A shift in the regulatory regime

The Information, Law, and Technology Agency (ILITA) held an international conference on data security on January 20 as a means to strengthen data protection in Israel. The conference involved a discussion on ILITA’s recent proposal to enact new privacy regulations related to information security. The proposal aims to subject database owners to information security rules and procedures, including the formation of internal procedures and information security policies, classifications, and privacy risk evaluations in the organizations, encrypting laptops, and more.

Mr. Yoram Hacohen, the head of ILITA, informed attendees of a coming change in the data protection regulatory regime. Within the next few months, two bills will be introduced to amend the Privacy Protection Act (PPA). The first will define and enhance the enforcement capabilities of the database registrar. The bill will provide broad authority to impose fines on organizations and corporations that act in violation of the data protection provisions of the PPA. The bill follows a NIS177,000 (approximately $50,000) fine that was recently imposed by the database registrar on a company that used a governmental database unlawfully. The second bill would abolish (with minor exceptions) the duty to register databases. The two bills reflect ILITA’s efforts to shift the center of gravity of data protection in Israel from procedural regulation to substantial enforcement.