Dear clients and colleagues,

We wish to update you that on January 4, 2022, the Protection of Privacy Authority (the “PPA”) issued a statement of opinion with respect to the interpretation of Regulation 3 to the Protection of Privacy Regulations (Transfer of Data to Databases Outside the State Borders), 5761-2001 (the “Regulations”).

The Regulations prohibit the transfer of data from a database in Israel outside the state borders, unless the receiving country in question ensures a level of protection of data which is not lower than the level of protection provided for under the Israeli law, or if the transfer satisfies certain conditions as set out in the Regulations. The statement of opinion focusses on Regulation 3 to the Regulations which requires the Israeli database owner to ensure, by way of obtaining a written undertaking from the recipient of the data, that latter will implement sufficient safeguards to ensure the security of the data being transferred, and that there will be no onward transfer of such data to any third party, whether in the same or a different jurisdiction.

In the draft statement of opinion (which is subject to public comments), the PPA calls for the removal of the significant obstacle set out in Regulation 3, namely, the prohibition against the onward transfer of the data by the overseas recipient to subsequent third parties (including for outsourcing purposes). The PPA asserts that the comprehensive prohibition against the onward transfer of data under Regulation 3 is inconsistent with recent commercial and technological developments since the enactment of the Regulations, and is even contrary to international legislation in this regard (including the GDPR).

The PPA proposes that the prohibition against the onward transfer of data by the overseas recipient will not apply if the Israeli database owner has consented to such onward transfer, provided that the initial transfer to the overseas recipient was compliant with Israeli law (i.e. on the basis of the data subject’s consent or legal authorization), and that the onward transfer would otherwise comply with the Regulations, had the transfer been made directly to such jurisdiction from Israel.

The implications of the proposal of the PPA are that once the Israeli database owner has approved the onward transfer of the data, the transfer is viewed as a direct transfer from Israel to such third party jurisdiction, and not as an onward transfer.

The PPA further clarifies that the scope and content of the undertaking required under Regulation 3, with respect to ensuring the security of the data being transferred, should not be required to meet Regulation 2(4) to the Regulations, according to which the recipient is required “to comply with the conditions for the maintenance and use of the data applying to a database in Israel”, and that a more limited undertaking should be sufficient, taking into account the scope, sensitivity and other relevant considerations relating to the data being transferred, even if such undertaking is not perfectly compliant with Israeli privacy laws.

Public comments to the statement of opinion may be submitted to the PPA until January 24, 2022. We will provide further updates with any developments.

To read the statement of opinion (in Hebrew) >> click here 

Sincerely,
Herzog, Fox & Neeman

Ohad Elkeslassy | Partner
Tel: 03-6922817
elkeslassyo@herzoglaw.co.il

Nurit Dagan | Partner
Tel: 03-6922817
dagan@herzoglaw.co.il