In its decision from January 15th, 2024 (“Decision”), the European Commission (“Commission”) re-affirmed Israel’s adequacy status, meaning that transferring personal data related to European data subjects to Israel will continue to be seamless.
The free data flow from the European Economic Erea (“EEA”) to Israel will remain in place, and as a result business between Israel and the EEA can be conducted in an easier, more convenient manner compared to other non-EEA countries.
Background
The adequacy status can be given to a country which is not a member of the European Union after an in-depth examination by the Commission to assure that such country offers adequate safeguards to the personal data related to European data subjects. Adequacy status was granted by the Commission only to a limited number of countries.
The renewal of the adequacy status of Israel is a relief for Israel-based companies, after the re-examination procedure of the adequacy status ( originally given in 2011) that began following the Regulation (EU) 2016/679 (General Data Protection Regulation) – GDPR which entered into effect in 2018.
The Israeli government had taken several steps in order to ensure that the adequacy status is renewed. The Commission mentioned in the Decision some of them , including “specific safeguards to reinforce the protection of personal data transferred from the European Economic Area by adopting Privacy Protection Regulations (Instructions for Data that was Transferred to Israel from the European Economic Area), 5783-2023. Israel also strengthened the requirements for data security by adopting Privacy Protection (Data Security) Regulations, 5777-2017 and consolidated the independence of its data protection supervisory authority in a binding government resolution.”
The Acknowledgment
In the Decision, the Commission acknowledges that European data subjects’ personal data transferred to Israel enjoys adequate data protection safeguards. Therefore, the adequacy decision from 2011 remains in power and personal data can continue to flow freely from the EEA to Israel without any special data transfer regime or special arrangement (like the Standard Contractual Clauses – SCC or Binding Corporate Rules – BCR).
In practice, the renewal of the adequacy status means that the transfer of personal data from Europe to Israel will remain materially the same as the transfer of personal data within the EEA.
Why is it important?
The adequacy status is important for the Israeli economy, especially with regards to trade or research relations with Europe. The convenient and simple flow of data to Israel makes it easier, from a legal and regulatory standpoint, for entities in Israel (including Israeli companies, businesses, hospitals, research institutions and public authorities) that receive personal data to do business in the EEA or with EEA based entities.
The adequacy status prevents the need for individual and resource-intensive mechanisms, for example detailed contractual arrangements, thereby reducing costs for businesses and organizations in Israel, reducing legal risks, and creating a competitive advantage for Israeli entities.
The Decision can be read here. The publication of the Privacy Protection Authority in the Ministry of Justice can be read here (in Hebrew).
The authors are Adv. Rotem Perelman-Farhi, head of the Technology, IP and Data Protection Department and Adv. Einat Goldstein, associate in the Department.
* This newsletter is provided for informational purposes only, is general in nature, does not constitute a legal opinion or legal advice and should not be relied on as such. If you are seeking legal advice, it is essential to review the specific facts of each case in detail with a qualified lawyer.