Clients updates / Privacy Law

Following an extensive public consultation process, a final report on the use of AI in the financial sector was published last week. The report was prepared by a committee comprising representatives of the Ministry of Justice, the Ministry of Finance, the Competition Authority, the Israel Securities Authority, the Capital Market, Insurance and Savings Authority, and the Bank of Israel.

The European Commission recently published the Digital Omnibus, aimed at simplifying data regulation within the European Union by amending key legislation governing digital data. In this update, we summarize the proposal’s key aspects.

Amendment 13 to the Israeli Privacy Protection Law significantly strengthens the PPA’s enforcement powers, requiring insurance agencies to ensure strict compliance in handling personal and sensitive data. Agencies must implement robust data security, transparency, and control measures to avoid substantial fines and regulatory sanctions.

A significant development occurred last week at the interface between artificial intelligence and intellectual property following the settlement agreement reached by Anthropic in the class action lawsuit filed against it with the US District Court for the Northern District of California.

Amendment 13, which significantly updates privacy laws in Israel, has come into effect! If you still don’t know what to do to comply with the requirements, we’ve prepared a guide to help you address the main issues (not all of them) right now! In this guide, you can find simple tips to implement in your organization to improve compliance with Israeli privacy law requirements.

Amendment 13 to the Israeli Privacy Protection Law is expected to come into effect in mid-August 2025. The amendment prescribes, inter alia, organizations’ obligation to appoint a data protection officer. The Privacy Protection Authority recently published a draft directive on implementing this obligation. The draft is not final and is open for public comments.

At the end of June 2025, the Northern California District Court issued two precedent-setting rulings addressing the legal question: Is it lawful to use copyrighted works for machine training of AI-based large language models (LLMs)?

Israel’s Attorney General has filed her position with the Tel Aviv District Court in support of a motion to order Google to actively block websites that are infringing copyrights and enabling viewing of pirated content for free.

The Israeli Privacy Protection Authority (PPA) published a draft directive recently to clarify its position about how businesses and organizations should apply the provisions of the Privacy Protection Law and the privacy regulations to artificial intelligence systems.

Earlier this month, the European Data Protection Board (EDPB) issued draft guidelines on the processing of personal data through blockchain technologies.

A recent ruling by the National Labor Court establishes that placing cameras near an employee’s workstation does not necessarily constitute a substantial deterioration in working conditions.

Recently, a US District Court in Illinois has granted final approval to a settlement in the Clearview AI consumer privacy litigation, concerning the company’s controversial practices of collecting and storing biometric facial recognition data. This should serve as a reminder that US state privacy laws are as relevant as ever and that their violation may lead to significant penalties.

The Israeli Privacy Protection Authority has issued a new statement introducing a significant change in the interpretation of the law and in the required methods for obtaining consent to the collection and processing of personal data. While the dry wording of the law enabled reliance on tacit or tacit consent, the PPA now clarifies that explicit, informed and free consent must be prioritized.

Several days ago, the European Data Protection Board (EDPB) adopted an opinion addressing key data protection concerns arising from the use of Artificial Intelligence (AI) models. The opinion specifically focuses on how GDPR principles apply to AI, emphasizing issues such as anonymization of data within AI models, the legal basis for processing personal data during AI development and deployment, and the consequences of unlawful data processing in AI systems.

As of January 1, 2025, the Israeli Privacy Protection Regulations (Instructions for data being transferred to Israel from the European Economic Area) will also apply to data being stored or processed in Israel or in other countries, such as the US and the UK, if these databases also contain data transferred from Europe. In other words, this means that as soon as a database in Israel or another country also contains personal information transferred from Europe, all data in the database must comply with the regulations’ requirements – not just the data that came from Europe, but also the local data or data that came from other countries.

Recent fines issued in New York are part of a wider trend of stricter state-level enforcement on cybersecurity in the U.S. Israeli companies operating in the U.S. are required to stay informed.

The Privacy Protection Authority has issued a mandatory guideline holding the board of directors fully responsible for information security, with heavy fines for violations. The guideline requires the board to oversee compliance with regulations and develop organizational policies, particularly for entities processing sensitive personal data.

The U.S. court is hearing artists’ lawsuits against AI platforms for copyright infringement. The decision could lead to new regulations and insights into the impact of using protected works for training.

The recent reform of the Privacy Protection Law aligns Israel’s privacy regulations more closely with European standards.

Israel’s Privacy Protection Authority has published a draft opinion clarifying its interpretation regarding transfers of personal data from Israel to other countries. According to this interpretation, such transfers of personal data are generally permitted only if the receiving country ensures a level of data protection equivalent to that of Israel.