I. New Inspection Unit to Increase Enforcement
On August 7, 2018 the Protection of Privacy Authority in the Ministry of Justice (the "PPA") announced that a new inspection unit has been added to the criminal and administrative enforcement agencies of the PPA. According to the PPA's announcement, the new unit will perform a cross-sectorial inspection in order to examine the implementation of the provisions of the Protection of Privacy Law, 1981 and the Protection of Privacy Regulations promulgated thereunder, including the Protection of Privacy (Data Security) Regulations, 2017 (which only recently entered into force in May this year), at all levels of the Israeli economy.
In accordance with the PPA's announcement, inspections will be conducted on a sectoral and thematic basis, such that, by the end of 2018, 150 different organizations that manage significant amounts of personal and highly sensitive data are expected to be reviewed, with an emphasis on the following sectors: customers clubs, medical institutions and therapeutic institutions, organizations that provide a platform for data management of minors, institutions of higher education, the hotel industry, entities that provide technological platforms for the use of personal data for election purposes, and companies that provide data processing and storage services.
As part of the inspection process, the reviewed organizations will be required to respond to specific questionnaires, and to provide information and data in order to examine their compliance with the provisions of the law and the regulations. After analyzing the information provided by these organizations, the PPA will reach a decision on proceeding with the inspection of each organization, and whether an audit team is needed to inspect the relevant organizations' premises. The PPA clarified that other proper enforcement actions within its powers will be considered against a reviewed organization in case such an organization does not cooperate, provides partial information or conceals information.
II. Initiated Investigative Proceedings
In addition, recently we have seen a growing trend on the part of the PPA to initiate investigative proceedings following events that receive media coverage and which raise questions or concerns about privacy and data security laws. As part of these investigative proceedings, the PPA investigates both the event itself as well as the general data collection, analysis and security procedures in place within the affected organization.
These steps are another important and supplementary element to the proposed amendment to the Protection of Privacy Law, which is currently being considered by the Israeli Parliament (the Knesset). The objective of the proposed amendment is to enhance the PPA's inspection and enforcement capabilities in order to be able to ensure adherence to the law.