Israel’s Privacy Protection Act amendments and EU adequacy

Israel is in the process of updating its Privacy Protection Act. At the request of the European Middle East Project, I have updated my opinion on the adequacy in EU terms of the amended law.

On the issue of adequacy of the Israeli PPA and the proposed amendments to the PPA:

It cannot be said that the Israeli Privacy Protection Act (PPA), even if amended as proposed in the 14th Amendment Bill, will provide “essentially equivalent” protection to the GDPR in substantive terms. At the very least, the changes that are apparently envisaged in a future 15th Amendment Bill will have to be adopted before the legal situation in Israel can be said to come close to the one in the EU. But of course, one would have to see those future further changes in detail before any firm conclusions about adequacy after their adoption could be drawn.

It can also not be said that the PPA, even if amended as proposed in the 14th Amendment Bill, will provide “essentially equivalent” protection to the GDPR in procedural/enforcement terms.

Even if all the proposed changes proposed under the 14th Amendment Bill to the PPA were to be adopted, Israeli law will continue to be glaringly deficient in relation to access to EU data by the Israeli law enforcement and national security agencies (an issue further highlighted in the current NSO/Pegasus scandal). For that reason alone, it should be considered impossible for the European Commission to issue a new positive adequacy decision on Israel at present. Only fundamental changes to the Israeli security laws, to bring them in line with the European Essential Guarantees for surveillance (EEGs), could remedy this.

On the issues of territoriality (which are not addressed in the proposed amendments): 

As I already concluded in my opinion in this regard:

Israel cannot be granted a new positive EU adequacy decision and then enjoy free personal data exchanges with the EU unless it starts treating onward transfers of data from Israel to the OTs as transfers abroad, at least as concerns EU data.

If Israel were to be granted a new adequacy decision without this change, that would perpetuate the current situation, which is the data protection equivalent of allowing goods from the settlements to be labelled as “Made in Israel” or of allowing settlement entities to benefit from EU funding programmes.

It may be hoped that the European Commission can persuade the Israeli authorities to address the issues of territoriality in relation to privacy/data protection law in that Bill.

In sum: For any new adequacy decision, Israel would have to adopt changes to the substantive provisions of the PPA that go beyond those envisaged in the 14th Amendment Bill (but that may be included in the putative 15th Bill); make changes to the status of the PPC; bring its security laws in line with the EEGs; and treat transfers of personal data from Israel proper to the OTs as onward transfers in terms of the GDPR. Such changes would strengthen the rule of law in Israel and in those territories, as well as adequately protect data on EU persons.