Israel

Section 12 of the law adds a temporary section 2A2 to the Elections (Propaganda Methods) Law, 5719-1959, for the period that begins one week after the law's publication and ends one year after election day for the Twenty-Sixth Knesset. A person who publishes election propaganda that appears deeply real, a deep fake, must attach a disclosure stating clearly and prominently that its content was not originally recorded.

The Chair of the Central Elections Committee may set rules on meeting the disclosure duty. The section does not apply to election propaganda first published before the day it takes effect. The law defines a digital means to include artificial intelligence. The definition of a deep fake reaches an event, a document or another object that may appear to have been recorded originally but was created by digital means, or edited by them so as to change it materially. The Knesset passed the law on 16 July 2026. It was published in Sefer HaChukim 3546 on 16 July 2026.

Art. 3 defines data of special sensitivity to include, among eight-plus enumerated categories, a biometric identifier used or intended to be used to identify a person or verify his identity in a digital manner, itself defined as a biometric data item used to identify a person or verify that person's identity, or a biometric measure from which the said data item can be derived, where biometric means a unique human, physiological, or behavioral characteristic that can be measured through digital measurement.

The derivation clause affirmatively brings in an identifier derived from a recording; a facial image is confirmed within scope by a separate security-level provision that gives a biometric identifier limited to a facial image a lighter basic-security-level treatment only when confined to internal employee or supplier management, a security-tier carve-out, not a substantive consent exemption.

Chapter D3/D4 imposes tiered security-level obligations keyed partly to biometric-identifier volume, automatically classifying a database of 100,000 or more biometric identifiers as high security level. No voice-specific provision or dedicated biometric retention or destruction duty was found; Art. 2(6) separately prohibits commercial use of a person's name, image, or voice without consent as a distinct tort, outside the database regime.

The Privacy Protection Regulations (Data Security), 5777-2017 are confirmed at primary source.

Regulation 11(d)(1) requires a database controller to immediately notify the Registrar (Head of the Privacy Protection Authority) of a severe security incident and report on the measures taken in response; this confirms and replaces the main Act's cross-referenced monetary-sanctions-schedule item (21), which separately fines a controller or processor who fails that duty at up to 80,000 or 320,000 NIS for an individual or corporate violator.

A severe security incident is defined by Regulation 1 by reference to the database's security-level tier (unauthorized use or integrity damage affecting a high-security database, or a substantial part of a medium-security one).

Regulation 22 (the regulations' own commencement clause) provides that the regulations take effect one year after their publication; the regulations' own text carries a footnote citing publication as Reshumot Regulations File 5777 no. 7809 dated 8 May 2017, so the one-year clock runs from that date to 8 May 2018. The Minister of Justice signed the regulations 5 April 2017. Any data-subject notification duty distinct from the Registrar-notification duty was not independently confirmed.

Regulation 10(a) requires the system of a database subject to a medium or high security level to have an automatic recording mechanism that monitors access to the database systems, recording the user identity, the date and time of the access attempt, the system component to which access was attempted, the access type, its scope, and whether access was granted or denied.

Regulation 10(b) requires the monitoring mechanism, to the extent possible, not to allow its operation to be disabled or modified, and to detect any such modification or disabling and send alerts to those responsible. Under Regulation 10(c), the database controller prescribes a routine procedure to examine the records of the monitoring mechanism and prepare a report of the issues found and the measures taken.

Regulation 10(d) requires the records of the monitoring mechanism to be retained for at least 24 months. Regulation 17(a) requires a database controller to retain the data collected when implementing the listed regulations, which include Regulation 10, in a secure manner for 24 months. Item 18(c) of the monetary sanctions schedule in the Protection of Privacy Law states 12 months for the retention of the monitoring mechanism's records, in a clause that fines a failure to meet Regulation 10(d).

Israel's Protection of Privacy Law, 5741-1981, creates a general tort of privacy infringement in Chapter A (Arts. 1-2, 4) and regulates 'databases' specifically from Art. 7 onward in Chapter B. A database excludes purely personal-use collections and small (100,000-or-fewer-person) name, address, or contact-only collections.

Amendment No. 13 rebuilt registration and notification duty at Art. 8A: mandatory registration is now limited to databases whose main purpose is commercial data provision with more than 10,000 individuals, or public-body databases, plus a separate notification duty, short of full registration, for any database holding special-sensitivity data on more than 100,000 individuals, including naming a Data Protection Officer where one is required.

Under PPL Art. 36(2), these regulations bar transfer of personal data outside Israel unless the destination country's law ensures protection no less than Israeli law provides, subject to five baseline principles: fair collection, purpose limitation, accuracy, an inspection right, and security.

Regulation 2 lists eight independent grounds permitting transfer regardless of that default rule: consent; vital-interest necessity where consent cannot be obtained; transfer to a corporation under common control with a privacy guarantee; transfer to a party bound by agreement to the same conditions; data already made public or open for inspection; public safety or security necessity; a legally mandated transfer; or transfer to a Convention 108 party, a state receiving data from EU member states on equivalent terms, or a state the Registrar of Databases has gazetted as having an adequate privacy authority.

Regulation 3 requires a written guarantee from the recipient in every case. No data localization is compelled. Regulation 5 (the regulations' own commencement clause) provides that the regulations enter into force six months after the date of their publication; the regulations were signed 17 June 2001 (26 Sivan 5761). They were published in Kovetz HaTakanot 5761 at page 900, and no commencement day has been located. Whether Amendment 13 touched this 2001 regulation was not confirmed against the Reshumot.

Arts. 13 and 13A give a data subject the right to access their own data held by a database, and Art. 14 gives a right to demand rectification or deletion, with follow-through notice to prior recipients of the corrected or deleted data; Art. 16 imposes a confidentiality duty on anyone with database access. A separate compensation right exists through the enforcement provisions rather than as a standalone rights article.

No General Data Protection Regulation (GDPR) Art. 22-style right to object to a fully automated decision is identified, and none is asserted either way.

Arts. 13 and 14 are original 1981 enactment provisions, sitting in Chapter B, whose own Art. 37 commencement clause provides that Chapter B comes into force six months from the date of publication of this Law rather than on Knesset passage; the original Hebrew enactment (from the Knesset's own legislative archive) confirms this wording and confirms Art. 13A is not present in that 1981 text, so it was inserted by a later amendment. The Knesset passed the Law on 23 February 1981. The sections this entry groups came into force on different days. No commencement day has been located.

The Privacy Protection Authority (Head of the Authority) enforces the Act, with Chapters D3-D4 monetary sanctions scaled to violation type and database security level, reaching 320,000 NIS for an individual violator in the severe-incident non-reporting tier of the schedule, with a higher corporate tier.

Two independent private-right-of-action mechanisms, both not requiring proof of damage, exist: Art. 29A lets a court award statutory damages up to 50,000 NIS per infringement, doubled to 100,000 NIS where intent to harm is proven, for any civil privacy infringement under the Chapter A general tort, expressly not dependent on damage; Art. 15A separately lets a court award exemplary damages up to 10,000 NIS, narrower in scope (six specific database-controller procedural violations), where the court is directed not to consider the extent of damage caused.

Art. 31B extends ordinary civil-wrong liability under the Torts Ordinance to a violation of Chapters B or D or regulations made under the Act, beyond the Chapter A tort alone. Amendment No. 13 added the Data Protection Officer duty at Arts. 17B1-17B3.

Section 4 makes it an offence, punishable by three years' imprisonment, to unlawfully penetrate computer material located in a computer, defining penetration as connecting or communicating with a computer, or operating it, except a penetration that constitutes wiretapping under the Secret Monitoring Law, 5739-1979. Section 5 raises the maximum to five years' imprisonment where the section 4 act is done to commit a further offence under any other law.

Unlike a computer-misuse statute conditioned expressly on defeating a security measure, section 4's own text does not state that requirement, and no reported Israeli decision confirming or excluding a public, unauthenticated web page from the offence has been located.

Section 19 permits fair use of a work for purposes such as private study, research, criticism, review, journalistic reporting, quotation, or instruction and examination by an educational institution, judged by the purpose and character of the use, the character of the work, the scope of the use relative to the whole, and the impact on the work's value and market.

A non-binding December 2022 opinion of the Ministry of Justice's Office of Legal Counsel and Legislative Affairs concluded that, subject to exceptions, using copyrighted works to train a machine-learning model is generally permitted as fair use, incidental use under section 22, or transient use under section 26, reasoning that building a training database fits the private-study and research purposes and constitutes transformative use; the opinion does not extend to a model's output or to training dominated by a narrow set of works, and it does not bind the courts.

Israel has not enacted a text-and-data-mining-specific opt-out mechanism, and no statute assigns legal weight to a robots.txt directive.

Section 10.1 of Directive 364 applies it to a banking corporation, to the corporations stated in sections 11(a)(3a), 11(a)(3b) and 11(b) of the Banking (Licensing) Law, and to a payment services provider with prudential importance.

Section 28 of Directive 364 requires a banking corporation to appoint a senior employee as the Chief Cyber Defense and Information Security Officer, who is responsible for monitoring and ensuring that the banking corporation complies with the information security management framework.

Section 106 of Directive 364 requires a banking corporation to refer in its information security and cyber defense policy to identity management controls and logical access management controls and to monitoring and managing information security incidents, among other issues. Section 116.1 of Directive 364 requires a banking corporation to establish identity management and logical access management controls.

Section 171.1 of Directive 364 requires a banking corporation to report technological failure incidents and information security incidents to the Supervisor of Banks pursuant to Directive 366. The Banking Supervision Department published Directive 364 on 18 November 2024. Circular C-06-2847 states that Directive 364 entered into force on 18 May 2026 and repealed, among others, Directive 357 on Information Technology Management and Directive 361 on Cyber Defense Management.

Section 5(c1) of the Banking Ordinance lets the Supervisor promulgate proper conduct of banking business directives pertaining to the operating and management methods of a banking corporation. Section 14h(a)(1) of the Banking Ordinance lets the Supervisor impose a financial sanction of one million NIS on a banking corporation that contravened a proper conduct of banking business directive. The English publication of Directive 364 states that only the Hebrew text is binding.

Every database controller in Israel, private or public, must prescribe a written data security procedure covering physical protection, access authorizations, identification and authentication, encryption of stored and transmitted data, and incident handling, scaled to one of four security-level tiers (individually-managed, basic, medium, high) set by the type, volume, and sensitivity of data the database holds.

A database controller subject to the medium or high tier must additionally run an automatic access-monitoring mechanism retained at least 24 months, and a controller subject to the high tier must conduct a data security risk assessment and a penetration test at least once every 18 months.

Every controller other than one managing a database individually must appoint a data security officer where the Protection of Privacy Law requires one, and must conduct an internal or external audit of compliance with these Regulations at least once every 24 months for a medium- or high-tier database.

A controller engaging an external service provider with access to the database must agree in writing on the data the provider may process, the systems it may access, and the provider's own reporting and destruction duties, and must monitor the provider's compliance.

The Registrar (Head of the Privacy Protection Authority) may exempt a specific database from these duties, or extend them to one that would not otherwise be covered, by written notice given the database's size, the type of information it holds, and its number of authorized users. These duties are separate from Regulation 11(d)'s duty to notify the Registrar of a severe security incident, which is this jurisdiction's privacy-topic breach-notification row.

Section 3 of Directive 366 applies it to a banking corporation, a corporation as defined in section 11(b)(1) of the Banking (Licensing) Law, and a payment service provider with prudential importance license holder as defined in section 36i. Section 6.1 of Directive 366 requires reporting to the Banking Supervision Department a significant technological failure incident.

Section 6.2 of Directive 366 requires reporting a suspected cyber incident dealt with at the level of the Chief Cyber Defense Officer when its handling was not completed within four hours of its initial identification or within two hours from knowledge of the damage it caused. Section 6.3 of Directive 366 requires reporting a cyber incident that affects a large number of customers or has new offensive characteristics.

Section 6.4 of Directive 366 requires reporting any significant data leak incident that sections 6.1 to 6.3 do not cover. Section 10.1 of Directive 366 requires a banking corporation to report by telephone within two hours of identifying an incident that requires reporting, and to supplement the telephone report with a written initial report within 8 hours from the time of the telephone report.

Section 12.1 of Directive 366 requires a banking corporation to submit up-to-date written information on the incident at least once daily or at any time that there are significant changes in its characteristics or consequences.

Section 16 of Directive 366 requires the investigation to be submitted to the Banking Supervision Department within 45 days from the completion of the incident or within 60 days from the date on which the incident was identified as one that requires reporting, whichever is earlier. Section 171.1 of Directive 364 requires the report to the Supervisor of Banks of technological failure incidents and information security incidents pursuant to Directive 366.

Section 5(c1) of the Banking Ordinance lets the Supervisor promulgate proper conduct of banking business directives pertaining to the operating and management methods of a banking corporation. Section 14h(a)(1) of the Banking Ordinance lets the Supervisor impose a financial sanction of one million NIS on a banking corporation that contravened a proper conduct of banking business directive.

Regulation 29 requires information about a public service, given to the public or individually, in writing or orally, including forms, brochures, letters, notices and information given by telephone, to be provided on the request of a person with a disability in a way that ensures access to the information and the service. Advertisements are excluded, and so is information given over the internet in which the adjustments of the internet services part were made, as to those adjustments.

The provider gives the information, in addition to the usual ways, through one or more listed adjustments suited to the disability, chosen after consulting the person, in the languages in which it gives the information to the public.

The listed adjustments include accessible print, simplified language, an audio file, a digital file that screen-reading software can read, and Braille, and an audio file, a digital file or Braille is due within a reasonable time and no later than three weeks after the request. Reading aloud is given immediately on request, or for information longer than three pages at a time agreed with the person and no later than a week after the request.

Information in legal language, such as contracts or quotations of legislation, or in professional language, is exempt from the simplified-language formats. Where receiving a service depends on filling in forms by hand, by typing or on a touch screen at the place of service, the provider must help a person who because of a disability cannot write or type, on request.

Regulation 32 requires the provider, on the request of a person with a disability, to give the service and information about it also by telephone, fax, text message, mail, email or other digital means, according to the means the provider and the recipient have and the nature of the service. Information adapted in simplified-language print and recordings must also be supplied through the provider's website, if one exists.

Where a service or information is given through recorded information in a computerized call-routing system, regulation 33 requires either a recording in simple language at a slow pace without background music at the start of the recorded information, or a referral to a human operator at the start.

Regulation 34 requires the provider to publish the accessibility adjustments made in the service, including through its website if one exists, to keep that publication current, to announce an interruption of an adjustment expected to last more than a week, and to publish any exemption it holds and the alternative adjustments.

Regulation 25 requires a provider that serves the public through automated service machines, such as vending, payment and information machines and machines through which banking services are given, to provide machines accessible for independent use by people with disabilities under Israeli Standard 1918 Part 4.

Operating instructions are given in plain-language text, symbols and audio as relevant, the maximum response time may not be less than 60 seconds for each action, or 45 seconds in banking machines, and the machine bears the international accessibility symbol. Where an identical service is given at one place through more than one machine, a third of the machines, and at least one, must be accessible on each level where the service is given.

A provider is exempt where no accessible machines can reasonably be bought or imported, parking payment machines and drive-up machines are exempt from tactile operation, and the regulation does not require anyone to manufacture accessible machines. Regulation 94 set 1 July 2015 for the information adjustments of regulation 29, and 1 January 2016 for its accessible print and simplified-language formats.

Part A of the Eighth Schedule to the Law lists, among the duties that draw a monetary sanction, providing accessible information under regulation 29, giving service by digital or technological means under regulation 32, the call-routing system adjustments of regulation 33 and publishing the adjustments under regulation 34, and Part B lists the automated machines of regulation 25.

Part A sets NIS 1,200, 3,500 or 12,500 and Part B NIS 2,400, 7,000 or 25,000, for a tiny, small or regular obligor, which for 2026 are NIS 1,310, 3,830 or 13,680 and NIS 2,620, 7,660 or 27,360. Item 9(1) of the Second Schedule to the Class Actions Law, 5766-2006, lists a claim under Chapter D, Chapter E or Chapter E1 of the Equal Rights for Persons with Disabilities Law.

The Minister of Justice signed the Regulations on 8 Adar 5773, which is 18 February 2013. Under regulation 108, the Regulations take effect six months after their publication. The Regulations were published in Kovetz HaTakanot 7240 on 25 April 2013, and the amendment on internet services was published in Kovetz HaTakanot 7876 on 26 October 2017.

Regulation 35 defines the internet accessibility standard as Israeli Standard 5568, the guidelines for accessibility of web content, in its parts and annexes as amended from time to time. An internet service is content in any format delivered over the internet and shown to a user through websites, documents or apps that are meant to give the user a public service or information about one.

The person bound is the person responsible for providing the public service, including its owner, holder or operator. Regulation 35א requires accessibility adjustments in an internet service in accordance with the guidelines of that standard at level AA, other than for apps and time-based media. A person that is not a public authority and made adjustments at level A by 25 October 2014 is treated as having complied.

A document prepared from 26 October 2017 onward and uploaded to a provider's website or app must be accessible under the standard's rules on documents, and while no standard on documents exists, the adjustments follow the reasonable accessibility options of the software in which the document was created. A data-entry form used to receive a service, and a document prepared after 26 October 2015 that explains such a form, must meet the requirements even if prepared before 26 October 2017.

A deviation from the standard counts as a breach only after a notice demanding correction is sent and the provider does not correct it within a reasonable time and no later than 60 days from receipt. A provider that hosts content supplied by other parties, and does not edit or produce it, is not responsible for adjustments in that content but must supply an accessible infrastructure.

An app for a device other than a desktop or laptop computer must meet the requirements of an Israeli standard for such apps, where one exists. Where no Israeli standard for apps exists, the success criteria of the web standard apply as far as possible and relevant, on at least two common operating systems. A provider is exempt for an app if it operates an identical service on a website adapted to such devices that meets the web standard.

Regulation 35ד requires captions meeting success criterion 1.2.2 of the standard in recorded video content that a public authority, or a person with the average turnover that regulation sets, edits or produces. Regulation 35ה requires a prominent accessibility statement on the website and on any app the provider operates. A licensed service accessibility expert may exempt a provider from a specific adjustment that its platform or technological interface does not technologically allow.

An exempt dealer, and a person whose average annual turnover falls within regulation 35ו(ז), is exempt from the adjustments in regulations 35 to 35ו, and a wider turnover exemption in regulation 35ו(ח) applied until 26 October 2020. Until 31 December 2021 a provider was exempt from adjustments in documents holding a service recipient's personal information behind a login, and such a document prepared from 1 January 2022 must be accessible under the standard's rules on documents.

Regulation 28 requires a periodic check, at least every five years, of the auxiliary aids and services including the adjustments in internet services, and the adjustments the check calls for are made within six months. A new service must be accessible from the day it starts, and where a regulation refers to an Israeli standard, the person bound meets the duty by following the version of the standard in force when the adjustment was made.

Item 6 of Part C of the Eighth Schedule to the Law lists the provision of accessibility adjustments on a website or in an app, under regulations 35א and 35ג. Item 12 of Part A of the Eighth Schedule lists showing an accessibility statement in an internet service, under regulation 35ה. Part A of the table in section 26ז sets NIS 12,500 for a regular obligor, which is NIS 13,680 for 2026.

Item 9(1) of the Second Schedule to the Class Actions Law, 5766-2006, lists a claim under Chapter D, Chapter E or Chapter E1 of the Equal Rights for Persons with Disabilities Law. The Second Schedule lists the claims for which a motion to certify a class action may be filed.

The Minister of Communications made the Regulations on 3 Tevet 5769, which is 30 December 2008, under section 19יב(ד) of the Equal Rights for Persons with Disabilities Law, 5758-1998. They bind a license holder, which is a person that received a general license to provide domestic fixed or mobile telephony services. A license holder's telecommunications service and facilities must be accessible to people with disabilities under the Law, the Regulations and any other law.

A license holder that offers terminal equipment to its customers must offer at least two models for each of five groups: people with hearing impairments, mobile models with video calling for people with hearing impairments, people with visual impairments, people with limited hand function, and fixed models for people with cognitive disabilities.

Models for people with visual impairments must be able to voice the screen content, keys and menus, and mobile models must allow voice-activated dialing. The license holder marks the accessibility features on the packaging or in a separate leaflet and lets a person with a disability try a model of each kind free of charge at the points of sale.

A license holder must offer, in Hebrew and Arabic, a text-message service for people with visual impairments through text-to-speech technology or other technological means, and a telephone relay service through an operator for people with hearing or speech disabilities, available every day of the year and at all hours. A license holder may not charge a person with a disability for the adjustments the Regulations require.

A license holder must publish the accessibility adjustments it makes, including on its website, with the accessible models, their features and prices, the points of sale and the right to try a model. A license holder reports to the Minister and the Commissioner on 1 January each year on its implementation of the Regulations. The Regulations came into force on 1 June 2009, and regulation 5 on 15 July 2009.

The Regulations do not detract from the license holder's duties under regulations made under section 19יב(א) of the Law. Under section 19נא of the Law, an act or omission contrary to a provision made under section 19יב is a civil tort for which the court may award compensation of up to NIS 50,000 without proof of damage.

Section 19יא requires a public service to be accessible to people with disabilities, in accordance with the Law's provisions. Section 19יא also requires the person responsible for providing a public service to make the accessibility adjustments the Law requires.

For a person that is not a public body, a public service under section 19י is a service given to the public or an undefined part of it in a public place, or a service listed in the Second Schedule that is meant for the general public or an undefined part of it. The Second Schedule lists, among others, health, entertainment, tourism, transportation, culture, commerce, energy and telecommunications services, and banking, credit, insurance, pension and other financial services.

Section 19א defines a public authority as a public body listed in the paragraphs of section 5 that it names, a body that provides a state health service, an official education institution, a public institution whose state funding exceeds 30% on average over the last five years, or a body the Minister of Finance designates by order.

Section 19יב has the Minister of Justice set, by regulations, the accessibility adjustments a public service must make so that a person with a disability has reasonable accessibility. Where the regulations set no gradual application, the accessibility duty applies in full no later than 1 November 2017 for a person that is not a public authority.

A person bound is exempt from a specific adjustment in an existing public place or a public service where it cannot be carried out for engineering reasons and an accessibility expert approves that, where it imposes an undue burden, where it substantially harms the special character of the place because of historic, archaeological, architectural or natural values, or where it requires a fundamental change in the nature of the place or the service.

Undue burden is judged by factors that include the type of service, the scope of activity, the nature and cost of the adjustment, external and state funding, accessible alternatives the same person offers nearby, and the revenue turnover or profit rate of the person responsible. A person bound is also exempt from a specific adjustment if the Commissioner determines that carrying it out may bring about the person's economic collapse.

The undue burden and economic collapse exemptions do not apply to a public service provided by a public authority, or to an adjustment about which the person bound acted in bad faith. A person who shows that an exemption applies must carry out alternative accessibility adjustments that are reasonable in the circumstances.

The Equal Rights for Persons with Disabilities (Exemption due to Undue Burden from Adjustments in an Existing Public Place that is a Building and in a Public Service) Regulations, 5779-2019 exempt a person bound that is not a public authority, and that is an exempt dealer or whose income does not exceed an exempt dealer's, from the adjustments the service Regulations set.

That exemption holds only while the person keeps a form and an affidavit in the shape the 2019 Regulations set, lasts three years from the signing of the affidavit and may then be issued again, and its existence is published as regulation 34(ה) of the service Regulations requires, without the turnover figures.

The Commissioner, or an inspector the Commissioner appoints, may order a person bound to take the actions the order lists to make the adjustments, after giving the person an opportunity to be heard, and the order sets the period for carrying them out.

A person who breaches an accessibility order is liable to the fine in section 61(a)(3) of the Penal Law, 5737-1977, and a further fine of 5% of that fine for each day the offence continues beyond the period the order sets, and a corporation is liable to twice that fine. An officer of a corporation must supervise and do everything possible to prevent that offence, is liable to the fine in section 61(a)(3) for failing to, and is presumed to have failed unless the officer proves otherwise.

An inspector may demand any information or document, including computer output, and may enter a public place or a place where a public service is given at any reasonable time. The official the Commissioner authorizes may impose a monetary sanction on a person who breaches an accessibility duty listed in the Eighth Schedule.

The sanction for each part of the Eighth Schedule depends on the size of the obligor: Part A NIS 1,200, 3,500 or 12,500, Part B NIS 2,400, 7,000 or 25,000, Part C NIS 3,600, 13,000 or 37,500, and Part D NIS 3,600, 13,000 or 200,000, for a tiny, small or regular obligor respectively.

For 2026 the table gives NIS 1,310, 3,830 and 13,680 for Part A, NIS 2,620, 7,660 and 27,360 for Part B, NIS 3,940, 14,220 and 41,030 for Part C, and NIS 3,940, 14,220 and 218,820 for Part D. The size classes rest on the obligor's annual transaction turnover in the year before the breach, and a public authority is never a tiny or small obligor. A continuing breach adds one fiftieth of the sanction for each month the breach continues.

A repeat breach, within two years of an earlier breach of the same duty for which a sanction was imposed or the person was convicted, adds an amount equal to the sanction. The sanction amounts are updated on 1 January each year by the Consumer Price Index, and the Minister of Justice may set circumstances in which a lower sanction may be imposed. The chapter on administrative enforcement began to apply on 10 August 2023.

For four years from then a first breach of a particular duty by a tiny or small obligor draws an administrative warning in place of the sanction. A first breach of a particular duty by a person holding an accessibility expert's certificate that documents the adjustments, where nothing has changed since, also draws an administrative warning, except for the duty to keep adjustments available, maintained and usable.

In circumstances the Commissioner sets in procedures, the official may instead let the person file an undertaking to stop the breach for a period of up to two years and deposit a guarantee, and no sanction is then imposed for that breach. A final decision under the chapter may be appealed to a magistrate's court within 45 days. An act or omission contrary to a provision of Chapter E1, Chapter E or the accessibility provisions of the Planning and Building Law is a civil tort.

For a breach of a provision made under section 19יב the court may award compensation of up to NIS 50,000 without proof of damage.

The court may not award that compensation if the defendant proves that it complies with an accessibility order, an undertaking or the timetable of an earlier judgment, that a sanction or warning was given before the act, that an earlier claim on the same act was filed less than three months before and it is making the adjustments on a reasonable timetable, that it applied to the Commission with an inquiry a reasonable time before the claim, or that a condition the Minister of Justice sets on the cost of the adjustment against its income is met.

The compensation amount is updated once a year by the Consumer Price Index against the index for February 2005. A senior officer of a corporation that commits the tort is also liable unless the officer proves that the tort was done without the officer's knowledge and that the officer took reasonable measures to prevent it.

The Commission, or an organization that promotes the rights of persons with disabilities, may bring a claim in addition to the person harmed, but the Commission may not sue over an act for which a monetary sanction was imposed. Item 9(1) of the Second Schedule to the Class Actions Law, 5766-2006, lists a claim under Chapter D, Chapter E or Chapter E1 of the Equal Rights for Persons with Disabilities Law. The Second Schedule lists the claims for which a motion to certify a class action may be filed.

Section 5(5) provides that copyright in a work does not extend to news of the day, though it extends to the particular expression of that news; a bare report of the day's events is therefore outside copyright, while the author's own wording of it is not.

Section 19 separately permits fair use of a work, including quotation, criticism, review, and journalistic reporting, judged against the purpose and character of the use, the character of the work, the scope of the use relative to the whole, and the impact on the work's value and market, with no cap distinct from that four-factor test and no restriction limiting it to a particular industry.

No reported Israeli decision applying either provision to a systematic news aggregator, as opposed to an individual quoting a published work, was located.