Written by: Haim Ravia, Dotan Hammer
The Israeli Privacy Protection Authority published draft guidance regarding the “Application of the Privacy Protection Law to Artificial Intelligence Systems”, for public consultation. The draft explains how the Israeli regulator intends to interpret and enforce privacy laws as applied to Artificial Intelligence (AI), emphasizing that the law applies throughout all stages of AI development and deployment, including information generated by AI.
The draft outlines how key privacy law principles apply to AI, such as requiring a legal basis for processing personal data, transparency and disclosures to data subjects, accountability, data security, and data subject rights.
Key aspects of the draft guidelines include:
- Elevated Disclosure Obligations: Organizations must clearly explain to data subjects the purposes and methods of AI processing, what personal data the AI system accesses, and must notify individuals when they are interacting with a non-human “bot”.
- Accountability Mechanisms: Organizations should adopt a Privacy-by-Design approach, appoint a designated officer to manage AI-related privacy issues, conduct Data Protection Impact Assessments (DPIAs), and establish generative AI use policies.
- Data Security Requirements: Organizations must address AI-specific risks when implementing data security obligations, including specific defenses against “inference attacks” aimed at extracting personal data from AI systems. These attacks must be monitored and reported to the regulator.
- Data Subject Rights: Privacy rights extend to AI and AI-generated data. Organizations may be required to correct faulty algorithms and implement mechanisms to ensure accuracy to comply with privacy rights.
- Limits on Online Personal Data Mining: Mining personal data available online for AI training purposes will be permissible only where implied consent exists. The draft specifies the conditions under which such consent may be inferred.The draft guidelines are open to public comments through June 5, 2025. If adopted, these guidelines will become the first authoritative regulatory framework in Israel specifically on Artificial Intelligence.Click here to read the draft guidelines of the Israeli Privacy Protection Authority on the Application of the Privacy Protection Law to Artificial Intelligence Systems (in Hebrew)
