Client updates / Regulation

Israel’s Privacy Protection Authority has published a draft opinion clarifying its interpretation regarding transfers of personal data from Israel to other countries. According to this interpretation, such transfers of personal data are generally permitted only if the receiving country ensures a level of data protection equivalent to that of Israel.

When the law came into effect last month, the Knesset Economic Affairs Committee prescribed an important series of exemptions from licensing requirements and updated timetables for submitting license applications in particular instances.

Until now, the HHS guidance provided a very broad interpretation of what constituted “protected health information” (PHI). This interpretation severely restricted data analytics service providers’ ability to cater to hospitals and for hospitals to manage their digital assets, in addition to exposing them to class action lawsuits. A federal court’s ruling to vacate the guidance is expected to facilitate both service providers and hospitals.

A new Israeli Supreme Court ruling states that, in particular instances, Israeli law will apply to engagements and agreements, even if those agreements stipulate that foreign law applies to them. In its decision, the court also issued several significant rulings that could affect commercial relations, in instances when cogent provisions of law apply.

The Dutch Data Protection Authority strictly interprets GDPR regarding data scraping, stating that data scraping will almost always be illegal.

An Israeli court ordered the McDonald’s fast food chain to pay ILS 40,000 to Maayan Parti, a consumer reporter for Israel’s Channel 12 News, after McDonald’s used the reporter’s name without her consent in an advertising campaign for the chain’s ice cream.

Developed for over two years, the American Privacy Rights Act proposes establishing a nationwide standard for privacy and data security, to empower individuals to control their personal information, as part of their right to privacy.

The French Data Protection Authority (CNIL) fined a corporation for violation of the GDPR due to flaws in its personal data collection and user consent practices, even though the data was collected by a third party.

Companies which distribute content online have been subject to the European Union’s Digital Services Act (DSA) since February 2024, which obligates them to protect their users from offensive and illegal content, enable users to report such content, etc. The DSA applies to any company whose content is accessible to European audience, regardless of its country of incorporation or the identity of its owners.

The AI Act applies, similar to other European legislation, to companies not based in the European Union but have activity in the Union. Therefore, it may also affect Israeli companies offering services in Europe.

The Israel Securities Authority’s publications in recent months do not reflect the final version of the directives, but indicate the ISA’s approach when regulating payment services: setting out the licensing process and the licensing requirements, defining criteria for exemptions, technological requirements, safeguarding and protecting customers’ funds, examining service providers’ integrity, etc.

In a paradoxical twist, the Israel Securities Authority also monitors unsupervised entities, to prevent them from exceeding their operational parameters without a license. Consequently, the ISA possesses the power to request documents and information from these entities, emphasizing the importance of responding honestly and comprehensively to such demands.

Small and medium-sized corporations are a central part of the Israeli economy’s growth engine and are considered major contributors to employment growth. The Israel Securities Authority is seeking to assist these businesses in diversifying their funding sources.

The new rules will require managers of large hedge funds to disclose additional information about their activities and strategies and provide more detail about their investments, including the countries and industries in which they are invested, leverage exposures, and more. As expected, fund managers are objecting, arguing that the new requirements will lead to superfluous information overload.

The court’s decision to start enforcement proceedings, in addition to the provisions of the California Consumer Privacy Act (CCPA) already being enforced, is expected to lead to a significant increase in enforcement against companies that fall in the scope of the CCPA.

The United States, the European Union, and other countries have been imposing economic sanctions on Israel for quite some time. The recent sanctions imposed on Israeli settlers suspected or convicted of committing violence against Palestinians may be a harbinger of a broad regime of sanctions that may affect business activities in Israel.

Uber’s insufficiently clear privacy protection policy and lack of transparency about the collection of personal information on its employees resulted in a heavy fine.

2023 trends are expected to continue in 2024, including the constantly evolving regulation of AI tools and new privacy protection and data security issues, as well as attempts by Israeli and global authorities to keep up with the pace at which technology is evolving and changing the face of the business world.

The high fine spares Meta an official determination by the Israel Competition Authority that it violated competition law by failing to report mergers, and serves as a “warning sign” to other international corporations that may not be sufficiently familiar with the obligation pursuant to Israeli law to report a merger if the company fulfills the monopoly criterion.

While AI tools offer significant contributions to businesses, even non-technological ones, it’s crucial to understand the potential exposures these tools may present. This guide emphasizes the importance of conducting examinations and implementing AI tools in a legal and transparent manner.