This informative Q&A covers common issues in cybersecurity laws and regulations, including criminal activity, applicable laws, specific sectors, corporate governance, litigation, insurance, employees, and investigatory and police powers that may occur in Israel.
This Q&A is part of the global guide to Cybersecurity. For a full list of jurisdictional Q&As click here
1. Criminal Activity
1.1 Would any of the following activities constitute a criminal offence in your jurisdiction? If so, please provide details of the offence, the maximum penalties available, and any examples of prosecutions in your jurisdiction:
Hacking (i.e. unauthorised access)
Section 4 of the Israeli Computers Law 5755-1995 states that any person who gains unauthorised access to computer material in a computer is liable for three years imprisonment; for this purpose, “unauthorized access to computer material” is unauthorised access by means of communication with or connection to a computer, or by operation thereof, with the exception of unauthorised access to computer material, which constitutes wiretapping under the Wiretapping Law, 1979. Israel’s Supreme Court (8464/14 State of Israel vs. Nir Ezra) has broadly interpreted the term “unauthorized access” under this clause to encompass any type of access to a given computer, whether direct access through an authorised user or indirect access via the interception of files or data. In addition, the Supreme Court in the same ruling interpreted the term “unauthorized” as any use carried out without the consent of the owner of the computer.
Section 2 of the Computers Law prohibits the unauthorised disruption of the proper operation of a computer system, or any unauthorised deletion, modification or disruption of materials on a computer system, for which the offender is liable for three years’ imprisonment.
The Israeli Computers Law makes no specific reference to phishing offences. However, in such cases the perpetrator may be charged with receipt of benefits through false pretenses and forgery, which are punishable by up to five years’ imprisonment.
Infection of IT systems with malware (including ransomware, spyware, worms, trojans and viruses)
Section 6 of the Computers Law states that any person who renders software able to disrupt or cause damage to computers or computer material is liable for three to five years’ imprisonment.
Section 6 of the Computers Law was enacted in Israeli legislation in order to align with the Budapest Convention (ETS 185-Convention on Cyber Crime), which Israel ratified in 2016.
Possession or use of hardware, software or other tools used to commit cybercrime (e.g. hacking tools)
Section 6(b) of the Israeli Computers Law states that any person who distributes or offers to the public or transmits to another or introduces to another person’s computer or installs on another person’s computer a password, access code or similar information to perform hacking is liable for five years’ imprisonment.
Identity theft or identity fraud (e.g. in connection with access devices)
Israeli law has no specific offence that addresses identity theft. However, the Computers Law determines the offence of “false information or false output”. This offence determines that “anyone who transfers to another or stores on a computer false information or acts with respect to information such that the result is false information or false output” is liable for five years’ imprisonment. The definition of false information is “information or output which may be misleading, in accordance with the purposes of the use thereof”. Therefore, a person who steals the identity of another in order to perform acts in his name may be liable for the aforesaid offence.
Electronic theft (e.g. breach of confidence by a current or former employee, or criminal copyright infringement)
Israel does not have a specific clause for digital theft, but Section 5 of the Israeli Computers Law states that a person who performs an act prohibited under Section 4 (the Hacking Clause), in order to commit an offence under any enactment other than the Computers Law, including offences of digital and IP theft, is liable for five years’ imprisonment.
Any other activity that adversely affects or threatens the security, confidentiality, integrity or availability of any IT system, infrastructure, communications network, device or data
There are no other activities.
Failure by an organisation to implement cybersecurity measures
Failure to implement information security measures in an organisation is not a criminal offence under Israeli legislation. However, the PPL determines a penalty of one years’ imprisonment for anyone who was required to appoint a Data Protection Officer, and failed to do so.
1.2 Do any of the above-mentioned offences have extraterritorial application?
The PPL does not include an applicability clause. Accordingly, the territorial applicability of the offences set forth therein is determined in the choice of law rules. In accordance with the choice of law rules determined in the Israeli Penal Law and in accordance with the case law of the courts, it appears that the law may be applicable in any one of the following situations:
1. The offence was committed by the owner of a database located in Israel.
2. The offence is related to acts of data processing performed in Israel.
1.3 Are there any actions (e.g. notification) that might mitigate any penalty or otherwise constitute an exception to any of the above-mentioned offences?
The performance of acts which may mitigate the potential damage to the data subjects upon the occurrence of, for instance, a data breach incident, may assist an entity that failed in protecting its customers’ personal information. For example, notifying the data subjects upon the occurrence of a data breach or another security failure should be considered.
1.4 Are there any other criminal offences (not specific to cybersecurity) in your jurisdiction that may arise in relation to cybersecurity or the occurrence of an Incident (e.g. terrorism offences)? Please cite any specific examples of prosecutions of these offences in a cybersecurity context.
There are no other criminal offences.
2. Applicable Laws
2.1 Please cite any Applicable Laws in your jurisdiction applicable to cybersecurity, including laws applicable to the monitoring, detection, prevention, mitigation and management of Incidents. This may include, for example, laws of data protection, intellectual property, breach of confidence, privacy of electronic communications, information security, and import / export controls, among others.
Israel had a broad array of acts of legislation and regulations, along with some relevant government resolutions on cybersecurity issues.
In 2002, Government Resolution 84/B established the National Information Security Agency, which was assigned with the task of regulating critical national infrastructure on cybersecurity issues.
In 2011, Government Resolution 3611 established Israel’s National Cyber Bureau (“INCB”), which was tasked with providing policy guidance in cybersecurity, along with other national responsibilities, including encouraging collaboration between academia, industry and the government.
In addition, in 2015, Government Resolution 2444 established the National Cyber Defense Authority (“NCDA”) as the operational arm of the INCB, which is responsible for national cybersecurity policy in the civilian sector (although its authority has yet to be formally enacted).
The Computers Law, 1995, focuses on computer cybercrimes and prohibits the unauthorised disruption of the proper operation of a computer system, or the unauthorised deletion, modification, or disruption of materials on a computer system along with some penal provision.
The Protection of Privacy Law, 1981, (“PPL”) established the Registrar of Databases, which currently act under the ILITA and has issued regulations and guidelines with respect to information security, such as the Protection of Privacy Regulations (Transfer of Information to Databases outside of Israel) 2001 (the “Data Transfer Regulations”), which regulate international data transfers, and the Protection of Privacy Regulations (Conditions for Possessing and Protecting Data and Procedures for Transferring Data Between Public Bodies) 1986 (the “Data Possession Regulations”), which set forth mandatory data protection requirements. The Protection of Privacy Regulations (Data Protection) 2017 (the “Data Protection Regulations”), impose mandatory data breach notification requirements and some additional security obligations.
The Administrative Offences Regulations (Administrative Fine – Protection of Privacy), 2004, determine the administrative fines which can be imposed in the event of any violation of specific provisions of the PPL.
The Wiretapping Law, 1979, requires investigative authorities to obtain a court order before engaging in electronic surveillance, while electronic surveillance for purposes of national security requires the direct approval of the Minister of Defense or Prime Minister.
The control of defence exports in Israel is regulated by the Defense Export Controls Law, 2007, and the regulations and orders promulgated thereunder.
2.2 Are there any cybersecurity requirements under Applicable Laws applicable to critical infrastructure in your jurisdiction?
For EU countries only, how (and according to what timetable) is your jurisdiction expected to implement the Network and Information Systems Directive? Please include details of any instances where the implementing legislation in your jurisdiction is anticipated to exceed the requirements of the Directive.
The Security in Public Bodies Law, 1998, regulates the security requirements for physical, digital and information systems that constitute critical infrastructure.
The law lists bodies which are considered critical infrastructures and sets forth the powers of the guiding national bodies – defence and civilian – vis-à-vis such bodies.
The law requires these public bodies to appoint a security officer who is supervised directly by the Israeli Security Agency.
2.3 Are organisations required under Applicable Laws, or otherwise expected by a regulatory or other authority, to take measures to monitor, detect, prevent or mitigate Incidents? If so, please describe what measures are required to be taken.
The PPL determines in Section 17 that the owner of a database, the holder of a database or manager of a database are each responsible for the security of the information in the database. It is important to note that although Israeli law draws the principles of data protection and privacy from EU law, the language and terminology are not identical to the standard terminology of data protection and privacy in EU law.
The term corresponding to ‘data controller’ in Israel law is ‘owner of a database’. ‘Holder of a database’ is defined in Israeli law as “anyone who holds permanent possession of a database, and is authorized to make use thereof”. Additionally, every database must have a database manager. The database manager is the CEO, unless determined otherwise in the database registration process.
After many years in which the requirement for data protection remained vague, the Data Protection Regulations were enacted in 2017, which specify the data protection requirements expected from owners of databases. The regulations are modular, such that the requirements under the regulations vary from one company to another, in accordance with the level of data protection required of a company. A company’s data protection level is determined in accordance with the type and quantity of information it holds, while the level of data protection is classified as basic, intermediate or high. There is an additional level of databases administered by an individual, with are subject to less requirements under the regulations.
In the framework of the regulations, owners of databases are required to have a written information security policy and an updated document on the structure of the database and an updated inventory of the database systems, which includes, inter alia, a list of software systems used for operating, managing and maintaining the database, for supporting its operation, and for monitoring and protecting it.
With respect to monitoring – in database systems which are subject to the intermediate or high level of security, it is mandatory to maintain an automatic documentation mechanism which allows for control and audit of the access to the database systems. Additionally, it is mandatory to document security incidents.
With respect to identification – the owner of a database is required to take measures to ensure that access to information in the database is performed only by an employee authorised therefor. In databases with a intermediate or high level it is necessary to consider the use of physical measures that are subject to the exclusive control of the authorised person, and, at the very least, to determine a procedure for changing passwords at a frequency of at least every six months.
Prevention – an owner of a database is required to prepare an information security procedure, to specify therein the measures whose purpose is the protection of the computer systems and communications infrastructures of the database and the manner of operation thereof for this purpose, to ensure the physical and peripheral protection of the database and the database’s systems, to perform a risk survey and intrusion examinations.
It is noted that there are sectoral regulations (for instance, in the field of banking and insurance), which determine additional requirements pertaining to data protection.
2.4 In relation to any requirements identified in question 2.3 above, might any conflict of laws issues arise? For example, conflicts with laws relating to the unauthorised interception of electronic communications or import / export controls of encryption software and hardware.
The data protection requirements may indeed create conflicts between different laws. Such a major conflict exists between the Wiretapping Law and the Israeli PPL, which determines that wiretapping – i.e. eavesdropping on a conversation without receiving the consent of one of the parties to the conversation – is illegal and carries a penalty of imprisonment.
The data protection requirements include, inter alia, monitoring system and network communications, and therefore may intercept “conversations” and data transmissions between parties to a conversation, without receiving their consent.
Israeli law does not distinguish between wiretapping a conversation and wiretapping data transmissions – meta data – and therefore wiretapping such communications, underscored by the duty to protect the information, may place the monitor of the transmissions at criminal risk.
Currently, the main route for addressing this conflict is by determining a policy for use of IT components in the organisation, specifying the means of monitoring, and receiving consent to the policy, from the employees and others using the systems.
2.5 Are organisations required under Applicable Laws, or otherwise expected by a regulatory or other authority, to report information related to Incidents or potential Incidents to a regulatory or other authority in your jurisdiction? If so, please provide details of: (a) the circumstance in which this reporting obligation is triggered; (b) the regulatory or other authority to which the information is required to be reported; (c) the nature and scope of information that is required to be reported (e.g. malware signatures, network vulnerabilities and other technical characteristics identifying an Incident or cyber attack methodology); and (d) whether any defences or exemptions exist by which the organisation might prevent publication of that information.
The Protection of Privacy Regulations (Data Protection), 2017, requires organisations that experience severe information security incidents to report to the Registrar of Databases. The reporting obligation also takes into account the organisation’s database security level. The Registrar of Databases has the authority to order such breached organisations to also report the information security incident to every data subject whose sensitive information was breached.
2.6 If not a requirement, are organisations permitted by Applicable Laws to voluntarily share information related to Incidents or potential Incidents with: (a) a regulatory or other authority in your jurisdiction; (b) a regulatory or other authority outside your jurisdiction; or (c) other private sector organisations or trade associations in or outside your jurisdiction?
Israel does not have any laws or regulations that directly restrict the sharing of information related to cyber incidents and yet, the gathering of such information without the consent of network users could potentially violate both the PPL and the Wiretapping Law.
In addition, the INCB has established the CERT-IL, which is a civilian centre for collaborating and coordinating cyber events. In order to meet its goals, CERT-IL collects information regarding cyber incidents from a variety of sources, including private entities that have volunteered to share information. Prior to sharing the information with CERT-IL, the breached entity is required to disclose such practices to its employees and data subjects, while the CERT-IL confirms that the sharing entity is aware of CERT-IL’s policies regarding shared information.
The Israeli Antitrust Authority has recently published a draft opinion on the joint effort, exchange and sharing of information by institutions, organisations and companies for the purpose of defending against cyber threats.
2.7 Are organisations required under Applicable Laws, or otherwise expected by a regulatory or other authority, to report information related to Incidents or potential Incidents to any affected individuals? If so, please provide details of: (a) the circumstance in which this reporting obligation is triggered; and (b) the nature and scope of information that is required to be reported.
To date, there has been no obligation to report to data subjects in Israel. Currently, with the new Data Protection Regulations taking effect, a mandatory reporting requirement became effective for “severe security incidents”. The definition of a severe security incident depends on the data protection level which applies to the breached database, as defined in the Data Protection Regulations. The current requirement is to report severe security incidents to the Registrar of Databases, who in turn, after consulting with the head of the National Cyber Defense Authority (NCDA), may order a report to the data subjects.
The data protection level of a database is determined in accordance with a number of criteria, including: the type of information found in the database; the number of data subjects in the database; the purposes of use of the database; the type of organisation which holds the database; and the number of persons holding authorisation for the data inside the database and the systems supporting it.
2.8 Do the responses to questions 2.5 to 2.7 change if the information includes: (a) price sensitive information; (b) IP addresses; (c) email addresses (e.g. an email address from which a phishing email originates); (d) personally identifiable information of cyber threat actors; and (e) personally identifiable information of individuals who have been inadvertently involved in an Incident?
As stated above, the reporting requirement derives from the amount of information exposed or affected, depending on the data protection level of the database.
Thus, for databases with a high security level, a reporting requirement will be triggered in the case of an “incident where use was made of information from the database, including an entry into the database systems in a manner which allows access to the information in the database, without authorization or in deviation from authorization or in a case of tampering with the information”.
With respect to databases with an intermediate data protection level, the requirement to report to the Registrar is only in the case of an “incident in which a substantial part of the database was used without authorization or in deviation from authorization or in a case of tampering with the information with respect to a substantial part of the database.”
2.9 Please provide details of the regulator(s) responsible for enforcing the requirements identified under questions 2.3 to 2.7.
When the Israeli PPL was enacted in 1981, it provided for the appointment of a Registrar of Databases. In 2006, the Israeli Law Information and Technology Authority (“ILITA”) was established, and since then ILITA carries out the functions of the Registrar of Databases.
ILITA belongs to the Israeli Ministry of Justice, and the head of ILITA also serves as the Registrar of Databases. ILITA carries out various regulatory functions, including enforcement, handling of complaints and supervision, as well as maintaining the database registration system.
The Registrar cannot initiate criminal proceedings against a company or person breaching the law, but may initiate administrative proceedings, such as imposing fines, determining administrative violations and suspending registration of a database.
2.10 What are the penalties for not complying with the requirements identified under question 2.3-2.8?
Currently, the authority of the Registrar of Databases on failure to comply with reporting requirements is to determine that an administrative violation has been committed. While it is not a criminal or economic sanction, such determination may be used to establish claims, including class actions, against the breaching entity.
2.11 Please cite any specific examples of enforcement action taken in cases of non-compliance with the above-mentioned requirements.
In recent years, there has been a significant rise in the enforcement activity of ILITA both in terms of audit in supervised bodies and in determining administrative violations and imposing fines. Some of ILITA’s enforcement activities have even led to police investigations and indictments.
One of ILITA’s significant cases in recent years dealt with the investigation of a leak of the Population Register of the State of Israel to the internet. ILITA’s investigation led to the filing of indictments against a number of defendants for copying and distributing the database. The cases ended with convictions and prison sentences of up to 18 months.
Another example from the past year (2017) is ILITA’s enforcement activity at one of the largest credit companies in Israel. Following a data breach incident in which an employee of the company stole information from the company which included hundreds of thousands of records of personal data on customers of the company, including full credit card numbers and bank account details, the level of data protection in the company’s systems and the company’s implementation of the data protection procedures were examined.
At the end of the supervisory activity, ILITA determined that the company had committed an administrative violation, after having found that the company had failed to address data protection matters pertaining to data management within the company as required by the law and had failed to adequately address intra-organisational data protection risks, alongside additional failures.
In general, ILITA evidently invests more resources in enforcement versus, for example, database registration.
3. Specific Sectors
3.1 Does market practice with respect to information security (e.g. measures to prevent, detect, mitigate and respond to Incidents) vary across different business sectors in your jurisdiction? Please include details of any common deviations from the strict legal requirements under Applicable Laws.
The main information security requirements, as aforesaid, are specified in the PPL and the Data Protection Regulations. The general data protection requirement applies to any owner, holder and manager of a database.
The regulations, as aforesaid, determine various data protection requirements in accordance with the type of the organisation, the amount of information it holds and the type of information.
Thus, for instance, while the owners of databases who are subject to intermediate and high data protection requirements are required to perform periodic risk surveys and penetration tests, owners of databases which are subject to basic or lower data protection requirements are exempt from this obligation.
Additionally, the Data Protection Regulations authorise the Registrar of Databases to exempt a certain database from requirements under the regulations, or to apply requirements under the regulations to a certain database.
Furthermore, the Registrar may instruct that anyone who meets certain guidelines on data protection or directives of a competent authority with respect to data protection which apply thereto, shall be deemed as complying with the regulations, if he is convinced that complying with the provisions of an accepted standard or the directives of a competent authority, ensures the level of security determined in such regulations with respect to the same database.
The purpose of the authority to grant an exemption is to prevent conflicts between various regulators (for instance, the Supervisor of Banks, the Commissioner of Capital Market, Insurance, and Savings and the NCDA).
3.2 Are there any specific legal requirements in relation to cybersecurity applicable to organisations in: (a) the financial services sector; and (b) the telecommunications sector?
A number of regulations and directives apply to the Israeli financial services sector.
The Supervisor of Banks at the Bank of Israel has issued Directive 357 – Information Security Management, which sets forth the required information security controls and policies for banks (in line with the Basel Committee’s Risk Management Principles for Electronic Banking from 2003), and Directive 361 – Proper Conduct of Banking Business, which defines the principles for cyber risk management in banks, along with the responsibility to record cyber incidents and report them to the Supervisor of Banks.
In addition, the Capital Market, Insurance and Savings Commissioner at the Ministry of Finance has issued a Directive which imposes new requirements aimed at ensuring the availability, confidentiality and integrity of sensitive information stored by such financial institutions (for example, insurance companies and pension funds), while also protecting the proper functioning of their computer systems. This Directive requires these regulated financial institutions to annually approve and implement a cybersecurity programme and policy.
4. Corporate Governance
4.1 In what circumstances, if any, might a failure by a company (whether listed or private) to prevent, mitigate, manage or respond to an Incident amount to a breach of directors’ duties in your jurisdiction?
Israel’s PPL requires the appointment of a manager for a database, who may be the active manager of a body which owns or holds the database or anyone who was empowered for such purpose by such manager. This law also imposes the responsibility for data protection in the database on each one of the three – the database manager, the database owner and the database holder.
There are specific sectoral regulations which impose more specific requirements on officers and directors in connection with the security of databases.
For example, Circular 2016-9-14 of the Capital Market, Insurance and Savings Commissioner at the Ministry of Finance (Cyber Risk Management in Institutional Bodies), addresses cyber risk management in insurance companies and pension funds in terms of the responsibility imposed on the relevant directors and officers in this field. This Circular requires directors to discuss a current plan for cyber risk management and risk evaluation, which includes a plan for risk mitigation and specification of the changes in management of the cyber risks, at least once a year. The same Circular also states that the CEO of an institutional body shall make proper resources available in order to implement a work plan for cyber risk management and shall maintain adequate control and supervisory mechanisms in this field.
Additional examples are the Bank of Israel Directives 357 and 361, which require the Board of Directors of banks to outline a corporate cyber protection strategy, to receive reports on significant cyber incidents, to approve a framework for cyber risk management and a corporate cyber protection policy, etc. In certain scenarios, the relevant directors and officers may even bear personal liability for failure to comply with the requirements of the above directives.
4.2 Are companies (whether listed or private) required under Applicable Laws to: (a) designate a CISO; (b) establish a written Incident response plan or policy; (c) conduct periodic cyber risk assessments, including for third party vendors; and (d) perform penetration tests or vulnerability assessments?
In accordance with Section 17B(a) of the PPL, the bodies required to appoint a Chief Information Security Office (“CISO”) are: an organisation that holds five databases which are required to be registered according to Section 8 of the PPL; a public body; a bank; an insurance company; and a company which engages in the rating or evaluation of credit.
In accordance with the Data Protection Regulations, an owner of a database is required to determine a written information security policy (“WISP”) which shall be binding on all of the employees. The written security procedure must include, inter alia, details on the manner of handling of data protection incidents, according to the severity of the incident and the degree of the sensitivity of the information.
With respect to risk management in terms of outsourcing, until now, prior to the Data Protection Regulations taking effect, the customary practice was to comply with the directives of the Registrar of Databases on outsourcing. The purpose of this directive was to ensure that an organisation’s use of outsourcing shall not entail the price of violation of the privacy of citizens.
Under the directive, bodies which outsource data processing activities are required to perform a preliminary evaluation of the legitimacy of outsourcing the activity. Thereafter, any body interested in outsourcing the data is required to clearly define the nature of the service which will be performed by outsourcing and precisely determine the purposes of the use of the information so that no use is made other than for the purpose for which the data was received. Additionally, the directive requires: the determination of data protection and confidentiality requirements; ensuring the granting of a right of inspection and correction to the data subject; and determining a mechanism for control by the customer of the service provider’s compliance with the privacy laws and a clear determination of the duration of time the information will be kept by the contractor for the purpose of performance of the service and deletion thereof upon expiration of the engagement.
The Data Protection Regulations adopt the principles of the directive as part of Section 15 of the Regulations.
With respect to organisations who possess databases on a high security level, as defined in the Data Protection Regulations, it was determined that they must perform penetration tests and risk assessments once every 18 months.
4.3 Are companies (whether listed or private) subject to any specific disclosure requirements in relation to cybersecurity risks or Incidents (e.g. to listing authorities, the market or otherwise in their annual reports)?
Bodies supervised by the Capital Market, Insurance and Savings Commissioner (the “Commissioner”), are required to promptly report to the Commissioner any significant cyber incident as a result of which, directly or indirectly:
1. Harmed or disabled production systems containing sensitive information for more than three hours.
2. Indications arise that sensitive information of the institutional body’s customers or employees was exposed or leaked.
Bodies supervised by the Supervisor of Banks (the “Supervisor”) are required to report to the Supervisor on any cyber incident or warning of a cyber incident.
4.4 Are companies (whether public or listed) subject to any other specific requirements under Applicable Laws in relation to cybersecurity?
There are no other specific requirements.
5.1 Please provide details of any civil actions that may be brought in relation to any Incident and the elements of that action that would need to be met.
Any organisation that has experienced a cyber attack or another security incident is exposed to civil claims by various parties – the company’s employees, customers, partners, shareholders, etc.
The claims can be based on contractual grounds, in accordance with the Contracts Law (General Part), 1973, as well as on grounds in accordance with the Torts Ordinance [New Version], including negligence and negligence per se.
5.2 Please cite any specific examples of cases that have been brought in your jurisdiction in relation to Incidents.
Two class actions were filed after data breach incidents, one against a website which engages in the sale of computer games (following a leak of personal information of customers of the website) and the second against a credit card company (for the leak of customers’ details and credit card numbers). Both ended with the withdrawal of the claims, such that to date there is no substantial ruling by the courts in Israel on claims of this type.
However, it is apparent that the causes of action were diverse, including violation of the PPL, negligence, a breach of contract, negligence per se, and failure to comply with an information security requirement.
5.3 Is there any potential liability in tort or equivalent legal theory in relation to an Incident?
The negligence tort is set forth in the Torts Ordinance [New Version] and can certainly serve as a cause of action in response to a security incident. In order to prove the elements of the negligence tort, the plaintiff must prove the existence of behavior during which a person (or company) caused damage without having been aware of the nature of his actions, the circumstances, or the harmful results of his behavior, while the “reasonable person” could have been aware of such details in similar circumstances.
6.1 Are organisations permitted to take out insurance against Incidents in your jurisdiction?
In Israel, organisations are permitted to take out insurance policies against cyber breaches. In light of the growing demand from their customers and the rising scrutiny from the relevant regulators, many companies tend to take out cyber insurance policies.
6.2 Are there any regulatory limitations to insurance coverage against specific types of loss, such as business interruption, system failures, cyber extortion or digital asset restoration? If so, are there any legal limits placed on what the insurance policy can cover?
Israeli law does not allow the purchase of an insurance policy against fines. Otherwise, there are no specific regulatory prohibitions with respect to cyber insurance.
7.1 Are there any specific requirements under Applicable Law regarding: (a) the monitoring of employees for the purposes of preventing, detection, mitigating and responding to Incidents; and (b) the reporting of cyber risks, security flaws, Incidents or potential Incidents by employees to their employer?
The Supreme Court in Israel has ruled that employees have a right to privacy also at their workplace. The leading precedent on this issue is the Isakov judgment [National Labor Court Appeal 90/8 Tali Isakov Inbar v. the State of Israel – the Supervisor of the Women’s Employment Law], where the national labour court struck a balance between the employer’s property right and managerial prerogative, and the employee’s right to privacy. Thus, for instance, with respect to the monitoring of an employee’s e-mail correspondence, the Supreme Court ruled that it is necessary to distinguish between the different types of mailboxes (professional, mixed and personal), while the professional box may be monitored – in certain circumstances – and the personal box cannot, other than subject to a court order.
Additionally, the ILITA released a number of directives pertaining to the protection of personal information in the workplace, use of security cameras, generally, and in the workplace, specifically, and other additional directives designed to clarify the regulator’s position on the balance between the employer’s interest in protecting his business and the employee’s right to privacy.
7.2 Are there any Applicable Laws (e.g. whistle-blowing laws) that may prohibit or limit the reporting of cyber risks, security flaws, Incidents or potential Incidents by an employee?
There are no such applicable laws.
8 Investigatory and Police Powers
8.1 Please provide details of any investigatory powers of law enforcement or other authorities under Applicable Laws in your jurisdiction (e.g. antiterrorism laws) that may be relied upon to investigate an Incident.
The powers of the enforcement and defence agencies in Israel vary between the various agencies and in accordance with the type of incident.
Thus, for instance, the cyber unit of Israel Police, which is responsible, inter alia, for conducting cyber crime investigations and handling cyber crime which involves economic damage, is authorised to exercise various powers granted by the law, including conducting searches in computers and seizing equipment related to perpetration of an offence.
Other defence agencies have broader powers, mainly with respect to the receipt of information from Israeli ISPs.
8.2 Are there any requirements under Applicable Laws for organisations to implement backdoors in their IT systems for law enforcement authorities or to provide law enforcement authorities with encryption keys?
No, Israel has no such requirements under the applicable laws.
LAW FIRM & AUTHOR DETAILS
Please provide the following additional details:
Brief promotional information of law firm / department (approx. 150 words):
Established in 1973, Shibolet is one of Israel’s largest full-service multidisciplinary law firms with a strong corporate and commercial practice, specialising in high-tech and venture capital. Based in the heart of Tel Aviv, Israel’s commercial and financial centre, the firm offers its clients legal services in all fields of commercial/corporate law on a worldwide basis, combining high-quality professional and personal service and a deep understanding of client affairs.
Author 1 Name: Nir Feinberg