Israeli Privacy Regulator Endorses Appointment Of Chief Privacy Officers In Organizations

• Published date: 04 November 2020
• Subject Matter: Privacy, Data Protection, Privacy Protection
• Law Firm: Pearl Cohen Zedek Latzer Baratz
• Author: Mr Haim Ravia, Dotan Hammer and Adi Shoval

The Israeli Privacy Protection Authority published for public comments a draft position paper on the advisable appointment of Chief Privacy Officers (CPOs, sometimes referred to as Data Protection Officers - DPOs) in Israeli organizations. The paper explains that although Israeli law does not mandate the appointment of CPO/DPO (other than in one isolated instance related to the Bank of Israel), the authority views the voluntary appointment as a recommended best practice for organizations whose operations involve processing personal data.

The paper goes on to explain that while the position may be performed by an in-house member or by an outside professional, it is highly recommended to appoint a senior, in-house executive in organizations whose core activities involve processing personal data or where processing is performed in a large scale.

The position paper references the comparable CPO/DPO regimes under the EU GDPR, the Brazilian LGPD, and the US HIPAA. It recommends that the CPO/DPO, among other matters, be responsible for the organization's privacy policy; be involved in the lifecycle of the organization's data processing activities to ensure that privacy and data protection principles are respected; conduct data protection impact assessments; and handle data subject complaints. The CPO/DPO would also be tasked...