Translation Notice — This is an English translation of a Hebrew law and may contain inaccuracies. In any dispute or legal matter, the original Hebrew text as published in Reshumot (ספר החוקים) is the sole authoritative and legally binding version.
Law
Protection of Privacy Law, 5741-1981
חוק הגנת הפרטיות
Section B: Direct Mailing
17c.
[Amendment: 1996, 2024]
Direct Mailing
17d.
[Amendment: 1996, 2024]
A controller of a database or a holder of a database shall not process personal data in a database used for direct mailing services, unless the controller or holder is registered in the Register and one of the controller's or holder's registered purposes is mailing services.
Indication of Data Source
17e.
[Amendment: 1996, 2024]
A controller of a database or a holder of a database shall not process personal data in a database used for direct mailing services, unless the controller or holder maintains a record indicating the source from which each collection of data used for the purposes of the database was received and the date of its receipt, as well as to whom each such collection of data was transferred.
Deletion of Data from a Database Used for Direct Mailing
17f.
[Amendment: 1996, 2007, 2024]
(a)Every direct mailing communication shall contain, in a clear and prominent manner —
(1)an indication that the communication is a direct mailing, together with an indication of the registration number of the database used for direct mailing services in the Database Register;
(2)a notice of the right of the recipient of the communication to be deleted from the database as provided in subsection (b), together with the address to which a request for such deletion is to be directed;
(3)the identity and address of the controller of the database in which the personal data pursuant to which the communication was made is held, and the sources from which that controller of the database received such data.
(b)Any person is entitled to demand, in writing, from the controller of a database used for direct mailing, that personal data relating to that person be deleted from the database.
(c)Any person is entitled to demand, in writing, from the controller of the database used for direct mailing services or from the controller of the database in which the data pursuant to which the communication was made is held, that personal data relating to that person not be transferred to any person, category of persons, or specific persons, all for a limited or permanent period of time.
(d)Where a person has notified the controller of the database of a demand as provided in subsections (b) or (c), the controller of the database shall act in accordance with the demand and shall notify the person, in writing, that the controller has done so.
(e)Where the controller of the database has not provided the notice referred to in subsection (d) within 30 days of the date of receipt of the demand, the person to whom the data relates may apply to the Magistrate's Court in the manner prescribed by Regulations, in order that the court order the controller of the database to act as aforesaid.
(f)The rights under this Section of a deceased person who is registered in a database are also vested in that person's spouse, child, parent, or sibling.
17g.
[Amendment: 1996, 2024]
Non-Application to a Public Body
17h.
[Amendment: 1996]
This Section shall not apply to a public body as defined in Section 23(1) in the performance of its functions under law.
Preservation of Laws
17i.
[Amendment: 1996]
The provisions of this Section are in addition to the provisions of any other law.
Need to cite this law in a foreign court?
Eli Shimony Israeli Attorneys-at-Law provides certified Expert Legal Opinions on Israeli law within 24–48 hours, accepted by courts worldwide.
Contact Us →Section C: The Privacy Protection Authority
The Privacy Protection Authority
17i1.
[Amendment: 5784]
(a)The Head of the Authority shall supervise compliance with the provisions of this Law and the Regulations made thereunder with respect to databases.
(b)A person acting on behalf of the Head of the Authority shall have the same status as a State employee, unless otherwise provided in this Law.
(c)The Authority shall publish its procedures regarding the exercise of its powers on its website; however, details that constitute information which a public authority is precluded from disclosing pursuant to Section 9(a) of the Freedom of Information Law shall not be published, and the Authority may refrain from publishing details that constitute information which a public authority is not required to disclose pursuant to Section 9(b) of that Law.
(d)Notice of the appointment of the Head of the Authority shall be published in the Official Gazette.
Preliminary Opinion
17i2.
[Amendment: 5784]
(a)At the request of a controller of a database or a holder of a database, or a person who is about to become one of the foregoing, the Authority shall issue a preliminary opinion regarding a database's compliance with the requirements of this Law or the provisions made thereunder with respect to the processing of information in the database (in this Law – "preliminary opinion").
(b)A request for a preliminary opinion shall include the purpose of the request and all facts required for the issuance of the opinion, together with the relevant documents.
(c)A preliminary opinion shall be issued within 60 days of the date of receipt of the request as referred to in subsection (b) or of the date of submission of the relevant documents, whichever is later; the Head of the Authority may extend the time limit in special circumstances; if the Authority decides not to issue a preliminary opinion, it shall notify the applicant thereof within 45 days of the said date.
(d)The Authority may publish a preliminary opinion with the consent of the applicant; if the applicant does not consent to the publication of the preliminary opinion, the Authority may publish it without details capable of identifying the applicant.
(e)The Head of the Authority shall establish a procedure, which shall be published on the Authority's website, regarding the manner of submitting a request for a preliminary opinion and the circumstances in which an opinion shall not be issued in respect of requests of the following types:
(1)A request concerning a matter on which the Authority's position has previously been published or in respect of which there is clear established case law;
(2)A request whose application and implications are limited to the applicant's particular matter relative to the substantial allocation of resources that handling it would require;
(3)A request that is theoretical or academic in nature;
(4)A request tainted by lack of good faith;
(5)A request relating to pending proceedings, including supervisory, inquiry, or criminal enforcement proceedings, under this Law;
(6)A request whose handling would require an unreasonable allocation of resources.
Report on the Activities of the Privacy Protection Authority and Reporting to the Constitution Committee
17i3.
[Amendment: 5784]
(a)The Head of the Authority shall prepare, by 1 June of each year, a report on the actions taken by the Authority to implement the provisions of this Law in the year preceding the preparation of the report, including enforcement and supervisory actions (in this Section – "report on the activities of the Privacy Protection Authority"); the Privacy Protection Council shall submit the report, together with its comments, no later than 1 July of each year, to the Constitution Committee.
(b)The report on the activities of the Privacy Protection Authority shall include, inter alia, information as detailed below, broken down by Government ministries, other public bodies, and private entities:
(1)The number of requests for preliminary opinions submitted to the Authority and the number of opinions issued;
(2)The number of requests for registration of databases submitted pursuant to Section 8a(a) and the number of requests refused or databases whose registration was suspended pursuant to Section 10(a), and the reasons for the refusal or suspension;
(3)The number of databases subject to registration under Section 8a(a) that were granted an exemption from the registration requirement;
(4)The number of databases whose registration was suspended or cancelled pursuant to Section 10(f);
(5)The number of notifications regarding databases submitted to the Privacy Protection Authority pursuant to Section 8a(b) and the number of controllers or holders of such databases that were subjected to supervision or an administrative inquiry in the year following the submission of the notification;
(6)The number of complaints submitted to the Authority against controllers or holders of databases regarding violations under this Law;
(7)The number of broad-scope supervisory reviews conducted pursuant to Section 23iz;
(8)The number of administrative inquiry proceedings opened pursuant to Section 23ib(a), and in how many of them a decision was made to conduct an investigation instead of an inquiry proceeding, pursuant to Section 23it(b);
(9)The number of search and seizure orders or orders for access to computer material requested from the court pursuant to Section 23id(a) and the number of cases in which an order was granted;
(10)The number of complaints submitted to the Head of the Authority against an external expert pursuant to Section 23ih(h), and how many of them were found to be justified;
(11)The number of orders to cease a violation issued pursuant to Section 23kh, broken down by type of violation, in how many of them an appeal was filed, and how many appeals were accepted in full or in part;
(12)The number of administrative warnings issued pursuant to Section 23lf, in how many of them a request for cancellation was submitted pursuant to Section 23lz, and what the outcomes of the request were;
(13)The number of cases in which a violator was given notice of the possibility of submitting an undertaking and depositing a bond in lieu of the imposition of a financial penalty pursuant to Section 23lt, and in how many cases the violator submitted an undertaking and deposited a bond pursuant to Section 23m(c);
(14)The total financial penalties imposed pursuant to Section 23kf, the average amount of the financial penalty imposed, the highest penalty imposed, and the lowest penalty imposed;
(15)The number of cases in which a violator requested to exercise the right of hearing pursuant to Section 23kh, and the average period of time for exercising the right of hearing;
(16)The number of cases in which a notice of liability was issued and no financial penalty was imposed, and the reasons for non-imposition;
(17)The number of cases in which the financial penalty was reduced pursuant to Section 23la and the Fifth Schedule, in how many of them the penalty amount was reduced because it exceeded the maximum permitted rate of the entity's turnover, in how many of them it was reduced because it exceeded the penalty ceiling for a micro or small business pursuant to that Schedule, and in how many of them it was reduced because a privacy protection officer was appointed in bodies listed in Section 17b1(a)(3) and (4);
(18)The number of repeat violations that occurred, how many of them occurred after an administrative warning was issued to the violator pursuant to Section 23lf, and how many of them occurred after submission of an undertaking and deposit of a bond pursuant to Section 23m;
(19)The number of continuing violations that occurred;
(20)The number of appeals filed against decisions of the Head of the Authority to impose a financial penalty, an administrative warning, or an undertaking and bond pursuant to Chapter d'3, in how many of them the execution of the decision was stayed, and in how many of them the appeal was accepted;
(21)The number of cases in which a financial penalty imposed on a corporation was not published and the number of cases in which a financial penalty imposed on an individual or a corporation was published as referred to in Section 23mf;
(22)The number of requests submitted for a cessation order pursuant to Section 23mi and in how many of them such an order was granted;
(23)Data on criminal enforcement carried out by the Authority, including, inter alia, the number of investigations opened by an investigator, the number of indictments filed as a result of those investigations, broken down by offence sections, and in how many of them the proceeding concluded with a conviction, and what the sentence was in each of the cases;
(24)The number of requests for approval of the exercise of the powers of the Head of the Authority, an inspector, or an investigator submitted to the Chairperson of the Central Elections Committee or to the Chairperson of the Regional Elections Committee, as applicable, in accordance with Section 23nt; how many of them were approved and in how many of them conditions were set.
(c)The Head of the Authority shall attach to the report on the activities of the Privacy Protection Authority pursuant to subsection (a) a report on the number of civil claims filed in court for compensation without proof of damage pursuant to Section 15a, and the case numbers of those claims, in accordance with information provided to the Head of the Authority by the Administration of Courts.
Need to cite this law in a foreign court?
Eli Shimony Israeli Attorneys-at-Law provides certified Expert Legal Opinions on Israeli law within 24–48 hours, accepted by courts worldwide.
Contact Us →Chapter III: Defenses
What Constitute Defenses
18.
[Amendment: 5784]
In criminal, civil, or administrative proceedings for invasion of privacy, it shall be a good defense if any one of the following conditions is met:
(1)The invasion was committed by way of a publication that is protected under Section 13 of the Prohibition of Defamation Law, 5725–1965;
(2)The defendant or the accused committed the invasion in good faith under one of the following circumstances:
(a)He did not know and was not required to know of the possibility of the invasion of privacy;
(b)The invasion was committed in circumstances in which the person who committed it was under a legal, moral, social, or professional duty to do so;
(c)The invasion was committed for the purpose of protecting a legitimate personal interest of the person who committed it;
(d)The invasion was committed in the course of the lawful pursuit of the occupation of the person who committed it and in the ordinary course of his work, provided that it was not committed by way of public publication;
(e)The invasion consisted of photography, or of the publication of a photograph, taken in a public place in which the image of the aggrieved person appears incidentally;
(f)The invasion was committed by way of a publication that is protected under paragraphs (4) to (11) of Section 15 of the Prohibition of Defamation Law, 5725–1965;
(3)The invasion served a public interest that justifies it in the circumstances of the matter, provided that if the invasion was committed by way of publication — the publication was not false.
Exemption
19.
[Amendment: 5745, 5769]
(a)A person shall not bear liability under this Law for an act that he was authorized to perform pursuant to law.
(b)A security authority, or a person who is among its employees or acts on its behalf, shall not bear liability under this Law for an invasion committed in a reasonable manner in the framework of their duties and for the purpose of fulfilling those duties.
(c)"Security authority", for the purposes of this Section, means any of the following:
(1)The Israel Police;
(2)The Intelligence Directorate of the General Staff and the Military Police of the Israel Defense Forces;
(3)The General Security Service;
(4)The Institute for Intelligence and Special Operations;
(5)The Witness Protection Authority.
Burden of Proof
20.
[Amendment: 5767]
(a)If the accused or the defendant proves that he committed the invasion of privacy under one of the circumstances referred to in Section 18(2) and that the invasion did not exceed what was reasonable in those circumstances, he shall be presumed to have committed the invasion in good faith.
(b)The accused or the defendant shall be presumed to have committed the invasion of privacy not in good faith if he knowingly invaded privacy to a greater extent than was reasonably necessary for the purposes afforded protection under Section 18(2).
(c)An accused or defendant who invokes a defense under Section 18(2)(b) or (d) shall be presumed to have committed the invasion of privacy not in good faith if he committed the invasion while violating the rules or principles of professional ethics applicable to him by virtue of law or accepted among the members of the profession to which he belongs; however, such a presumption shall not apply if the invasion was committed in circumstances in which the accused or defendant acted in accordance with a legal duty imposed upon him.
Rebuttal of Defense Pleas
21.
Where the accused or the defendant has adduced evidence or testified himself in order to establish one of the defenses available under this Law, the plaintiff or prosecutor may adduce rebutting evidence; nothing in this provision shall derogate from the power of the court under any law to permit the parties to adduce evidence.
Mitigating Circumstances
22.
In pronouncing sentence or awarding damages, the court may take into account, in favor of the accused or the defendant, the following as well:
(1)The invasion of privacy was no more than a repetition of what had already been stated, and he cited the source upon which he relied;
(2)He did not intend to cause the invasion;
(3)If the invasion was committed by way of publication — he apologized for the publication and took steps to halt the sale or distribution of the copy of the publication containing the invasion, provided that the apology was published in the same place, to the same extent, and in the same manner as the invasion was published, and was unqualified.
Need to cite this law in a foreign court?
Eli Shimony Israeli Attorneys-at-Law provides certified Expert Legal Opinions on Israeli law within 24–48 hours, accepted by courts worldwide.
Contact Us →