA of a data breach : Yes

Requirement for Processor to notify controller of data breach : No

Requirement for Processor to notify DPA of data breach : No

Requirement for Processor to notify subjects of data breach : No

Obligation to maintain information security control to protect personal data from unauthorized access or processing: general technical/physical/organizational security controls : Yes

Rights of data subjects

Right to object data use or/opt out : No

Right to data portability : No

Right against automated decision making : No

Right to be informed : Yes

Consent required for processing children's data : No

Right to access information : No

Right to rectification : Yes

Right to erase : Yes

Right to withdraw consent : No

Right to restrict data processing : No

International data transfer and data localization

Legal basis for international data transfer: approved jurisdictions : No

Legal basis for international data transfer: approved standard contractual clauses : No

Legal basis for international data transfer: derogations, such as consent, contract performance, necessity to establish, exercise or defend legal claims : No

Legal basis for international data transfer: binding corporate rules : No

Data localisation requirements: retention of personal data in local jurisdiction : No

Data localisation requirements: tax or financial record laws : No

Legal basis for international data transfer: EU/EEA adequacy : No

Legal basis for international data transfer: Convention 108 : No

Data localisation requirements: national security laws : No

Legal basis for international data transfer: APEC CBPRs : No

Data localisation requirements (such data is part of another type of record or dataset): retention or storage of personal data in the local jurisdiction or otherwise prohibit the transfer or disclosure of the personal data outside of the local jurisdiction : No

Data localisation requirements: anti-investigatory/blocking statutes that restrict any activity on local territory that aids a foreign government investigation : No

Data localisation requirements: other data localization regulations (export control laws/medical laws/employment laws etc.) : No

Data protection officer (DPO) requirements

Mandatory appointment of a DPO : Yes

Requirement of professional/legal qualification/expert knowledge for DPO : No

Clear DPO role specification : Yes

Group appointments: a group of undertakings to appoint a single DPO : No

Privacy notice requirements

To inform subjects via privacy notice: the existence of subject rights : Yes

To inform subjects via privacy notice: Controller/controller's representative contact details : No