Article Israel: Privacy Protection Authority Announces Scope of Informed Consent for Collection of Personal Information by AI

On July 31, 2022, Israel’s Privacy Protection Authority (PPA) published its position on the obligation to inform data subjects of the collection and use of personal information (PPA document). The PPA announced that the collection and use of personal information through algorithm-based decision-making systems (i.e., artificial intelligence, or AI) requires that the subjects of such collection and use be informed of the purpose and the recipients of the information. Failure to comply with these requirements constitutes a violation the Privacy Protection Law, 5741-1981, as amended.

Legal Requirement of Informed Consent

The PPA document affirms Israeli law permitting the collection and use of personal information about a person when it is based on the person’s consent or when authorized by law. In both situations, however, the law requires that the party interested in collecting and using the information (requesting party) inform data subjects about the collection and use, and provide them with specific related data. (PPA document para. B2.)

In accordance with section 11 of the Privacy Protection Law:

Contacting a person for information for the purpose of maintaining or using [the information] in a database must be accompanied by a notice that will indicate:

(1) whether the person has a legal obligation to provide the information, or if the provision of the information depends on the person’s will and consent;
(2) the purpose for which the information is requested;
(3) to whom the information will be delivered and the purposes of delivery.


The PPA clarified that the obligations under the above-cited provision apply even when the request for collection of information was made in accordance with the person’s own request for a particular service.

Section 3 of the Privacy Protection Law provides that the consent for collection and use of information must be informed consent. The requesting party, according to the PPA, must therefore

present the person with data regarding the collection and use of information about that person, so that the subject of the information will have a full picture before deciding whether to agree to the provision of the information.

The scope and content of the notification may be affected in this context by various data, such as the identity of the requester, the nature of the requester’s relationship with the subject of information, and the type and sensitivity of the information. (PPA document paras. 9–10.)


Collection of Information and Decision-Making Based on Algorithms

According to the PPA, information processing in technological systems is performed using algorithms and is based on predefined criteria and for specific purposes. In many cases, the processing is performed in a nontransparent manner, which is especially problematic in the context of technological systems that make decisions about a person.

The PPA states that the collection and processing of personal information by algorithm-based decision-making systems constitutes a violation of a person’s ability to control information if done without the subject’s sufficient knowledge or ability to understand what has been done with the information and for what purpose. (Para. 17.)

AI systems were designed to process information from a wide variety of sources, including databases, in a variable “independent” manner, and not according to predefined criteria. The algorithms in these systems have the ability to use previous decisions and statistical information to change the criteria and circumstances that provide the basis for their decisions. The mode of operation of such systems is complex and variable, and therefore may not be transparent. Consequently, it is often difficult for data subjects to control how their personal information is used. According to the PPA, in some cases, the information itself is collected by AI-based systems such as “bots” that ask a person to share and deliver personal information, sometimes without informing the person about the purpose of collecting the information and the identity of the information’s recipient.

Considering the special features involved in collecting information and making decisions on the basis of algorithms, the PPA determined that the notice obligations imposed under section 11 of the Privacy Protection Law apply to requesting parties that collect and use personal information through such systems. (Para. 22.)

Specific Rules on AI Systems

According to the PPA, a person whose personal information is collected and processed by automated system, such as “bots,” must be informed of the collection and use, as well as of the manner in which the systems operate, to the extent necessary for receipt of informed consent. Such a person should be given an explanation regarding the type of data that may be used by the systems and its source. (Para. 24.)

Scope of Information Provided to a Data Subject

The PPA provided that the scope of detail required for compliance with the duty of notification depends on the context:

In circumstances where the collection of information and its use involve a significant violation of privacy, or when it can be assumed that the subject of the information may not be aware that the  information is even being collected or of its implications, it is necessary to ensure that the notification is presented in a targeted but comprehensive manner to the extent possible. (Para. 26.)

Ruth Levush, Law Library of Congress
October 21, 2022

Read more Global Legal Monitor articles.

About this Item

Title

  • Israel: Privacy Protection Authority Announces Scope of Informed Consent for Collection of Personal Information by AI

Online Format

  • web page

Rights & Access

Publications of the Library of Congress are works of the United States Government as defined in the United States Code 17 U.S.C. §105 and therefore are not subject to copyright and are free to use and reuse.  The Library of Congress has no objection to the international use and reuse of Library U.S. Government works on loc.gov. These works are also available for worldwide use and reuse under CC0 1.0 Universal. 

More about Copyright and other Restrictions.

For guidance about compiling full citations consult Citing Primary Sources.

Credit Line: Law Library of Congress

Cite This Item

Citations are generated automatically from bibliographic data as a convenience, and may not be complete or accurate.

Chicago citation style:

Israel: Privacy Protection Authority Announces Scope of Informed Consent for Collection of Personal Information by AI. 2022. Web Page. https://www.loc.gov/item/global-legal-monitor/2022-10-20/israel-privacy-protection-authority-announces-scope-of-informed-consent-for-collection-of-personal-information-by-ai/.

APA citation style:

(2022) Israel: Privacy Protection Authority Announces Scope of Informed Consent for Collection of Personal Information by AI. [Web Page] Retrieved from the Library of Congress, https://www.loc.gov/item/global-legal-monitor/2022-10-20/israel-privacy-protection-authority-announces-scope-of-informed-consent-for-collection-of-personal-information-by-ai/.

MLA citation style:

Israel: Privacy Protection Authority Announces Scope of Informed Consent for Collection of Personal Information by AI. 2022. Web Page. Retrieved from the Library of Congress, <www.loc.gov/item/global-legal-monitor/2022-10-20/israel-privacy-protection-authority-announces-scope-of-informed-consent-for-collection-of-personal-information-by-ai/>.