Move to Bring Email Lists Under Privacy Law Questioned (1)

Businesses with at least 10,000 electronic contacts would have to follow Israel’s strict privacy rules for those lists—even if they include only names and email addresses—under a sweeping new legal opinion from Israel’s Privacy Protection Authority.

The authority, in an emailed statement Nov. 28, said such lists constitute a “database” under the country’s privacy protection and data security laws. The interpretation takes immediate effect, although it’s likely to face a legal challenge, attorneys say.

Israel’s Privacy Protection Act requires organizations and businesses to protect information they hold on people for business or public purposes. Because an email address can be used to glean additional information about someone “such as occupation, marital status,” and “other information about him in various databases,” it should be regarded as “personal information” as protected by the law, which was last updated in 2017, according to the opinion.

Multinational corporations that handle European citizens’ data already follow similar rules under the European Union’s General Data Protection Regulation. But smaller companies and organizations exempt from the GDPR could face fines in Israel for noncompliance—up to 100,000 shekels ($26,800) and a year’s imprisonment for each injured party—even if they hold no sensitive data on their contacts.

“This could prove a substantial burden on small and medium-sized businesses,” Assaf Harel, a partner and head of the cybersecurity and privacy practice at Gorntizky and Co. law firm in Tel Aviv, told Bloomberg Law in an email Nov. 28.

Steps to Compliance

The opinion would require “virtually any business in Israel to register its database of customers and suppliers both in Israel and abroad,” Ariel Yosefi, head of the technology and regulation department at Herzog Fox and Neeman law firm in Tel Aviv, told Bloomberg Law in an email.

Businesses will need to appoint a database manager, draft internal procedures and documentation, and comply with security requirements for each list, Harel said. They also may need to register their lists with the authority.

Companies also should check any data processing services provided by outside contractors and their international data transfer agreements to ensure they’re compliant, Yoheved Novogroder- Shoshan, a technology and privacy law partner at Yigal Arnon and Co. law firm in Tel Aviv, told Bloomberg Law in a phone interview.

In the short term, the policy will have a major effect on small businesses trying to build their client base, Hillel Fuld, a Bet Shemesh-based blogger and business adviser to technology companies, told Bloomberg Law.

“We see an incredible decrease in email conversions when we have these policies, so it’s definitely going to impact businesses and, in the short term, it’s going to hurt,” he said.

Over the long term, however, the policy could improve businesses by forcing them to take consumer privacy seriously, Fuld said.

“In the end it makes business healthier, so consumers win and businesses win,” he said.

Challenges Ahead

There’s a “good chance” the authority’s interpretation could face a legal challenge, Yosefi said. He noted that Israeli law (Article 7(2)) specifically excludes “a collection that includes only the name, address and method of communication” from the definition of a database.

But there’s a case to be made that emails can be considered personal information under Israeli law, Novogroder-Shoshan said.

“Anything related to an individual’s ‘personality’ is interpreted by the Supreme Court as extending to a very broad category of information,” she said.

The authority’s approach is “erroneous,” Haim Ravia, senior partner and leader of the internet, cyber and copyright group at Pearl Cohen Zedek Latzer Baratz law firm in Herzliya, said. Israeli lawmakers didn’t intend for simple lists of names, addresses and means of contact, like telephone numbers, to constitute personal data under law, he said.

But Ravia said proponents could argue that even the smallest piece information can reveal something about an individual.

“Your name tells about your ethnic and racial origins. Your address testifies to your economic and social status and so potentially does your telephone number,” he told Bloomberg Law in an email. “An email address is no different.”