[Amendment: 5784]
(a)Where a controller of a database or a holder of a database has violated a provision of the provisions under this Law, as detailed below, the Head of the Authority may impose upon them a financial penalty in the amount of 150,000 new shekels, and if the database contained personal information concerning 1,000,000 persons or more, the Head of the Authority may impose upon them double that amount:
(1)They committed one of the following:
(a)processed personal information in a database required to be registered without it having been registered, contrary to the provisions of Section 8a(a);
(b)included incorrect particulars in an application for registration of a database submitted pursuant to Section 9, contrary to the provisions of that section;
(c)failed to notify the Head of the Authority of a change in the particulars enumerated in Section 9(b) or in particulars prescribed pursuant to Section 9(c), contrary to the provisions of Section 9(d), except for a change in the address of the controller of the database;
(2)failed to provide the Head of the Authority with a notification concerning a database required to give notification pursuant to Section 8a(b), or failed to notify the Head of the Authority of a change in any of the particulars detailed in that section, contrary to the provisions of that section;
(3)processed personal information in a database used for direct mailing services without the database having been registered in the register, or without one of its registered purposes being direct mailing services, contrary to the provisions of Section 17d;
(4)failed to notify the Head of the Authority that they regularly receive personal information in accordance with the provisions of Section 23c and that the information is stored in a database, contrary to the provisions of Section 23d(c).
(b)Where a controller of a database or a holder of a database has violated a provision of the provisions under this Law, as detailed below, the Head of the Authority may impose upon them a financial penalty pursuant to the provisions of this Chapter, in the amount of 15,000 new shekels:
(1)refused to allow a person whose personal information is held in the database to inspect the personal information pertaining to them, contrary to the provisions under Section 13;
(2)made a change to the personal information in their possession without notifying every person who received that information, contrary to the provisions under Section 14(b);
(3)failed to notify the applicant of a refusal to correct personal information contained in a database owned by them or to delete it, contrary to the provisions under Section 14(c);
(4)failed to correct personal information contained in a database held by them, contrary to the provisions of Section 14(d);
(5)failed to comply with a person's demand pursuant to Section 17f(b) that personal information referring to them be deleted from a database used for direct mailing, contrary to the provisions of Section 17f(d);
(6)failed to comply with a person's demand pursuant to Section 17f(c) that personal information referring to them not be transferred to a person, a category of persons, or specific persons, contrary to the provisions of Section 17f(d).
(c)(1)Where a controller of a database or a holder of a database has violated a provision of the provisions under this Law, as detailed below, the Head of the Authority may impose upon them a financial penalty pursuant to the provisions of this Chapter, in an amount equal to the product of 50 new shekels multiplied by the number of persons to whom the approach or demand was made, as detailed below, and if the approach or demand concerned information of special sensitivity — in an amount equal to the product of 100 new shekels multiplied by the number of such persons:
(a)approached a person to obtain personal information for the purpose of processing it in a database, without providing them with the notice required under Section 11;
(b)approached a person by way of direct mailing, contrary to the provisions of Section 17f(a);
(c)a controller of a database who failed to specify, upon a demand for personal information, that they regularly transfer information in accordance with Section 23c, contrary to the provisions of Section 23d(a).
(2)If the amount of the financial penalty pursuant to paragraph (1) is less than 30,000 new shekels, the Head of the Authority may impose upon a controller of a database or a holder of a database a financial penalty in the amount of 30,000 new shekels.
(d)(1)Where a controller of a database or a holder of a database has violated a provision of the provisions under this Law, as detailed below, the Head of the Authority may impose upon them a financial penalty pursuant to the provisions of this Chapter in the amount of 2 new shekels for each person whose personal information is contained in the database, and if the personal information in the database was information of special sensitivity — in the amount of 4 new shekels for each such person:
(a)approached a person to obtain personal information for the purpose of processing it in a database, where the approach was made to an unspecified group of persons, without providing them with the notice required under Section 11, contrary to the provisions of that section;
(b)failed to appoint an information security officer, contrary to the provisions of Section 17b(a);
(c)failed to appoint a privacy protection officer, contrary to the provisions of Section 17b1(a)(1) or (2);
(d)processed personal information in a database used for direct mailing services without maintaining a record specifying the source from which each data collection used for the purposes of the database was received and the date of receipt thereof, as well as a record specifying to whom each such data collection was transferred, contrary to the provisions of Section 17e;
(e)a controller of a database who failed to maintain a record of the personal information transferred in accordance with Section 23c, contrary to the provisions of Section 23d(b);
(f)with respect to a controller of a database listed in Section 17b1(a)(1) or (2) — failed to comply with the instructions of the Head of the Authority to cease or remedy a violation, contrary to the provisions of Section 23ke(d);
(g)the Minister of Justice, with the approval of the Constitution Committee, may prescribe by Order that the provisions of sub-paragraph (f) shall also apply with respect to a controller of a database or a holder listed in Section 17b1(a)(3) and (4).
(2)In a financial penalty pursuant to sub-paragraphs (d) and (e), the amount of the financial penalty shall be calculated according to the number of persons for whom there is no record as referred to in those sub-paragraphs.
(3)If the amount of the financial penalty pursuant to paragraph (1) is less than 20,000 new shekels, and if the personal information in the database was information of special sensitivity — less than 40,000 new shekels, the Head of the Authority may impose upon a controller of a database or a holder of a database a financial penalty in the amount of 20,000 new shekels or 40,000 new shekels, as the case may be.
(e)(1)Where a controller of a database or a holder of a database has violated a provision of the provisions under this Law, as detailed below, the Head of the Authority may impose upon them a financial penalty pursuant to the provisions of this Chapter in the amount of 4 new shekels for each person whose personal information is contained in the database, and if the personal information in the database was information of special sensitivity — in the amount of 8 new shekels for each such person:
(a)failed to comply with the instructions of the Head of the Authority pursuant to Section 23ke(a) to cease using information about a person's private affairs in a database for a purpose other than that for which it was provided, contrary to the provisions of Section 2(9), or to cease processing personal information in a database for a purpose that constitutes a privacy violation pursuant to Section 2;
(b)processed personal information in a database for an unlawful purpose, contrary to the provisions of Section 8(b), unless the processing was conducted solely in violation of the provisions of Section 2;
(c)failed to comply with the instructions of the Head of the Authority pursuant to Section 23ke(b) to cease processing personal information in a database that was created, received, accumulated or collected in violation of the provisions of this Law or in violation of the provisions of any other law regulating the processing of information, or to cease permitting another to process such personal information on their behalf;
(d)processed personal information without the authorization of the controller of the database, or in excess of such authorization, contrary to the provisions of Section 8(c);
(e)a controller of a database who transferred information received from a public body, contrary to the provisions of Section 23b, without the conditions of Section 23c having been fulfilled.
(2)If the amount of the financial penalty as referred to in paragraph (1) is less than 200,000 new shekels, the Head of the Authority may impose upon a controller of a database or a holder of a database a financial penalty in the amount of 200,000 new shekels.
(f)Where a controller of a database or a holder of a database processed personal information in a database otherwise than in accordance with the purpose assigned to it, contrary to the provisions of Section 8(b), in circumstances where it would have been possible to lawfully prescribe such a purpose, the Head of the Authority may impose upon them a financial penalty pursuant to the provisions of this Chapter in the amount prescribed in item (1) of the Third Schedule.
(g)Where a controller of a database or a holder of a database failed to provide a document or a copy of computer material to an inspector, contrary to the provisions of Section 23j(a)(2) or (3), the Head of the Authority may impose upon them a financial penalty pursuant to the provisions of this Chapter in the amount of 300,000 new shekels.
(h)Where a controller of a database or a holder of a database has violated a provision of the Regulations prescribed pursuant to Section 36, as detailed in Column A of the Third Schedule, applicable to them, the Head of the Authority may impose upon them a financial penalty pursuant to the provisions of this Chapter in the amount prescribed in relation thereto in Column B, Column C, Column D or Column E alongside that provision, as the case may be, and if the database is one to which the high security level in that Schedule applies and it contains information concerning 1,000,000 persons or more, the Head of the Authority may impose upon them double the amount prescribed in Column E alongside that provision.
(i)(1)Where a controller of a database or a holder of a database has violated a provision of the Regulations prescribed pursuant to Section 36, in the Fourth Schedule, as detailed in Column A of Part A of that Schedule, the Head of the Authority may impose upon them a financial penalty pursuant to the provisions of this Chapter in the amount prescribed in Column B alongside that provision.
(2)Where a controller of a database or a holder of a database has failed to comply with the instructions of the Head of the Authority pursuant to Section 23ke(c) to cease a violation of the provisions of the Regulations as referred to in Part B of the Fourth Schedule, the Head of the Authority may impose upon them a financial penalty pursuant to the provisions of this Chapter, in the amount prescribed in Column B alongside that provision in that Schedule.
(j)(1)Where a payment demand has been served upon a holder of a database in respect of a violation of a provision as referred to in subsection (h), the Head of the Authority shall notify the controller of the database accordingly, together with a copy of the payment demand served upon the holder, and shall instruct the controller to act to bring about the cessation of the violation by the holder, all within a period as the Head of the Authority shall direct.
(2)If the violation referred to in paragraph (1) has not ceased and the controller of the database has not carried out what the Head of the Authority required of them for the purpose of ceasing the violation, the Head of the Authority may serve upon them a notice of intent to charge as referred to in Section 23kz in respect of that violation, and the provisions under this Section shall apply to the controller of the database with respect to that violation, with the necessary modifications, as if they were the violator; the amount of the financial penalty to be imposed upon the controller of the database in respect of such a violation shall be the amount that could be imposed upon the holder in respect of that same violation.