Written by: Haim Ravia, Dotan Hammer
The Israeli Privacy Protection Authority (PPA) recently issued a new directive detailing the requirements for transferring ownership of personal data databases. Directive No. 2/2024 emphasizes the transferor’s obligation to notify data subjects when ownership changes.
According to the directive, any change in ownership warrants notification to data subjects regarding the new owner’s identity and contact information, giving them the choice to discontinue the relationship with the new owner. Notice alone may be sufficient if the terms, conditions, and circumstances of data processing and ownership transfer are materially unchanged.
However, the directive identifies two instances in which the transferee must receive prior specific consent for transferring ownership in the database. First, when the identity and nature of the new owner are materially different and may affect the data subjects’ rights, giving rise to a presumption that they had not impliedly consented to the transfer. In these cases, the transferee must obtain prior specific consent from each data subject for the transfer of the ownership. Second, when the terms and conditions of the underlying data processing materially change.
Click here to read the new directive (in Hebrew)
