Financial Sanctions in Privacy Law

Until recently, an organization that violated Israel's Privacy Protection Law was exposed mainly to criminal proceedings or civil claims. Amendment 13 added an administrative enforcement tool: the power of the Privacy Protection Authority to impose a financial sanction on those who violate certain provisions of the law. This article explains, in general terms, what a financial sanction is, what may trigger one, how the process looks, and how an organization can reduce its exposure.

One point up front: details of the sanction amounts and the terms of their calculation are set out in the law and its schedules, and they may be updated from time to time. This article therefore does not state amounts. Check the binding, current text on the Authority's website and in the official statute book, with legal advice.

What is a financial sanction

A financial sanction is an amount that an administrative authority may impose on a violator without filing an indictment and without having to open a court proceeding. The recipient may submit arguments, ask for a reduction and, in suitable cases, appeal to a court. The difference from criminal proceedings is mainly speed and accessibility for the Authority, which changes the incentives organizations face.

Which violations may lead to a sanction

The law lists violations for which a sanction may be imposed. Without going through the full text, these are the recurring themes:

• Database management and registration. Breaches of registration and reporting duties, as the law provides.
• Notice to the person whose data is collected in a database. Failing to state the purpose of collection and the identity of the database owner.
• Access and correction rights. Ignoring a person's request to view or correct the data held about them.
• Information security. Failing to meet the data security regulations, including lacking appropriate procedures.
• Cooperation with the Authority. Failing to provide documents or information requested during supervision.
• Using data for a purpose other than the one it was given for, and transferring data to others unlawfully.

Amendment 13 also broadened the definition of sensitive information and the need for greater care with it. More on the amendment: Amendment 13: what changed.

What affects the size of a sanction

In general, the calculation mechanism in the law takes several factors into account: the type of violation, the number of people whose data is involved, whether the data is especially sensitive, and whether the violation is repeated. The Authority may also weigh circumstances such as cooperation, prompt correction and measures taken in advance to prevent the violation.

Two practical lessons follow. First, an organization holding sensitive or large-scale data carries greater exposure than a small one holding little. Second, an organization that documents, corrects and cooperates is in a better position before the Authority.

How the process looks

The administrative process generally includes the following stages (confirm the exact details in the law and the Authority's guidance):

1. Supervision or inquiry. A complaint from an individual, a publicized incident or a planned audit.
2. Request for documents and clarifications. The Authority asks the organization for information.
3. Notice of intent to impose a sanction. The organization receives notice of the intent and its reasons, and has an opportunity to make its arguments and put them in writing.
4. Decision. If the Authority decides to impose a sanction, it issues a payment demand.
5. Request for reduction or appeal. Under the law, a reduction may be requested and, in some circumstances, an appeal filed against the amount of the sanction or the sanction itself.

Legal advice is especially important at the notice stage: the written response can affect the final decision.

Responsibility of managers and directors

The Authority has issued guidance on the board of directors' role in meeting data security duties. In practice the subject does not stay with the IT department: management and the board are expected to understand it, receive reports and make sure someone is responsible. The same goes for a privacy protection officer, whose role is to help the organization comply. See the DPO's role and who must appoint a DPO.

How to prepare: a checklist

Risk cannot be reduced to zero, but it can be cut considerably:

• Data mapping. Know what personal data is collected, where it is stored and who sees it.
• Written policies and procedures. Including a procedure for access and correction requests and one for security incidents. See reporting a data security incident.
• Clear notices. Proper wording on the website and in forms. See website privacy policy.
• Marketing with consent. See the spam law and consent.
• Supplier agreements. A supplier processing data for you should commit to a security level and to reporting.
• Employee training and a record that it took place.
• Appointing a DPO where required, and checking whether an internal person or an external DPO fits.

What to do if the Authority contacts you

• Do not ignore it. An Authority inquiry requires a response within the stated time.
• Gather all relevant documents before answering.
• Avoid inconsistent versions: a uniform, coherent response should be coordinated among everyone in the organization.
• Seek legal support early, before issuing a written response.
• Fix any deficiencies found, and document the fix.

In summary

Financial sanctions are now part of the reality for organizations that hold personal data. The practical way to deal with them is to prepare in advance: mapping, procedures, training and documentation. If you want to check where your organization stands, or you received an inquiry from the Authority, you can contact us. More on the field on the privacy protection and DPO page.

The information in this article is general, is not legal advice, and does not replace review of the specific case. Sanction amounts and conditions are set by law and may change; check the current text.