Israel

Art. 3 defines data of special sensitivity to include, among eight-plus enumerated categories, a biometric identifier used or intended to be used to identify a person or verify his identity in a digital manner, itself defined as a biometric data item used to identify a person or verify that person's identity, or a biometric measure from which the said data item can be derived, where biometric means a unique human, physiological, or behavioral characteristic that can be measured through digital measurement.

The derivation clause affirmatively brings in an identifier derived from a recording; a facial image is confirmed within scope by a separate security-level provision that gives a biometric identifier limited to a facial image a lighter basic-security-level treatment only when confined to internal employee or supplier management, a security-tier carve-out, not a substantive consent exemption.

Chapter D3/D4 imposes tiered security-level obligations keyed partly to biometric-identifier volume, automatically classifying a database of 100,000 or more biometric identifiers as high security level. No voice-specific provision or dedicated biometric retention or destruction duty was found; Art. 2(6) separately prohibits commercial use of a person's name, image, or voice without consent as a distinct tort, outside the database regime.

The Privacy Protection Regulations (Data Security), 5777-2017 are confirmed at primary source.

Regulation 11(d)(1) requires a database controller to immediately notify the Registrar (Head of the Privacy Protection Authority) of a severe security incident and report on the measures taken in response; this confirms and replaces the main Act's cross-referenced monetary-sanctions-schedule item (21), which separately fines a controller or processor who fails that duty at up to 80,000 or 320,000 NIS for an individual or corporate violator.

A severe security incident is defined by Regulation 1 by reference to the database's security-level tier (unauthorized use or integrity damage affecting a high-security database, or a substantial part of a medium-security one).

Regulation 22 (the regulations' own commencement clause) provides that the regulations take effect one year after their publication; the regulations' own text carries a footnote citing publication as Reshumot Regulations File 5777 no. 7809 dated 8 May 2017, so the one-year clock runs from that date to 8 May 2018. The Minister of Justice signed the regulations 5 April 2017.

Any data-subject notification duty distinct from the Registrar-notification duty was not independently confirmed and is not recorded here.

Israel's Protection of Privacy Law, 5741-1981, creates a general tort of privacy infringement in Chapter A (Arts. 1-2, 4) and regulates 'databases' specifically from Art. 7 onward in Chapter B. A database excludes purely personal-use collections and small (100,000-or-fewer-person) name, address, or contact-only collections.

Amendment No. 13 rebuilt registration and notification duty at Art. 8A: mandatory registration is now limited to databases whose main purpose is commercial data provision with more than 10,000 individuals, or public-body databases, plus a separate notification duty, short of full registration, for any database holding special-sensitivity data on more than 100,000 individuals, including naming a Data Protection Officer where one is required.

Under PPL Art. 36(2), these regulations bar transfer of personal data outside Israel unless the destination country's law ensures protection no less than Israeli law provides, subject to five baseline principles: fair collection, purpose limitation, accuracy, an inspection right, and security.

Regulation 2 lists eight independent grounds permitting transfer regardless of that default rule: consent; vital-interest necessity where consent cannot be obtained; transfer to a corporation under common control with a privacy guarantee; transfer to a party bound by agreement to the same conditions; data already made public or open for inspection; public safety or security necessity; a legally mandated transfer; or transfer to a Convention 108 party, a state receiving data from EU member states on equivalent terms, or a state the Registrar of Databases has gazetted as having an adequate privacy authority.

Regulation 3 requires a written guarantee from the recipient in every case. No data localization is compelled.

Regulation 5 (the regulations' own commencement clause) provides that the regulations enter into force six months after the date of their publication; the regulations were signed 17 June 2001 (26 Sivan 5761), but their Reshumot publication date, which Regulation 5's six-month clock actually runs from, was not established at primary source, so no effective date is recorded, rather than one computed from the signature date. Whether Amendment 13 touched this 2001 regulation was not confirmed against the Reshumot.

Arts. 13 and 13A give a data subject the right to access their own data held by a database, and Art. 14 gives a right to demand rectification or deletion, with follow-through notice to prior recipients of the corrected or deleted data; Art. 16 imposes a confidentiality duty on anyone with database access. A separate compensation right exists through the enforcement provisions rather than as a standalone rights article.

No General Data Protection Regulation (GDPR) Art. 22-style right to object to a fully automated decision is identified, and none is asserted either way.

Arts. 13 and 14 are original 1981 enactment provisions, sitting in Chapter B, whose own Art. 37 commencement clause provides that Chapter B comes into force six months from the date of publication of this Law rather than on Knesset passage; the original Hebrew enactment (from the Knesset's own legislative archive) confirms this wording and confirms Art. 13A is not present in that 1981 text, so it was inserted by a later amendment.

Neither the original Law's Reshumot publication date nor Art. 13A's own insertion date was established at primary source, so no effective date is recorded, and the status is enacted rather than an inferred in-force date.

The Privacy Protection Authority (Head of the Authority) enforces the Act, with Chapters D3-D4 monetary sanctions scaled to violation type and database security level, reaching 320,000 NIS for an individual violator in the severe-incident non-reporting tier of the schedule, with a higher corporate tier.

Two independent private-right-of-action mechanisms, both not requiring proof of damage, exist: Art. 29A lets a court award statutory damages up to 50,000 NIS per infringement, doubled to 100,000 NIS where intent to harm is proven, for any civil privacy infringement under the Chapter A general tort, expressly not dependent on damage; Art. 15A separately lets a court award exemplary damages up to 10,000 NIS, narrower in scope (six specific database-controller procedural violations), where the court is directed not to consider the extent of damage caused.

Art. 31B extends ordinary civil-wrong liability under the Torts Ordinance to a violation of Chapters B or D or regulations made under the Act, beyond the Chapter A tort alone. Amendment No. 13 added the Data Protection Officer duty at Arts. 17B1-17B3.

Section 4 makes it an offence, punishable by three years' imprisonment, to unlawfully penetrate computer material located in a computer, defining penetration as connecting or communicating with a computer, or operating it, except a penetration that constitutes wiretapping under the Secret Monitoring Law, 5739-1979. Section 5 raises the maximum to five years' imprisonment where the section 4 act is done to commit a further offence under any other law.

Unlike a computer-misuse statute conditioned expressly on defeating a security measure, section 4's own text does not state that requirement, and no reported Israeli decision confirming or excluding a public, unauthenticated web page from the offence has been located.

Section 19 permits fair use of a work for purposes such as private study, research, criticism, review, journalistic reporting, quotation, or instruction and examination by an educational institution, judged by the purpose and character of the use, the character of the work, the scope of the use relative to the whole, and the impact on the work's value and market.

A non-binding December 2022 opinion of the Ministry of Justice's Office of Legal Counsel and Legislative Affairs concluded that, subject to exceptions, using copyrighted works to train a machine-learning model is generally permitted as fair use, incidental use under section 22, or transient use under section 26, reasoning that building a training database fits the private-study and research purposes and constitutes transformative use; the opinion does not extend to a model's output or to training dominated by a narrow set of works, and it does not bind the courts.

Israel has not enacted a text-and-data-mining-specific opt-out mechanism, and no statute assigns legal weight to a robots.txt directive.

Every database controller in Israel, private or public, must prescribe a written data security procedure covering physical protection, access authorizations, identification and authentication, encryption of stored and transmitted data, and incident handling, scaled to one of four security-level tiers (individually-managed, basic, medium, high) set by the type, volume, and sensitivity of data the database holds.

A database controller subject to the medium or high tier must additionally run an automatic access-monitoring mechanism retained at least 24 months, and a controller subject to the high tier must conduct a data security risk assessment and a penetration test at least once every 18 months.

Every controller other than one managing a database individually must appoint a data security officer where the Protection of Privacy Law requires one, and must conduct an internal or external audit of compliance with these Regulations at least once every 24 months for a medium- or high-tier database.

A controller engaging an external service provider with access to the database must agree in writing on the data the provider may process, the systems it may access, and the provider's own reporting and destruction duties, and must monitor the provider's compliance.

The Registrar (Head of the Privacy Protection Authority) may exempt a specific database from these duties, or extend them to one that would not otherwise be covered, by written notice given the database's size, the type of information it holds, and its number of authorized users. These duties are separate from Regulation 11(d)'s duty to notify the Registrar of a severe security incident, which is this jurisdiction's privacy-topic breach-notification row.

Section 5(5) provides that copyright in a work does not extend to news of the day, though it extends to the particular expression of that news; a bare report of the day's events is therefore outside copyright, while the author's own wording of it is not.

Section 19 separately permits fair use of a work, including quotation, criticism, review, and journalistic reporting, judged against the purpose and character of the use, the character of the work, the scope of the use relative to the whole, and the impact on the work's value and market, with no cap distinct from that four-factor test and no restriction limiting it to a particular industry.

No reported Israeli decision applying either provision to a systematic news aggregator, as opposed to an individual quoting a published work, was located.