webinar Summary: Data Subject’s Rights

On January 9, 2025, FPF-Israel held a webinar on “Data Subject’s Rights – A Key to Strengthening Privacy?”.

 The panel included the following speakers:

Adv. Liron Mautner-Lugasi, Senior Director of Privacy and Data Division, Department of Public and Constitutional Law, Ministry of Justice;

Adv. Odia Kagan, Partner and Chair of Data Privacy Compliance & International Privacy at Fox Rothschild (USA);

Adv. Dana Yaffe, Director of The Clinic on Human Rights Clinic in Cyberspace, The Hebrew University of Jerusalem.

The panel was moderated by Adv. Rivki Dvash is a senior fellow at FPF-Israel.

A written summary of the main points raised in the webinar is presented for your convenience.

Those interested can watch the recording (in Hebrew) at this link.

Opening remarks:

The webinar was born in the wake of Amendment No. 13 to the Israeli Privacy Law, which strengthened the ability to enforce in Israel and the understanding that the upcoming amendment that the Ministry of Justice will promote will also regulate substantive issues.

In this webinar, we examined whether upholding the rights of data subjects can help increase data protection in Israel. We invited three spokeswomen from different disciplines.

Adv. Liron Mautner-Lugasi:

Adv. Mautner-Lugasi reviewed the theoretical and normative perceptions of the data subject’s rights in Israel.

Highlights:

Data protection is considered a legal and social tool that allows a person freedom of expression and protection from the concentration of power of commercial and governmental entities. The rights of data subjects in Israel are relatively limited compared to the European GDPR. Amendment 13 was enacted primarily to improve the enforcement of the legal arrangement in Israel.

Adv. Mautner-Lugasi presented the Israeli legislation on data rights, including the right to access data (section 13), the right to rectify data (section 14), the obligation of the controller to notify when collecting data (section 11), which was expanded in Amendment No. 13, and special rights regarding the use of data in databases for direct marketing and direct marketing services (17c-17f).

The Privacy Regulations (Provisions Regarding Data Transferred to Israel from the European Economic Area), 5783-2023 (the Mediation Regulations), which came into full effect on January 1, 2025, apply to databases containing data from the European region. The regulations have created an anomaly because they apply only to some databases. Therefore, they are called mediation regulations because, as far as the Ministry of Justice is concerned, this is a temporary situation and not optimal.

The expansion of data subject rights in the Regulations touches on several aspects, including the expansion of the right to deletion, the obligation to minimize the data held in the database, the obligation to ensure the accuracy of the data in the databases, and the expanded duty to inform.

In addition to the Privacy Act, specific legal arrangements in Israel establish unique rights for data subjects, such as the Criminal Information Law, the Financial Data Service Law, the Credit Data Law, etc.

In conclusion, Adv. Mautner-Lugasi elaborated on the existing anchors in Amendment No. 13 that strengthen the ability to carry out administrative or private enforcement of a violation of data subject rights while mentioning a legislative amendment that is expected to expand the ability to file class actions on this issue. 

Adv. Odia Kagan

Adv. Kagan presented the leading approach in the United States regarding the protection of data subjects’ rights and its uniqueness, especially vis-à-vis the European approach.

Highlights:

The main difference in the perception of data protection between the United States and Europe is that in Europe, data protection is perceived as a fundamental human right, while in the United States, data protection focuses on the issue of your agency and role as a consumer. The emphasis is on the consumer as a user of services in the market.

According to Adv. Kagan’s analysis, the free market is the basis in the U.S. for the perception of data subject rights. People are the basic unit of society’s functioning, and their free choice drives the market.

Today, technological advances have the ability to “disrupt” a person’s decision through various manipulations. Therefore, American regulation focuses on removing the “defects” that divert or influence a person’s agency by emphasizing transparency and non-deception to allow a person to make an honest, free choice.

Another emphasis is on the “sale” of information, where most enforcement was done in the United States. There is increasing importance placed on the rights of deletion, correction of information, and tracking of data transfers between various entities. The emphasis here is on the monetization of information. Because you did not give the person the choice, he could not anticipate the transfer, and you did not give him the option to object or condition it. There is extensive writing on the subject in the United States and significant enforcement in these areas.

The issue of choice is acute; therefore, there is enforcement where there is deception or unfair influence on the selection considerations (such as dark patterns).

Adv. Kagan emphasized that in the United States, especially after the change of leadership at the FTC, the impact of information on the person is examined. The fact that data is being processed, if it has no impact in reality, does not concern American regulation. Where the processing of sensitive information will have an impact on a person’s life, for example, medical treatment, employment, etc., or if the circumstances of the collection or use involve deception, they will be stricter in checking the processing of information to ensure that it is done transparently and fairly vis-à-vis the consumer.

The concept is not that the state gives a person rights but that you have rights by your “being,” and you are giving the state permission to help you be more protected. Therefore, the purpose of the laws is to provide you with the tools to make informed decisions as they were in the past. That is why, in the United States, the focus is on transparency, preventing patterns that prevent the possibility of making an informed decision, monetization that you do not expect, and in cases where the use of information has a consequence that may cause harm.

Adv. Dana Yaffe

Adv. Yaffe presented the difficulties in practically implementing standing up for rights in virtual space.

Highlights:

Adv. Yaffe emphasized the gaps between existing legislation and the practical complexity of implementing individual rights in the digital space in Israel.

The three main barriers are the law enforcement authorities and their modus operandi, the need to deal with foreign platforms that do not cooperate in many cases, and the international effect of the space.

Incidentally, Adv. Yaffe would like to point out that sometimes the harm also occurs to someone who is not a “consumer” of digital media (such as someone whose intimate photos were distributed on a network in which he is not a member). Therefore, relying on consumer’s perception and user’s consent is insufficient.

Adv. Yaffe presented several examples of cases she handled and the difficulties she experienced during the treatment of these cases.

In her view, beyond the amendment to the Privacy Law, more effective enforcement tools are necessary in Israel, similar to the DSA (Digital Services Act) laws in Europe, which impose liability on digital content intermediaries. In addition, Adv. Yaffe emphasized the gaps in protecting individual rights in the online space in Israel and asked for regulatory reinforcement to better deal with digital abuses (for example, the right to be forgotten).

As for the tool of class actions and civil lawsuits in general, they can usually be used only after the injury and evidence about it have become known. Otherwise, it is challenging to prove a violation of data protection in a company that protects its trade secrets when the defendant can always bring in more knowledgeable experts to contradict the plaintiffs’ claims.

A joint discourse at the end

In conclusion, Adv. Dvash. Asked what the spokespersons would recommend as anchors for future legislation in Israel on the subject:

Adv. Kagan emphasizes the importance of transparency without misleading the way information is presented to the user. Based on the perception that the regulator should allow the individual to make autonomous decisions, the solution is to empower the person and not focus only on restricting the business. Another emphasis is on the actual impact—to intervene where the use of the information impacts people’s reality.

Adv. Yaffe feels there is a lack of a law similar to the DSA that provides effective tools to act vis-à-vis companies. It is also necessary to train law enforcement agencies, especially the police, to act in such offenses. It must be remembered that there are platforms that don’t comply with Israeli law, and then there is a need for international cooperation to create deterrence in the field.

Adv. Mautner-Lugasi noted that the data subject’s rights are one of several tools that can improve data protection. It is impossible to impose everything on a person and be satisfied that he may realize his rights. Strengthening administrative enforcement is an example of another such tool. We need to promote and develop additional tools and principles, and a combination of all of these will succeed in bringing about change.