IsraelProtection of Privacy Law, biometric identifier definition and security-level tiering
Protection of Privacy Law 5741-1981, as amended by Amendment No. 13, Art. 3 (biometric identifier and data of special sensitivity definitions), security-level provisions
In force since .
A biometric privacy rule binding public and private bodies.
- Excludes recording-derived identifiers
- No
- Audit expectation
- none
What it requires
- An app that captures or stores a facial image, voiceprint, or other biometric identifier of a person in Israel, including one derived from a photo, video, or audio recording, must treat it as data of special sensitivity and apply Israel's tiered security-level obligations, which scale up automatically at 100,000 or more biometric identifiers held.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- PR.DS-P1Data-at-rest are protected.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does a facial image or voice recording that an app stores but does not use 'to identify a person or verify his identity in a digital manner' count as data of special sensitivity under paragraph (4) of that definition in Article 3 of the Protection of Privacy Law?
What it makes you log
Logging duty
Article 3 defines the biometric identifier and data of special sensitivity, and the definitions in the monetary-sanctions chapter sort a database into the basic, medium or high security level, a database holding biometric identifiers of 100,000 or more individuals being high. The definitions set which security obligations apply and impose no log or record duty themselves; the record duties sit in the Data Security Regulations and are reached through the sanctions schedule, which the enforcement row for this law covers. The cited provisions state no territorial hook.
- Kind
- None
- As of
What this law does
Art. 3 defines data of special sensitivity to include, among eight-plus enumerated categories, a biometric identifier used or intended to be used to identify a person or verify his identity in a digital manner, itself defined as a biometric data item used to identify a person or verify that person's identity, or a biometric measure from which the said data item can be derived, where biometric means a unique human, physiological, or behavioral characteristic that can be measured through digital measurement.
The derivation clause affirmatively brings in an identifier derived from a recording; a facial image is confirmed within scope by a separate security-level provision that gives a biometric identifier limited to a facial image a lighter basic-security-level treatment only when confined to internal employee or supplier management, a security-tier carve-out, not a substantive consent exemption.
Chapter D3/D4 imposes tiered security-level obligations keyed partly to biometric-identifier volume, automatically classifying a database of 100,000 or more biometric identifiers as high security level. No voice-specific provision or dedicated biometric retention or destruction duty was found; Art. 2(6) separately prohibits commercial use of a person's name, image, or voice without consent as a distinct tort, outside the database regime.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .