State Comptroller of Israel calls to amend the Israeli Protection of Privacy Law

A recent report issued by the State Comptroller of Israel is severely critical of the failure on the part of the Ministry of Justice, or rather, the Ministry's department of counseling and legislation, to further the abolishment of the database registration requirement in the Protection of Privacy Law. The report points out repeated attempts by the Israeli Law, Information and Technology Authority (ILITA, the Israeli privacy regulator) to abolish the registration requirement, to no avail. The report emphasizes that the statutorily mandated registration requires ILITA to devote resources to a registry that does not further the protection of privacy in Israel.
“The protection of privacy with regard to existing databases in Israel, is lacking”, according to State Comptroller, Judge (ret.) Joseph Shapira, in the annual audit report (64c), which was presented today to the Knesset (the Israeli Parliament). The annual report includes a section that addresses database registration in Israel (available here, in Hebrew). Among other things, the Comptroller examined the scope of database registrations, the registration process and its implications, actions taken to constrict the registration requirement (prescribed by the Protection of Privacy Law), and the replacement of the registration requirement with a duty of prudent database management. The following are the main findings of the report:
  • Despite the obligations imposed by the Protection of Privacy Law to register databases, only a negligible percentage of all databases in Israel that need to be registered, are in fact registered. This phenomenon has existed since the enactment of the law in 1981 and is exacerbating with technological advancements, which have caused a significant increase in the number of existing databases;
  • During the database registration process, typically no examination is performed of compliance with the duties prescribed by the law, such as information security requirements. A confirmation that a database has been registered is, in large part, a confirmation of the database’s mere inclusion in the registry rather than a certification of its compliance with the substantive duties laid down by the law or of the accuracy of the information contained in the registry. This may consequently mislead the public;
  • As early as 2007, a committee headed by the Deputy Attorney General recommended that the obligations associated with database registration be limited. The legislative process regarding this matter is moving at a snail’s pace and essentially, Israel today has a legal regime that the regulators themselves believe is partially irrelevant to the present technological reality and partially inadequate in terms of privacy protection;
  • Since non-registration of a database (that requires registration) is a criminal offense, the delay in the enactment of the amendments to the Protection of Privacy Law brings about a result where individuals, corporations and public entities that fail or neglect to register a database (that requires registration), are seemingly presumed criminals;
  • Despite the consensus that the benefits of registration are few, the Israeli Law, Information and Technology Authority (ILITA) continues to expend significant resources in handling the database registration process, as prescribed by law. Valuable resources are thus taken away from regulatory activities carried out by ILITA regarding compliance with the substantive provisions of the law;
  • The scope of the database registration in Israel is marginal and therefore, inital registration fees and annual fees for renewed registration, are not paid by the vast majority of the databases required to do so by law. Additionally, many owners of registered databases fail to pay the annual renewal fee. This leads to inequality between law-abiding databases owners and those that have not registered their databases or have not paid the annual renewal fees.
In conclusion, the Comptroller found that the reality described in the report indicates that the protection of privacy with regard to existing databases in Israel is lacking. Therefore, and in light of the State’s obligation to promote the constitutional right to privacy, the State Comptroller stated that the relevant personnel in the Ministry of Justice must act, without further delay, and take the necessary actions required for advancing the amendment to the Protection of Privacy Law regarding database registration, in a manner that gives due attention this important constitutional right.