Personal data transfers from the EU/EEA to Israel & the Occupied Territories

This opinion, prepared for the European Middle East Project, seeks to contribute to discussions about the future of personal data flows between the EU and Israel and the Occupied Territories (OTs), including the review of the 2011 EU Adequacy Decision on Israel under the EU General Data Protection Regulation (GDPR) that is currently underway.

Transfers of EU personal data to this region pose special challenges in the light of international law and the EU’s policy of “differentiation” between Israel and the OTs, which has been affirmed by rulings of the Court of Justice of the EU (CJEU). They also warrant scrutiny because of Israel’s extensive surveillance activities, which raise questions about potential access by Israeli state security agencies to EU citizens’ data. The July 2020 Schrems II judgment of the CJEU invalidated EU arrangements for data flows to the United States precisely because of such concerns – with clear implications in relation to other third countries including Israel.

The opinion addresses the question of how the EU’s so-called policy of differentiation, which distinguishes between activities of Israel within its pre-1967 borders and its activities beyond the Green Line, should be applied in the EU’s treatment of flows of personal data to Israel and to the OTs. This issue should be seen as an important aspect of the review of the EU Adequacy Decision on data transfers to Israel.

It shows that the Israeli Privacy Protection Act (PPA) manifestly fails to meet the now-applicable GDPR standards in terms of substance, procedure, enforcement, and undue access to data by the Israeli security and intelligence agencies.

And it shows that the Israeli approach to the issues of territorial application of the PPA and transfers of personal data to East Jerusalem, the Golan Heights and the Israeli settlements in the West Bank is fundamentally incompatible with the EU views on the territorial scope of EU-Israel relations in general, and with the stipulations in that regard in the 2011 Adequacy Decision on Israel in particular.

Unlike in other areas of EU-Israel relations, the territorial limitations in the EU Adequacy Decision have not been enforced in practice. It appears that the EU quietly tolerates Israel’s non-compliance with these provisions.

The current situation is the data protection equivalent of allowing goods from the settlements to be labelled as ‘Made in Israel’ or of allowing settlement entities to benefit from EU funding programmes.

In theory, the EU has three options: a) to allow the 2011 Adequacy Decision on Israel to continue; b) to issue a new Adequacy Decision; or c) to repeal or suspend the 2011 decision without replacing it (for now).

However, it follows from the analyses the only option compatible with the standards set by the CJEU in recent judgments in both the areas of data protection and in relation to territorial differentiation is the final one: to withdraw or suspend the 2011 Adequacy Decision.

Subsequently, the EU can try and persuade Israel to bring its data protection law and practice in line with EU standards and territorial requirements, and to end indiscriminate mass surveillance, to allow the EU to issue a new Adequacy Decision in the future.

Specifically with regard to territorial differentiation, the EU would have to obtain Israel’s agreement to adopt a measure obliging Israeli data controllers and processors to treat onward transfers of EU/EEA personal data to the OTs as ‘transfers of personal data abroad’ as opposed to internal domestic disclosures.