HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"EN
1.2.2011 Official
Journal
of
the
European
Union L
27/39
COMMISSION DECISION
of 31 January 2011
pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate
protection of personal data by the State of Israel with regard to automated processing of personal
data
(notified under document C(2011) 332)
(Text with EEA relevance)
(2011/61/EU)
THE EUROPEAN COMMISSION,
of Israel. Those ‘Basic Laws’ are complemented by a large
body of case law, as the Israeli legal system adheres to a
Having regard to the Treaty on the Functioning of the European
great extent to common law principles. The right to
Union,
privacy is included in the ‘Basic Law: Human Dignity
and Liberty’ under section 7.
Having regard to Directive 95/46/EC of the European
Parliament and of the Council of 24 October 1995 on the
protection of individuals with regard to the processing of
(6) The
legal
standards
for
the
protection
of
personal
data
in
personal data and on the free movement of such data, ( 1 ) and
the State of Israel are largely based on the standards set
in particular Article 25(6) thereof,
out in Directive 95/46/EC and are laid down in the
Privacy Protection Act 5741-1981, lastly amended in
After consulting the European Data Protection Supervisor,
2007 in order to establish new processing requirements
for personal data and the detailed organization of the
supervisory authority.
Whereas:
(1) Pursuant
to
Directive
95/46/EC,
Member
States
are
required to provide that the transfer of personal data
(7) That
data
protection
legislation
is
further
complemented
to a third country may take place only if the third
by governmental decisions on the implementation of the
country in question ensures an adequate level of
Privacy Protection Act 5741-1981 and on the organ
protection and if the Member States’ laws implementing
isation and functioning of the supervisory authority,
other provisions of the Directive are complied with prior
largely based upon recommendations formulated in the
to the transfer.
Report to the Ministry of Justice by the Committee for

the Examination of Legislation relating to Databases
(Schoffman Report).
(2) The
Commission
may
find
that
a
third
country
ensures
an adequate level of protection. In that case, personal
data may be transferred from the Member States
without additional guarantees being necessary.
(8) Data
protection
provisions
are
also
contained
in
a
number of legal instruments regulating different sectors,
such as financial sector legislation, health regulations and
(3) Pursuant
to
Directive
95/46/EC
the
level
of
data
protection should be assessed in the light of all the
public registries.
circumstances surrounding a data transfer operation or
a set of data transfer operations and giving particular
consideration to a number of elements relevant for the
(9) The
legal
data
protection
standards
applicable
in
the
State
transfer and listed in Article 25 thereof.
of Israel cover all the basic principles necessary for an
adequate level of protection for natural persons in
(4) Given
the
different
approaches
to
data
protection
in
third
relation to the processing of personal data in
countries, the adequacy assessment should be carried out,
automated databases. Chapter 2 of Privacy Protection
and any decision based on Article 25(6) of Directive
Act 5741-1981, which lays down the principles for the
95/46/EC should be made and enforced in a way that
processing of personal data, does not apply to the
does not arbitrarily or unjustifiably discriminate against
processing of personal data in non-automated databases
or between third countries where like conditions prevail,
(manual databases).
nor constitute a disguised barrier to trade, regard being
had to the European Union’s present international
commitments.
(10) The
application
of
the
legal
data
protection
standards
is
guaranteed by administrative and judicial remedies and
(5) The
State
of
Israel’s
legal
system
has
no
written
consti
by independent supervision carried out by the super
tution but constitutional status has been conferred on
visory authority, the Israeli Law, Information and Tech
certain ‘Basic Laws’ by the Supreme Court of the State
nology Authority (ILITA), which is invested with powers
of investigation and intervention, and which acts
( 1 ) OJ L 281, 23.11.1995, p. 31.
completely independently.

---

L 27/40
EN
Official Journal of the European Union
1.2.2011
(11) Israeli
data
protection
authorities
have
provided
explan
95/46/EC’ ( 1 ). This opinion has been taken into
ations and assurances as to how the Israeli law is to be
account in the preparation of this Decision ( 2 ).
interpreted, and have given assurances that the Israeli
data protection legislation is implemented in accordance
with such interpretation. This Decision takes account of
(16) The Committee established under Article 31(1) of
these explanations and assurances, and is therefore
Directive 95/46/EC did not deliver an opinion within
conditional upon them.
the time limit laid down by its Chairman,
HAS ADOPTED THIS DECISION:
(12) The
State of Israel should therefore be regarded as
providing an adequate level of protection for personal
data as referred to in Directive 95/46/EC with regard
Article 1
to automated international transfers of personal data
1. For the purposes of Article 25(2) of Directive 95/46/EC,
from the European Union to the State of Israel or,
the State of Israel is considered as providing an adequate level
where those transfers are not automated, they are
of protection for personal data transferred from the European
subject to further automated processing in the State of
Union in relation to automated international transfers of
Israel. Conversely, international transfers of personal data
personal data from the European Union or, where they are
from the EU to the State of Israel whereby the transfer
not automated, they are subject to further automated processing
itself as well as the subsequent data processing is carried
in the State of Israel.
out exclusively through non-automated means should
not be covered by this Decision.
2. The competent supervisory authority of the State of Israel
for the application of the legal data protection standards in the
State of Israel is the ‘Israeli Law, Information and Technology
Authority (ILITA)’, referred to in the Annex to this Decision.
(13) In
the
interest
of
transparency
and
in
order
to
safeguard
the ability of the competent authorities in the Member
States to ensure the protection of individuals as regards
the processing of their personal data, it is necessary to
Article 2
specify the exceptional circumstances in which the
1. This
Decision
concerns
only
the
adequacy
of
protection
suspension of specific data flows may be justified,
provided in the State of Israel, as defined in accordance with
notwithstanding the finding of adequate protection.
international law, with a view to meeting the requirements of
Article 25(1) of Directive 95/46/EC and does not affect other
conditions or restrictions implementing other provisions of that
Directive that pertain to the processing of personal data within
the Member States.
(14) The
adequacy
findings
pertaining
to
this
Decision
refer
to
the State of Israel, as defined in accordance with inter
national law. Further onward transfers to a recipient
2. This
Decision
shall
be
applied
in
accordance
with
inter
outside the State of Israel, as defined in accordance
national law. It is without prejudice to the status of the Golan
with international law, should be considered as
Heights, the Gaza Strip and the West Bank, including East
transfers of personal data to a third country.
Jerusalem, under the terms of international law.
Article 3
(15) The
Working
Party
on
the
protection
of
individuals
with
1. Without prejudice to their powers to take action to ensure
regard to the processing of personal data established
compliance with national provisions adopted pursuant to
under Article 29 of Directive 95/46/EC has delivered a
provisions other than Article 25 of Directive 95/46/EC, the
favourable opinion on the level of adequacy as regards
competent authorities in Member States may exercise their
protection of personal data in relation to automated
existing powers to suspend data flows to a recipient in the
international transfers of personal data from the
State of Israel in order to protect individuals with regard to
European Union or, whether they are non-automated
the processing of their personal data in the following cases:
they are subject to further automated processing in the
State of Israel. In its favourable opinion, the Working
Party has encouraged the Israeli authorities to adopt
(a) where a competent Israeli authority has determined that the
further provisions which extend the application of
recipient is in breach of the applicable standards of
Israeli legislation to manual databases, which expressly
protection; or
recognise the application of the proportionality
principle to personal data processing in the private
sector and which interpret the exemptions in inter
( 1 ) Document WP114 of 25 November 2005. Available at http://ec.
national data transfers as in accordance with the
europa.eu/justice_home/fsj/privacy/docs/wpdocs/2005/wp114_en.pdf
( 2 ) Opinion 6/2009/EC on the level of protection of personal data in
criteria set out in its ‘Working document on a
Israel. Available at http://ec.europa.eu/justice_home/fsj/privacy/docs/
common interpretation of Article 26(1) of Directive
wpdocs/2009/wp165_en.pdf

---

EN
1.2.2011 Official
Journal
of
the
European
Union L
27/41
(b) where there is a substantial likelihood that the standards of
95/46/EC with a view to repealing or suspending this
protection are being infringed, there are reasonable grounds
Decision or limiting its scope.
for believing that the competent Israeli authority is not
taking or will not take adequate and timely steps to settle
the case at issue, the continuing transfer would create an
imminent risk of grave harm to data subjects and the
Article 5
competent authorities in the Member State have made
The Commission shall monitor the functioning of this Decision
reasonable efforts in the circumstances to provide the
and report any pertinent findings to the Committee established
party responsible for processing established in the State of
under Article 31 of Directive 95/46/EC, including any evidence
Israel with notice and an opportunity to respond.
that could affect the finding in Article 1 of this Decision, that
protection in the State of Israel is adequate within the meaning
of Article 25 of Directive 95/46/EC and any evidence that this
2. The suspension shall cease as soon as the standards of
Decision is being implemented in a discriminatory way. In
protection are assured and the competent authority of the
particular, it shall monitor the processing of personal data in
Member States concerned is notified thereof.
manual databases.
Article 4
Article 6
1. Member
States
shall
inform
the
Commission
without Member States shall take all the measures necessary to comply
delay when measures are adopted on the basis of Article 3.
with the Decision within three months of the date of its
notification.
2. The
Member
States
and
the
Commission
shall
inform
each
other of cases where the action of bodies responsible for
Article 7
ensuring compliance with the standards of protection in the
State of Israel fails to secure such compliance.
This Decision is addressed to the Member States.
3. If the information collected under Article 3 and under
Done at Brussels, 31 January 2011.
paragraphs 1 and 2 of this Article provides evidence that any
body responsible for ensuring compliance with the standards of
protection in the State of Israel is not effectively fulfilling its
For the Commission
role, the Commission shall inform the competent Israeli
authority and, if necessary, present draft measures in accordance
Viviane REDING
with the procedure referred to in Article 31(2) of Directive
Vice-President

---

L 27/42
EN
Official Journal of the European Union
1.2.2011
ANNEX
Competent supervisory authority referred to in Article 1(2) of this Decision:
The Israeli Law, Information and Technology Authority
The Government Campus
9th floor
125 Begin Rd
Tel Aviv
Israel
Mailing address:
PO Box 7360
Tel Aviv, 61072
Tel. + 972-3-7634050
Fax + 972-2-6467064
E-mail: ILITA@justice.gov.il
Website: http://www.justice.gov.il/MOJEng/RashutTech/default.htm

---