Written by: Haim Ravia, Dotan Hammer
The Israeli Privacy Protection Authority (PPA) issued a draft opinion for public comments on the principle of consent under Israeli privacy law. The draft opinion clarifies how consent applies in the digital age and explains the PPA’s interpretations which will guide its enforcement efforts, including penalties for violations.
The draft opinion emphasizes that consent must be informed. Notifying the data subject under Section 11 of the Privacy Protection Law is the bare minimum legal threshold; data controllers must provide additional details when relevant. Data controllers will be required to document and demonstrate that data subjects were sufficiently informed, particularly when relying on data subjects’ implied consent, such as data subjects’ acquiescence or failure to object – two practices that the draft opinion discourages.
The draft opinion also explains that consent must be freely given. It illustrates practices that may render consent legally invalid, such as using “dark patterns”: deceptive design tactics that manipulate data subjects into providing consent. These issues are especially prone to occur in cases of unbalanced bargaining power, such as employment contracts or contracts for essential services. In these cases, a heightened burden is placed on the data controller to provide information in a simple and comprehensible manner.
The draft opinion raises significant legal and financial implications for organizations operating in Israel. It is open for public comment until March 24, 2025.
Click here to read the draft opinion (in Hebrew).
