Expanded Application of Privacy Protection Regulations to Data from the EEA
As of January 1, 2025, the Israeli Privacy Protection Regulations (Instructions for Data Transferred to Israel from the European Economic Area) will also apply to data stored or processed in Israel or in other countries, such as the US and the UK, if the relevant databases also contain data transferred from Europe. In other words, once a database in Israel or another country contains personal information transferred from Europe, all data in that database must comply with the regulations’ requirements, not just data from Europe, but also local data and data from other countries.
These regulations, enacted about a year and a half ago, came into effect in August 2023 as part of the European Commission’s process of renewing the adequacy status that the EU granted to Israel in 2011. When the regulations came into effect, they imposed specific obligations on owners of databases in Israel receiving personal data from the European Economic Area (EU member countries, as well as Iceland, Norway, and Liechtenstein). Essentially, the regulations adopted elements of the European General Data Protection Regulation (GDPR) and applied them specifically to data originating in Europe.
Until January 2025, the regulations distinguished between European citizens’ data transferred to Israel or stored in Israeli databases, which were protected by the regulations, and data about Israelis or citizens of other countries, which were not subject to the regulations. As of January 2025, the protection previously reserved for data from the EEA will also apply to non-European data processed in an integrated database containing European data, regardless of the source of non-European data. This change eliminates the previous distinction and obligates database controllers to implement measures ensuring that all data in the database comply with the same stringent standards.
Exclusions from the Regulations
The regulations will not apply in certain circumstances—for example, if the data in the database came directly from a data subject in the EEA, rather than from a third party, or if the transfer is required for law enforcement purposes.
Furthermore, the regulations impose obligations only on database owners (and on database controllers pursuant to Amendment 13 to the Privacy Protection Law), not on database holders. For example, the regulations will not apply to an Israeli company that acts merely as a database holder for a company in an EEA country.
Expanded Obligations
The regulations impose various obligations adopted from the GDPR with respect to data processed in databases in Israel:
- Obligation to delete data – If a data subject requests it, database controllers must delete data that were unlawfully obtained or are no longer necessary for the purposes for which they were collected, subject to certain exceptions that allow the controller to retain the data.
- Obligations concerning data retention and deletion –Database controllers must implement mechanisms to ensure that the database does not retain data that are no longer necessary for the purposes for which they were collected and must delete such data as soon as possible.
- Obligations concerning data accuracy – Database controllers must ensure that data in the database are correct, complete, and up-to-date, and must take action to correct or delete data that do not meet these requirements.
- Obligation to inform data subjects – Database controllers must inform data subjects, through the transferor of the data, of the controller’s identity and contact details, the purposes of the transfer and use, the type of data being transferred, and the data subjects’ right to demand correction or deletion of their data.
The regulations impose more comprehensive obligations than those prescribed in Section 11 of the Privacy Protection Law. They essentially adopt the GDPR standard and expand the information that must be provided to data subjects, the framework for providing data and the requirements for transfers to third parties, including information about the type of data and the reason for their transfer. The regulations thus impose higher standards of transparency and disclosure on database controllers in Israel, meaning that Israeli companies may need to update their privacy policies and internal procedures.
Recommendations for Israeli Companies with International Operations
We recommend that Israeli companies processing personal data originating in EEA countries implement the following measures:
- Map all data in the database and their sources, determine the company’s rolein relation to the data (controller or holder only), and conduct a legal review to determine whether the regulations apply to all or some of the company’s databases in Israel.
- Conduct a risk assessment to identify the obligations that apply to the company in relation to the relevant databases.
- If the regulations apply to all or some of the company’s databases:
○ Revise the company’s privacy policy and internal procedures to ensure compliance with the regulations’ requirements, including procedures regarding data subjects’ rights.
○ Revise contracts with external service providers that have access to the protected data.
○ Implement control mechanisms to ensure compliance with the regulations’ requirements.
Israeli companies managing databases that contain data originating in EEA countries should implement these measures as soon as possible and revise their organizational and technological processes to support compliance with the regulations’ requirements.
Our Privacy, Cyber and AI Department is available to answer questions and help you make the necessary adjustments.
***
Dr. Avishay Klein is a partner and head of the firm’s Privacy, Cyber and AI Department.
Adv. Liav Shapira is an associate in the department.