Dear Clients and Friends,

We would like to draw your attention that on September 29, 2020, the Israeli Privacy Protection Authority (the “PPA“) has issued a statement regarding the transfer of personal data from Israel to the United States, in light of the annulment of the EU-US Privacy Shield framework for the transfer of personal data from Europe to the United States.

On July 16, 2020, in the case of Schrems 2 (the “Ruling“) which dealt with two of the main exceptions to Article 46 of the European General Data Protection Regulation (the “GDPR“), which prohibits the transfer of EU citizens personal data outside the EU, the European Court of Justice (the “ECJ“) has annulled in its ruling the Privacy Shield framework, which was a unique framework allowing the transfer of personal data from EU countries to organizations in the United States, that met the requirements of the Privacy Shield framework. According to the Ruling, the ECJ does not consider the Privacy Shield framework satisfactory in terms of meeting the required threshold of personal data protection by the European Law, and in particular the provisions of the GDPR and the European Convention of Human Rights.

Prior to ECJ’s Ruling, the PPA’s position (similar to its position prior to the 2015 ECJ’s annulment of the Safe Harbor framework (which was prior to the Privacy Shield framework) in the case of Schrems 1) was that US organization which are self-certified under the Privacy Shield framework, have been providing an adequate level of protection for personal data, and therefore the transfer of personal data from Israeli based databases to such US based organizations was made possible on the basis of the exception set forth in Section 2(8)(2) of the Israeli Privacy Protection Regulations (Transfer of Data to Databases Outside the State Borders), 2001 (the “Regulations“), which permit the transfer of personal data from a database in Israel to a database in a recipient country, if the latter receives personal data from member states in the European Union, under the same conditions of receipt.

With the annulment of the Privacy Shield framework by the ECJ, the PPA clarifies that the exception set forth in Regulation 2(8)(2), can no longer be relied upon as basis for transferring personal data from a database in Israel to US-based organizations, even if these organizations are bound by the principles of the Privacy Shield framework. Therefore, at this stage in time, Israeli companies are advised to implement, to the extent applicable, other alternatives available under the Regulations, for the purpose of transfer of personal data to the United State.

As part of its statement, the PPA has further stated that they it is considering reforming the Regulations in order for them to meet the needs of the Israeli economy, while taking into account the world’s leading regulation in that matter.

To view Schrems 2 Ruling >> click here

To view PPA’s full statement (in Hebrew) >> click here.

Please do not hesitate to contact us if you have any questions or require any clarification regarding the above.

Sincerely

Herzog Fox & Neeman