Global Privacy Dispatches- Israel- Revoked Registration of Controversial Database
By Dan Or-Hof, CIPP
Databases Registrar Revokes the Registration of a Controversial Database
Advocate Yoram Hacohen, the head of the Israeli Law, Information and Technology Authority (ILITA) and the Databases Registrar (the Israeli privacy and data protection agency), has ordered the registration revocation of two sensitive databases.
The decision, a first of its kind in Israel, followed an ILITA investigation of a pre-employment testing and evaluation company's privacy practices. The investigation revealed that the company, Pilat Technologies, allegedly violated substantial provisions of the Privacy Law, some of which constitute a criminal offence.
Under the Privacy Law, subject to certain limitations, every computerized, business-oriented database must be registered in a governmental database registry held and managed by the Databases Registrar. The law further provides that a database owner must notify the data subject of the purposes for which the data is processed and the identity of third parties to whom the data will be transferred. Other provisions of the law prohibit the processing of personal information for purposes other than the purposes for which the information was provided, and require every database owner to allow data subjects access to their personal records.
The Databases Registrar found that Pilat transferred assessments and test results to additional employers, without receiving the required consent, presumably in an effort to save the costs of preparing new assessments. Pilat refused requests made by examinees to access their personal records and failed to provide them with a proper notification of the processing purposes and data transfers.
The revocation of the databases' registration may impose a grave risk on Pilat's business, as maintaining an unregistered database is a criminal offence and can subject Pilat to civil tort claims, as well.
Pilat informed that it does not accept the legal analysis of the Databases Registrar and that it intends to fight the Registrar's decision.
Dan Or-Hof is a senior counsel at Pearl Cohen Zedek and Latzer LLP, with specific expertise in data protetion and privacy law. He may be reached at email@example.com.