Israel’s Privacy Protection Authority announced Sept. 29 that following the "Schrems II" ruling, data transfers from Israel to the United States can no longer rely on the EU-U.S. Privacy Shield. The decision demonstrates the tightrope act third countries find themselves in as they try to gingerly navigate the treacherous EU-U.S. privacy terrain without disrupting economic or political ties.
The U.S. and EU are Israel’s largest trade partners. Moreover, Israel is one of the few countries to have obtained “adequacy” status from the EU — and that determination is currently reviewed by the European Commission under the mandate of the EU General Data Protection Regulation and the new requirements of the "Schrems I" and "Schrems II" decisions. Last but in no way least, in the diplomatic arena, Israel seldom departs from the side of the U.S., by far its staunchest political ally.
With this context, it is important to understand the scope and limits of the PPA decision. Pursuant to the passage in Europe of the 1995 Data Protection Directive, with its restrictions on transborder data flow, Israel adopted its Privacy Protection Regulations (Transfer of Data to Databases Outside of Israel), 2001 (unofficial English translation here). The regulations largely replicate the EU data transfer regime, including even a notional “adequacy” provision, Section 1, which purports to assess foreign data protection regimes according to a set of principles, identical to those in the DPD. (Cynics would say that Israeli law itself does not necessarily satisfy these conditions.) But in the absence of any Israeli “adequacy” determinations, this provision has not been operationalized.
Consequently, companies rely on a list of alternative data transfer mechanisms specified in Section 2 of the regulations. Importantly, Section 2(8) of the regulations authorizes transfers to (1) EU member states; (2) other signatories of Council of Europe Convention 108; or (3) any country “which receives data from Member States of the EU, under the same terms of acceptance.” Other provisions permit transfers (1) with data subject consent (Section 2(1)); (2) from an Israeli corporate parent to a foreign subsidiary (Section 2(3)); or (3) provided the data importer “enters into a binding agreement with the data exporter to comply with Israeli legal standards concerning the storage and use of data” (Section 2(4)).
The Section 2(8) blanket authorization of transfers to Europe or countries receiving data from Europe has been convenient, enabling simplified transfers to 27 EU member states and piggybacking the EU’s adequacy determinations to authorize transfers to additional third countries. In the past, the PPA interpreted this provision to allow transfers to Safe Harbor certified companies in the U.S. However, with Safe Harbor’s demise, the PPA opined that Israeli companies could no longer use that framework under the Section 2(8)(2) language that whitelists countries that receive data from the EU, “under the same terms of acceptance.” Interestingly, after the conclusion of the EU-U.S. Privacy Shield, the PPA did not formally renew its statement that allowed the use of Safe Harbor for transfers to the U.S. While not issuing a formal opinion, the PPA on several occasions expressed reservations about using the Privacy Shield under Section 2(8), given that the new arrangement afforded EU persons certain protections that did not extend to Israeli citizens.
In any event, after Tuesday’s announcement, it is clear that companies in Israel cannot rely on the EU-U.S. Privacy Shield for transfers to the U.S. It’s important to note that unlike Switzerland, Israel did not have its own Privacy Shield arrangement with the U.S. Hence, the PPA announcement is inextricably tied to the Court of Justice of the European Union invalidation of the EU-U.S. Privacy Shield. Moreover, the PPA did not rule out or even opine on data transfers from Israel to the U.S. writ large. Thus, companies can still use alternative mechanisms, including Section 2(4) contracts, to execute data transfers to the U.S. In this respect, Israeli companies typically use a variation of the EU standard contractual clauses, adapted to address issues related to Israeli law and jurisdiction.
Seen against this background, the Israeli decision — while perhaps still viewed as impolitic by Washington policymakers — is narrowly crafted and largely technical. Nevertheless, it is yet another demonstration of the disruptive downstream effect of the "Schrems II" decision and the challenges it presents for policymakers and businesses around the globe.
Photo by T.H. Chia on Unsplash
