A database is an organized collection of information or structured data, typically stored electronically in a computer system. In the context of databases, a privacy policy is essential as it ensures that user data is handled securely and in compliance with legal standards, protecting sensitive information from unauthorized access. In this article, we will address questions on this subject and clarify the importance of privacy policies in safeguarding user information.
Frequently Asked Questions in the Field of Privacy Protection:
When is a database considered a private database?
A database owner is required to register the database if one of the following conditions is met:
* The number of individuals whose information is in the database exceeds 10,000.
* The database contains sensitive information.
* The database includes information about individuals that was not provided by them, on their behalf, or with their consent for this specific database.
* The database belongs to a public body.
* The database is used for direct mailing services.
What information is included in the definition of “sensitive information”?
* Data regarding a person’s personality, private affairs, health status, economic status, opinions, and beliefs.
* Information defined as sensitive by the Minister of Justice in an order, with the approval of the Knesset Constitution, Law, and Justice Committee.
How do you register a private database?
The database owner is required to submit a registration application to the Registrar of Databases at the Ministry of Justice. The application includes a set of documents based on the type of information in the database. Forms can be downloaded and submitted online via this link: https://www.gov.il/he/service/registration_in_the_database
Is a person’s email address considered private information? Is a computerized list containing only names and email addresses subject to the obligations of the Privacy Protection Law and Regulations?
This question arises because Section 7 of the Privacy Protection Law excludes data collections containing only “name, address, and contact details” from certain privacy protection obligations. However, the Privacy Protection Authority previously deliberated on this and ruled that a collection of email addresses alongside their owners’ names does indeed constitute a “database,” making it subject to the Privacy Protection Law and Regulations. This is because an email address often allows for the inference of additional personal data, such as professional training, personal status, political affiliation, and more. Furthermore, as email addresses are commonly used for identification on social networks and online services, they can serve as a “key” to uniquely identify an individual and link various data points held across different databases.
Must a company’s employee database be registered with the Registrar of Databases?
Human resources management involves collecting and storing personal information of employees, including addresses, ID numbers, marital status, education, professional experience, bank account details, medical status, CVs, and more. According to the criteria defined by law, the fact that this information is considered “sensitive information” is sufficient to require its registration as a database. This is a necessary and sufficient condition for registration. Despite this, many organizations—particularly small ones with dozens or hundreds of employees—are unaware of the requirement to register their HR database, assuming the number of records is relatively small. Such organizations are often unfamiliar with the criteria for defining a record collection as a database under the Privacy Protection Law. Failure to register can lead to administrative fines and reputational damage.
Must a company’s surveillance camera database be registered?
Footage of employees will typically be identified or, at the very least, identifiable. Employees are a defined and limited group whose identities, details, and schedules are known to the employer in advance. Therefore, workplace recordings generally fall under the definition of “information,” and a collection of recordings from cameras operated by an employer falls under the definition of a “database” as defined in Section 7 of the Privacy Protection Law—even if the cameras do not utilize advanced technologies like automatic facial recognition. Consequently, the employer is obligated to treat the camera system as a private database and register it with the Registrar of Databases.
Insights from Senior Cybersecurity Experts at IPV Security:
- To identify private databases at a client’s site, one must rely on the Privacy Protection Law and professional experience. Occasionally, a database that appears non-private is revealed to be a private database. Professional guidance is recommended for accurate identification.
- The law requires the registration of every private database with the Registrar of Databases. Failure to register a private database constitutes a legal offense.
- Based on updates from the Privacy Protection Authority, a person’s email address is considered private information. For example, a database containing names and email addresses is a private database and requires registration and appropriate protection.
- An organizational employee database is defined as a private database unless it contains no information beyond name, address, and phone number. Any organization managing an employee database containing sensitive information must register it with the Registrar of Databases at the Ministry of Justice, regardless of the number of records.
- Video footage generated by surveillance cameras installed in an organization is considered sensitive information and constitutes a private database requiring registration and appropriate protection.
- There are strict restrictions regarding the installation of surveillance cameras in an organization. Non-compliance with these restrictions may constitute a criminal offense. It is advisable to consult a privacy protection expert when installing surveillance cameras.
For the correct and efficient management of privacy protection within an organization—including compliance with the Privacy Protection Law and Regulations and the implementation of information security controls—you may utilize the Privacy Protection module within the CISOteria system.