Clients updates / Privacy Law

E-commerce giant Amazon reported in its financial statements at the end of last month that the Luxembourg data protection authority had imposed on it a fine totaling EUR 746 million. The fine appears to have been laid on Amazon for its use of users’ personal data for targeted advertising, in violation of the EU’s General Data Protection Regulation (GDPR).

This past year has been nothing short of a rollercoaster ride for employers in Israel, in terms of both their business activities and their role as employers. Now, when we can perhaps see a glimmer of light at the end of the tunnel in the form of Israel’s vaccination campaign, quite a few questions arise.

Israel’s Privacy Protection Authority has published its recommendation that every organization appoint a privacy protection supervisor. This supervisor’s task is to implement the privacy protection laws that apply to the organization. The PPA noted that although Israeli law does not impose such a duty, it is a best practice recommended for organizations that collect and analyze personal data.

In early October, the Data Protection Authority in Hamburg, Germany announced that the clothing retailer H&M committed severe violations of its employees’ privacy. Because of these European General Data Protection Regulations (GDPR) violations, the retailer would pay a fine of approximately 35 million euros.

A July decision by the Court of Justice of the European Union has established that in light of the fact the United States does not respect the privacy of its citizens in accordance with EU standards, the Privacy Shield mechanism allowing for personal data transfers between Europe and the US can no longer be relied upon. At the same time, in Israel, the Ministry of Justice has published a memorandum that constitutes the first step in adjusting existing law to the digital age.

The global effort to fight the spread of coronavirus has prompted new privacy related questions around the world. Much has been written for and against the use of privacy-compromising measures to protect public health. Therefore, we have chosen to concentrate on the practical implications of privacy principles on companies and businesses.

The Israeli National Cyber Security Authority published recommendations for business and organizations related to privacy protections and data security for telecommuting due to coronavirus spread.

The United States Court of Appeals for the Ninth Circuit (in California) recently held that the scraping of data from public websites without any prior consent is lawful, even if it contradicts the provisions of a website’s terms of use.

The Hellenic Data Protection Authority (HDPA) recently imposed a EUR 150,000 fine on the international consulting firm PwC for its violations of the new European data protection regulations (the General Data Protection Regulations, or GDPR).

July 2019 brought an escalation in the enforcement of privacy infringements by companies around the world. These events underscore the trend that began with the GDPR taking effect and should lead any business entity coming across personal information.

Eight months after the European Union’s General Data Protection Regulations came into force, the French regulator issued Google a EUR 50 million fine, the highest fine issued so far under the GDPR.

The Israeli Privacy Protection Authority recently published a pronouncement whereby a collection of email addresses and the names of their owners also constitutes a database.

Recently, the UK Information Commissioner’s Office decided to take action against a non-European entity following an alleged breach of the GDPR.

Both Brazil and India have recently passed new privacy protection laws. These laws may also apply to Israeli companies doing business in the countries.

Over the last few days, the Privacy Protection Authority has begun sending in-depth questionnaires to various business entities for the purpose of examining these entities’ compliance with the Privacy Protection Regulations (Data Security) that came into effect on May 8, 2018.

California recently passed a sweeping consumer privacy law that significantly increases the protection provided to people whose personal information is being collected.

Recently, the Knesset approved a private bill that expands the scope of the “Spam Law.” The amendment is aimed at preventing the phenomenon whereby messages not necessarily commercial in nature are being sent to the general public, mainly through a robo-call system. 

On February 2018, the Knesset passed Amendment 66 to the Communications Law. The legislative amendment, colloquially known as “the Spam Law”, prescribes that when an ongoing transaction is terminated, a dealer will be prevented from continuing to send advertisements to the former customer, even without the consumer being required to send notice that he is opting out.

At the end of October 2017, the Privacy Protection Authority published a guideline about the use of surveillance cameras in the workplace and within the framework of employment relations. This guideline does not come as a surprise, as a draft of it was already published last year for public comments.