Israel: PPA investigates City of Bat Yam educational institution for alleged violation of information security
The Privacy Protection Authority ('PPA') announced, on 4 January 2022, its investigation into a complaint against an unnamed educational institution in the City of Bat Yam regarding an alleged violation of the Protection of Privacy Law, 5741-1981 ('PPL') and the Protection of Privacy Regulations (Data Security) 5777-2017 ('the Data Security Regulations'), following a serious security incident.
Background to the case
In particular, the PPA outlined that the security incident involved the dumping of huge amounts of sensitive personal information of students of the institution, including personal photographs, questionnaires with personal information, and psychological assessments.
Findings of the PPA
Further to the above, the PPA highlighted that any body that manages or holds personal information about people, and certainly an educational institution that holds sensitive information concerning students and minors, must ensure that it acts to protect the information in accordance with its duty under the Data Security Regulations, including with regard to the processes of archiving, eradication, or destruction of such information. In addition, the PPA noted that printouts of information in a database, especially when it comes to sensitive information, are also subject to a duty of confidentiality and must be processed in accordance with the data controller's duty under the Data Security Regulations. Moreover, the PPA expressed that the educational institution acted to handle the incident by collecting the exposed materials and no serious security incident had been reported.
Finally, the PPA outlined that, following its appeal to the educational institution and the municipality for immediate and urgent action, the educational institution had acted to correct the incident and collected the exposed materials. However, the PPA highlighted that failure to comply with privacy obligations can expose the body to administrative and criminal enforcement proceedings, as well as harming the reputation of the infringing body.
You can read the press release, only available in Hebrew, here.