"A person's right to privacy is one of the most basic fundamental rights and one of the cornerstones of every democratic society." At first glance this sentence sounds not only worn out but also a bit bombastic, but there is no doubt that it is accurate.
Our right to privacy, at least in its traditional sense, is something so trivial for us that it feels odd even to dwell on it. It is clear to all of us that no one may enter our home without permission, peek in at us through the window, place tracking devices on us or listen in on our phone calls. It is clear to all of us that it is strictly forbidden to read the private messages we send, and that our banker or doctor has no right to share the data/findings with any party unrelated to the matter. We agree that under certain circumstances and conditions it would be right to infringe on these rights, but we understand that a society that does not place the individual's right to privacy as a core value is a society that is very dangerous to live in. We know such countries, and most of us would not want to live there.
Somewhere along the way, when it reaches other "domains", outside the walls of our home or our WhatsApp, it feels less intuitive. The name of the customer, the size and model of the Adidas shoes she ordered from our site, doesn't always feel in the gut like something that deserves special attention. Nor do the details about the user and the meal he ordered on the evening of the final. Against the backdrop of the feeling that no matter what we do, every breath is monitored by the tech giants and other parties, perhaps it's not so surprising. So when a business owner, even the smallest, has to deal with so much bureaucracy, approvals and licenses, what is simpler than copying some "privacy notice" from one of the websites, popping up a cookie usage policy, and closing the matter. As with the "terms of use", after all, nobody (almost) really reads these materials.
On the other hand, assuming that your business and site are not, heaven forbid, trying to mislead anyone, and the service you provide is open, clear and legitimate, embedding an organizational culture of protecting customers'/users' "privacy" is not necessarily complicated and cumbersome. Amendment 13 to the Privacy Protection Law (mistakenly called Amendment 14), which will enter into force in August 2025, includes significantly harsher sanctions against rogue businesses, but even if we set aside the sticks, treating the privacy of users and customers (and employees) properly is also good for business. Customers know how to appreciate transparency and honesty, and no one likes to feel they are being "taken for a ride".
Getting to know the basic principles of privacy law will help you develop healthy legal instincts. It does not replace a lawyer or a suitable consultant, but internalizing the rationale and adopting the way of thinking pays off. Despite gaps between European regulation (the famous GDPR) and Israeli law, the GDPR principles are a good general framework. For a taste, we will illustrate some of them in a few words. Suppose you own an online store that specializes in selling spices. You wish to examine the issue of protecting the privacy of the clients. In order to collect and process personal information, it is required Legal basis. In order to carry out the spice purchase transaction, it is clear that a customer, who is a private individual, must provide certain personal details, probably an address and payment details. However, this does not permit you to collect any information from him and for any purpose. You must act in a manner transparent and fair and it must know exactly what data you are collecting, and for what purpose. The principle of "purpose limitation", states that you cannot, for example, tomorrow use the address you received for shipping for another purpose without prior explicit consent. And if the customer provided an email address for sending an invoice, sending other publications would be a use that deviates from the purpose for which the information was given. Another basic principle states that you must collect the minimum information that is essential in order to provide the service. The purchaser's personal status – divorced, married or a mother of three – or her education, appears on its face to be excess information that is unnecessary and irrelevant to selling spices. Another principle relates to the period for which you must keep the information – you may not keep information without Time limit. You must store the information in a manner secure and is responsible for reducing the risk of unauthorized use, cyber incidents, etc.
No one wants you to stop doing business or to limit yourselves to selling spices, but you must be transparent and clear and make sure things are agreed. If some of the details you collected from the customer are intended for additional purposes, you must notify in advance and obtain consent for this. Applying privacy law involves many principles, rules, nuances and details, and requires professional skill and familiarity with the field, but internalizing the spirit of these matters, and adhering to basic principles of fairness, transparency, accuracy and detail, is an excellent foundation that may save you a great deal.
* This short and general article is intended to give a taste of a few basic principles and rules in privacy law. It does not constitute legal advice in any way, it is not intended to, and it should not be regarded as such.
