Israeli Privacy Protection Authority Issues Draft Policy On Data Minimization

• Published date: 05 April 2021
• Subject Matter: Privacy, Data Protection
• Law Firm: Pearl Cohen Zedek Latzer Baratz
• Author: Mr Haim Ravia and Dotan Hammer

The Israeli Privacy Protection Authority (Israel's privacy regulator) published a draft policy paper on data minimization under Israeli law for public comments. The draft paper highlights that data handlers must ensure that the personal data they collect is relevant and necessary for the purposes of the database in which the data is maintained.

Data handlers are expected to integrate the data minimization principle into their operations. Retention of excess data for purposes that exceed those it was collected for and those ancillary to it, increases the risk for privacy and data security-related violations. The draft paper also suggests that a database owner's failure to update or correct personal data at the request of a data subject could mean that the database owner retains excessive (outdated) data.

Since 2018, the Israeli information security regulations mandate that a database owner conduct an annual review to determine whether it maintains excessive personal data that is not...