Privacy in Israel- Recent Development in the Israeli Privacy Protection Law
09/12/2018

Israeli Privacy Protection Authority: A list of Names and Email Addresses is considered “Information” for purposes of Israeli Privacy Protection Law

The Israeli Privacy Protection Law, 1981 and the regulations promulgated thereunder (the “Law”) is Israel’s principal data protection legislation. It applies, inter alia, to the protection of all personal information, and sets forth the obligations of individuals and entities, as to how they hold and manage such information. One of the areas regulated by the Law is the requirement of holders of certain types of “Information” to register a database and maintain it in certain manners provided thereunder.

Generally: a “database” means a collection of data, kept by a magnetic or optic means and intended for computer processing, other than…. (2) a compilation that includes only names, addresses and methods of communication, which in itself does not produce a characterization which infringes the privacy of the persons whose names are included therein.” Israel’s Privacy Protection Authority (“PPA”) recently addressed the question of whether a compilation of names and e-mail addresses would be considered merely a list of “methods of communication,” thereby excluding holders of such lists from the obligations regarding databases.

In a November 28, 2018 statement, the PPA clarified that a compilation of names and e-mail addresses does not fall within said exception. Therefore, a holder of a list of names and email addresses must register a database and is subject to the provisions regulating the holding and maintaining of databases.

Relying in its statement on the definition of “Information” under the Law, (i.e. “data on a person’s personality, personal status, privacy, state of health, economic situation, professional training, opinions and belief”), the PPA notes that e-mail addresses can be used to deduce personal information such as occupation, marital status, age, opinions and beliefs, etc. E-mail addresses can also be used as tools in identifying a person with greater certainty and linking different information about him or her to different databases. Lastly, the PPA relies on the interpretation of the European Union law, in determining that an e-mail address is “personal data” which should be protected.

We urge individuals and entities that hold a list of names and email addresses for business purposes to seek legal advice on the implications of the PPA’s recent statement.

No Fields Found.