EU Commission: Israeli companies can continue to process personal data transferred from the EU
EU Commission: Israeli companies can continue to process personal data transferred from the EU
After conducting a review of 11 countries including Israel that have adequacy status for transferring data from the EU, the European Union Commission announced that they would renew Israel’s status, but only if it makes updates to its current legislation
Finally, some good news for the Israeli economy and Israeli high-tech in particular: in a report released last week, the European Union has reaffirmed its recognition of Israel's privacy laws and the compatibility of Israeli law with EU law, according to a statement from the Ministry of Justice. This means that data can be shared freely between EU and Israeli entities, and Israeli companies can collect, store, and process the personal data of EU citizens just like European companies, and bypass cumbersome and costly bureaucratic procedures.
However, Dr. Tehilla Shwartz Altshuler from the Israel Democracy Institute warns that "without significant amendments to existing privacy legislation, and without amending the Shin Bet law, legal challenges to this agreement are only a matter of time, and, based on the American precedent it is highly likely that such a lawsuit would be successful."
Israel has enjoyed adequacy status with the European Union regarding data flow since 2011, and it is part of a select group of countries that can freely transfer data with the EU. In recent years, adequacy decisions have been under review, primarily due to the strict privacy laws enacted by the EU under the General Data Protection Regulation (GDPR) and, in Israel’s case, outdated Israeli privacy legislation that haven’t been updated in over 40 years.
Last Wednesday, the EU concluded its review of 11 existing adequacy decisions, including Israel, which had been made before the enactment of GDPR. According to the Ministry of Justice, this decision enables "the flow of personal information to Israel in a simple and convenient manner, easing the legal and regulatory burden on all entities in Israel that receive personal information from Europe." The Ministry added, "This recognition eliminates the need for private and resource-consuming procedures, including detailed contractual arrangements, reducing costs for businesses and organizations in Israel, minimizing legal risks, and creating a competitive advantage for Israeli companies."
According to the statement released by the EU, the renewal of adequacy status was made possible through Israel's adoption of relevant regulations and policies, overseen by the Privacy Protection Authority, including the introduction of new protections for information, the clarification of various privacy rules and the creation of protections for information transferred between Israel and Europe. "The Israeli government introduced specific safeguards to reinforce the protection of personal data transferred from the European Economic Area which notably create new obligations in the area of data accuracy and data retention, strengthen the rights to information and deletion and introduce additional categories of sensitive data," the EU report says.
The report adds that, "In the area of government access to personal data, public authorities in Israel are subject to clear, precise and accessible rules under which such authorities can access and subsequently use for public interest objectives, in particular for criminal law enforcement and national security purposes, data transferred from the EU." At the same time, the report recommends that Israel enshrine legislation protections developed in part following court precedents (an indirect reference to the importance of an independent and strong judiciary) and clarifies that the Commission "will closely monitor future developments in this area.”
"The decision was made following a comprehensive professional review process by the EU Commission over several years," the Ministry of Justice said in a press release. "This process included a detailed presentation of privacy protection legislation in Israel, including an emphasis on the uniqueness of the various features of the Israeli legal system, and the implementation of additional steps related to the right to privacy, including the establishment of regulations, the adoption of a government decision regarding the independence of the Privacy Protection Authority, and the publication of the Authority's guidelines."
Shwartz Altshuler, who is considered one of Israel’s leading privacy experts, said that although this is a happy outcome, there are some caveats. "The State of Israel received adequacy status because it agreed to give personal information from the EU increased protection than we, the citizens of Israel, enjoy," she told Calcalist. "The commission also required that public authorities' access to personal information be subject to clear, precise and transparent public laws, something that wasn’t the case regarding the 'Pegasus' incident, for example, and the Israel Police which was examined by a government committee.
"Furthermore, the Commission clarifies the importance it attaches not only to the legislation but to the decisions of the European Court of Justice, which twice invalidated the Commission's compliance decisions regarding the U.S., for reasons related to the broad powers of the intelligence and law enforcement bodies in the U.S. to collect and use personal information, forcing the U.S. to take a series of steps to strengthen the supervision and enforcement of these actions. In our case, a public memorandum was recently published to amend the Shin Bet law seeking to grant the agency intrusive surveillance powers along with little supervision or the establishment of dedicated and independent supervisory bodies.”
Prof. Eran Toch, an Associate Professor in the Department of Industrial Engineering at Tel Aviv University and a former member of the Privacy Protection Council, said in response to the EU decision: "I was relieved when I saw that the EU Commission decided to renew the adequacy status. Without this status, all Israeli companies that do business in Europe, especially high-tech, had to face a very significant obstacle, especially today during the war.
"I am also happy that Israel has maintained the independent status of its judicial system. If the plans of the Minister of Justice were implemented, it would be impossible to know if our adequacy status would have been renewed. However, the decision also issued us a warning, saying that in the future Israeli legislation will have to be updated. The EU Commission's report specifically refers to Amendment No. 14 to the Privacy Protection Law, which is currently being discussed at the Knesset, and makes clear that without such updates, we will not continue to enjoy adequacy status."
