Clients updates / Privacy Law

A recent ruling by the National Labor Court establishes that placing cameras near an employee’s workstation does not necessarily constitute a substantial deterioration in working conditions.

Recently, a US District Court in Illinois has granted final approval to a settlement in the Clearview AI consumer privacy litigation, concerning the company’s controversial practices of collecting and storing biometric facial recognition data. This should serve as a reminder that US state privacy laws are as relevant as ever and that their violation may lead to significant penalties.

The Israeli Privacy Protection Authority has issued a new statement introducing a significant change in the interpretation of the law and in the required methods for obtaining consent to the collection and processing of personal data. While the dry wording of the law enabled reliance on tacit or tacit consent, the PPA now clarifies that explicit, informed and free consent must be prioritized.

Several days ago, the European Data Protection Board (EDPB) adopted an opinion addressing key data protection concerns arising from the use of Artificial Intelligence (AI) models. The opinion specifically focuses on how GDPR principles apply to AI, emphasizing issues such as anonymization of data within AI models, the legal basis for processing personal data during AI development and deployment, and the consequences of unlawful data processing in AI systems.

As of January 1, 2025, the Israeli Privacy Protection Regulations (Instructions for data being transferred to Israel from the European Economic Area) will also apply to data being stored or processed in Israel or in other countries, such as the US and the UK, if these databases also contain data transferred from Europe. In other words, this means that as soon as a database in Israel or another country also contains personal information transferred from Europe, all data in the database must comply with the regulations’ requirements – not just the data that came from Europe, but also the local data or data that came from other countries.

Recent fines issued in New York are part of a wider trend of stricter state-level enforcement on cybersecurity in the U.S. Israeli companies operating in the U.S. are required to stay informed.

The Privacy Protection Authority has issued a mandatory guideline holding the board of directors fully responsible for information security, with heavy fines for violations. The guideline requires the board to oversee compliance with regulations and develop organizational policies, particularly for entities processing sensitive personal data.

The U.S. court is hearing artists’ lawsuits against AI platforms for copyright infringement. The decision could lead to new regulations and insights into the impact of using protected works for training.

The recent reform of the Privacy Protection Law aligns Israel’s privacy regulations more closely with European standards.

Israel’s Privacy Protection Authority has published a draft opinion clarifying its interpretation regarding transfers of personal data from Israel to other countries. According to this interpretation, such transfers of personal data are generally permitted only if the receiving country ensures a level of data protection equivalent to that of Israel.

Until now, the HHS guidance provided a very broad interpretation of what constituted “protected health information” (PHI). This interpretation severely restricted data analytics service providers’ ability to cater to hospitals and for hospitals to manage their digital assets, in addition to exposing them to class action lawsuits. A federal court’s ruling to vacate the guidance is expected to facilitate both service providers and hospitals.

The Dutch Data Protection Authority strictly interprets GDPR regarding data scraping, stating that data scraping will almost always be illegal.

An Israeli court ordered the McDonald’s fast food chain to pay ILS 40,000 to Maayan Parti, a consumer reporter for Israel’s Channel 12 News, after McDonald’s used the reporter’s name without her consent in an advertising campaign for the chain’s ice cream.

Developed for over two years, the American Privacy Rights Act proposes establishing a nationwide standard for privacy and data security, to empower individuals to control their personal information, as part of their right to privacy.

The French Data Protection Authority (CNIL) fined a corporation for violation of the GDPR due to flaws in its personal data collection and user consent practices, even though the data was collected by a third party.

The court’s decision to start enforcement proceedings, in addition to the provisions of the California Consumer Privacy Act (CCPA) already being enforced, is expected to lead to a significant increase in enforcement against companies that fall in the scope of the CCPA.

Uber’s insufficiently clear privacy protection policy and lack of transparency about the collection of personal information on its employees resulted in a heavy fine.

2023 trends are expected to continue in 2024, including the constantly evolving regulation of AI tools and new privacy protection and data security issues, as well as attempts by Israeli and global authorities to keep up with the pace at which technology is evolving and changing the face of the business world.

While AI tools offer significant contributions to businesses, even non-technological ones, it’s crucial to understand the potential exposures these tools may present. This guide emphasizes the importance of conducting examinations and implementing AI tools in a legal and transparent manner.

The Regional Labor Court in Tel Aviv has recognized an employee’s resignation as tantamount to dismissal under the law due to the employer’s use of surveillance cameras around the employee’s workstation in a manner inconsistent with the Privacy Protection Authority’s guidelines and the court’s position in such matters.