🇮🇱Israel

Israel's privacy framework has moved from database registration to broader data accountability

Israel's privacy regime is anchored by the Privacy Protection Law, 5741-1981. The Law still begins with the classic rule that a person must not invade another person's privacy without consent. But the updated framework is no longer only about traditional privacy torts and old-style database registration. It now uses modern concepts such as personal data, database controller, database holder, data of special sensitivity, lawful processing, notification duties, privacy protection officers, supervisory powers and administrative enforcement.

This makes Israeli compliance more operational. An organisation must still avoid privacy-invasive conduct, but it must also be able to show why personal data is processed in a database, who controls it, who holds it on behalf of the controller, what notice was given, whether registration or notification is required, whether a privacy protection officer must be appointed, and how data security is being maintained.

The main pillars to understand first

The privacy invasion framework answers the civil and criminal question: what conduct infringes privacy? It covers conduct such as harassment, prohibited eavesdropping, private-domain photography, misuse of private correspondence, use of a person's name, image or voice for profit, breach of confidentiality obligations, misuse of private affairs information and publication of intimate, health or private-domain matters.

The database processing framework answers the data governance question: when may personal data in a database be processed? The updated Law focuses on processing personal data only for the lawfully established purpose of the database, and only with authorisation from the database controller and within the scope of that authorisation. It also restricts processing where the personal data was created, received, accumulated or collected unlawfully.

The registration and notification framework answers the regulator-facing question: which databases must be registered or notified? Registration is now focused mainly on databases whose main purpose is collecting personal data to provide it to others as a business practice or for consideration, including direct mailing services, where the database contains personal data about more than 10,000 individuals, and on certain public body databases. A separate notification obligation applies where a database that is not otherwise registrable contains data of special sensitivity about more than 100,000 individuals.

The Privacy Protection Authority framework answers the enforcement question: who supervises compliance? The Head of the Authority supervises compliance with the Law and regulations regarding databases, may provide preliminary opinions, and has supervisory, administrative inquiry, administrative enforcement and penal enforcement powers.

How the updated framework works in practice

The Law now places much more emphasis on role clarity. A database controller determines, alone or with another, the purposes of processing the data in the database. A database holder is an external entity that processes data on behalf of the controller. A database manager is the controller, or in the case of a public body, the general manager or authorised person managing the database. These distinctions matter because responsibility, notices, rights handling, security duties, officer appointments and enforcement exposure can differ by role.

The definition of personal data is now broad and modern. It covers data relating to an identified or identifiable person, including identification through names, identification numbers, biometric identifiers, location data, online identifiers or details relating to physical, health, economic, social or cultural status. Data of special sensitivity includes categories such as intimate and family life, health, genetic data, biometric identifiers, origin, criminal history, political opinions, religious beliefs, worldview, personality assessments, location and transmission data, payroll and financial activity, legally confidential data and certain data transferred from outside Israel that receives special protection at source.

The collection notice is also more demanding. When personal data is requested for processing in a database, the person must be told whether providing it is legally required or voluntary, the consequence of non-consent, the purpose of the request, the controller's name and contact details, to whom the data will be delivered and for what purposes, and the existence of rights to review and request correction of personal data.

What organisations should prioritise

Start by replacing old database inventories with a controller-holder inventory. For each database, identify the controller, any holder, the database manager, the lawful purpose of establishment, the categories of personal data, whether data of special sensitivity is processed, the number of individuals, the source of the data, whether any data is received regularly from a public body, whether any data is transferred outside Israel, and whether the database is used for direct mailing or for providing data to others.

Then test the two regulator-facing thresholds separately. First, check whether the database must be registered because it is a qualifying data-transfer or direct-mailing business database with personal data about more than 10,000 individuals, or because it is a relevant public body database. Second, check whether the database must be notified because it contains data of special sensitivity about more than 100,000 individuals. Do not use the older assumption that every sensitive database automatically has the same registration trigger.

Next, test whether a privacy protection officer is required. Appointment may be required for public bodies and their holders, data businesses collecting personal data for delivery to others above the 10,000-person threshold, organisations whose main activities require continuous and systematic monitoring of individuals on a significant scale, and organisations whose main occupation includes processing data of special sensitivity on a significant scale.

Finally, build evidence. Keep section 11 collection notices, database definition documents, data security procedures, rights-response workflows, holder instructions, direct-mailing source records, registration or notification records, privacy officer reporting lines, and documentation showing that personal data is processed only for the lawfully established purpose and within controller authorisation.