Written by: Haim Ravia, Dotan Hammer
Amendment 13 to Israel’s Privacy Protection Law, the most significant Amendment to the law in decades, is set to take effect on August 14.
The amendment expands key definitions, such as “personal information” and “data processing,” aligning more closely with similar provisions in the GDPR and expanding the general application of the law. The Amendment limits database registration requirements while introducing new obligations, such as the appointment of a Data Protection Officer (DPO) in certain cases.
One of the major changes in the amendment is the new powers of enforcement and sanctions granted to the Israeli Privacy Protection Authority (PPA), including significant administrative fines. The PPA previously signaled its intention to use these powers to their full extent as soon as the amendment comes into force.
In preparation for Amendment 13, the PPA recently published guidance on several provisions. One set of guidelines clarified the circumstances in which appointing a DPO is legally required. According to the draft guidelines, any entity using a database dedicated to “extended and systematic monitoring of users’ personal data” is required to appoint a DPO. The PPA is accepting comments to these draft guidelines until September 23, but has signaled its intent to enforce the law based on the draft guidelines.
The PPA also recently clarified the process for submitting a request for an advance ruling by the regulator. This procedure allows covered entities to request the PPA’s legal opinion on specific fact-patterns of interest. The PPA is required to respond to the request within 60 days in most cases, with an opinion binding on all future regulatory action.
Click here to read our Client update regarding Amendment 13’s major provisions.
Click here to read the PPA’s guidance regarding advance ruling by the regulator (in Hebrew).
Click here to read the PPA’s draft opinion regarding the mandatory appointment of a DPO (in Hebrew).
