Israel - Algorithmic Processing Guidance

Overview

The Privacy Protection Authority (PPA) published a formal position paper on 31 July 2022 setting out the scope and content of the statutory notification duty when personal data is collected or used, and placing special emphasis on processing that involves algorithmic or automated decision‑making. The opinion links the statutory notice obligation (section 11 of the Protection of Privacy Law) with the statutory requirement for "informed" consent and clarifies that when data are collected for, or used by, systems that incorporate automated decision‑making (including AI techniques), controllers must provide enhanced, context‑sensitive disclosure in order for consent and notice to be meaningful. The document is available from the PPA and is summarised on the PPA's publications page (Privacy Protection Authority – Ministry of Justice) and analysed in contemporary legal summaries. The guidance is procedural and interpretive: it explains enforcement expectations under the existing Protection of Privacy Law rather than creating new legislation.

Definitions

Key definitions used or clarified by the opinion include: "notification duty" (the point‑of‑collection obligation to inform a person of the purpose, recipients and legal basis for requested data), "informed consent" (consent given with a reasonable understanding of purpose and consequences), "automated decision‑making" (use of algorithmic or AI systems to reach decisions without meaningful human intervention), and "algorithmic processing" (use of computational models that may adapt or change decision criteria based on data or prior outputs). The opinion stresses that in the PPA's view, where algorithmic systems affect individuals' rights or significant interests, notification should include information about the automated nature of processing, categories and sources of data used, and the potential significance of decisions derived from the system.

Governance and Institutional Framework

The PPA positions this opinion within the existing Israeli privacy framework overseen by the Ministry of Justice's Privacy Protection Authority (PPA). The opinion is intended to guide the PPA's supervisory and enforcement activities under the Protection of Privacy Law and the Data Security Regulations (see related material on PPA and government pages). The document recommends organisational governance measures: board‑level accountability for privacy risks arising from AI, appointment and involvement of privacy and security officers in the design and deployment of algorithmic systems, and documented internal roles for technical, legal and compliance stakeholders. It also recommends clear contractual allocation of responsibilities with processors and outsourced service providers, including clauses requiring adequate notice information and support for subject requests. The PPA signals that compliance with the opinion will be an enforcement consideration when the authority inspects databases or investigates complaints.

Key Focus Areas

The opinion focuses on a number of central issues for algorithmic processing and notification obligations: (1) Adequacy of notice: notice must be meaningful, timely, and adapted to the audience; layered notices and concise summaries are encouraged. (2) Algorithmic transparency: controllers should explain, to the extent reasonably possible, how automated systems make decisions, the categories of data used, and the possible consequences for individuals. (3) Consent and its limits: consent must be informed and voluntary; in contexts of power imbalance (employment, essential services) implied or coerced consent is insufficient. (4) Data minimisation and purpose limitation: controllers must minimise the collection of data for algorithmic use and avoid secondary use that exceeds the notified purposes. (5) DPIA/PIA use: the PPA recommends DPIAs for systems that create elevated privacy risk and maintaining records of mitigation measures. (6) Human oversight & contestability: where automated decisions have material effects, individuals should be informed about the opportunity for human review or appeal. (7) Special categories and sensitive uses: heightened notice, additional safeguards, and in many cases avoidance of sensitive inference or profiling without strong safeguards. (8) Documentation and auditability: controllers should retain internal documentation (model descriptions, training data summaries, evaluation and test results) to enable supervisory review while balancing legitimate trade secret considerations. Several of these themes are described in practical examples in the opinion and in the supporting commentary published by the PPA and independent advisors (ICLG (analysis)).

Implementation Framework

The opinion sets out a flexible implementation framework that is risk‑based and context sensitive. At collection the controller should provide: concise, intelligible notice at the point of collection; a layered approach linking to more detailed explanations and technical documentation; and clear statements when data will be processed by automated systems and when decisions may follow with material consequences. For high‑impact systems the PPA recommends performing a DPIA before system deployment, publishing a non‑technical summary of the DPIA where feasible, and ensuring technical controls such as differential access, logging, and explainability outputs for affected individuals. Contracts with processors must include obligations to support notice, record‑keeping and incident reporting. The opinion also encourages sectoral regulators and professional bodies to develop sector specific templates and examples to support consistent implementation.

Monitoring and Evaluation

The PPA advises continuous monitoring of algorithmic systems: periodic re‑assessment of privacy impact, documented testing for bias and accuracy, monitoring for model drift and change of decision criteria, and logging of automated decisions for auditability. The opinion recommends that controllers maintain a cadence of evaluation aligned with system risk (for example, more frequent review for systems affecting health, finance, employment or rights). The PPA notes that where monitoring reveals material privacy risks not disclosed at collection, controllers should update notices and, where necessary, re‑obtain valid informed consent or otherwise remediate the processing to align with legal bases.

Penalties, Liability, and Appeals

The opinion itself is a regulatory interpretation and does not set new penalties; however, the PPA states that failure to meet the notification duty or to provide adequate disclosure regarding automated decision‑making will be a material factor in enforcement actions under the Protection of Privacy Law and applicable Data Security Regulations. Remedies available under Israeli law include administrative sanctions, enforcement orders, corrective directions, and (where applicable) criminal sanctions for severe wilful breaches. The PPA indicates its intention to consider the guidance when exercising enforcement discretion and to take into account efforts to comply, remediate and cooperate when assessing sanctions. Affected individuals retain existing legal remedies (complaints to the PPA, civil claims, and judicial review) where rights have been impaired.

Relationship to Other Instruments

The PPA locates the opinion among other contemporary materials: it references the Protection of Privacy Law (1981), the Data Security Regulations, prior PPA guidance (on security incidents and DPIAs), and later PPA work on consent and AI. The opinion anticipates coordination with sectoral regulators (banks, capital markets, health) and references comparative regulatory approaches in the EU (GDPR) and other jurisdictions in which automated decision‑making rules or guidance exist. The opinion should be read alongside later PPA publications (including draft guidance on AI, April 2025) and sectoral circulars.

International Alignment

Although rooted in Israeli statutory law, the opinion explicitly aligns to international standards and practices: it draws on privacy‑by‑design principles, DPIA practice common under the EU GDPR, and international recommendations on algorithmic transparency. The PPA highlights that algorithmic transparency obligations should be balanced against legitimate commercial confidentiality and IP interests and recommends mechanisms to allow supervisory review without public disclosure of trade secrets. The PPA also notes that controllers engaged in cross‑border processing must consider both Israeli notification duties and international obligations (including adequacy and transfer safeguards) when explaining algorithmic processing to data subjects and regulators.

Implementation Timeline

Sources and References