Beit Shemesh Municipality Fined for Exposing Resident Data

The Beit Shemesh Municipality has been fined NIS 64,000 by the Privacy Protection Authority for a data breach that exposed the personal information of approximately 4,600 residents. The breach occurred due to a malfunction in the municipality's GIS system, which had been contracted out to an external vendor. This allowed unauthorized access to sensitive welfare and medical data through the municipality's website.

The incident came to light when a journalist discovered the vulnerability and reported it. The Privacy Protection Authority launched an investigation, leading to the system's shutdown and the blocking of access to the compromised data. This enforcement action is part of the implementation of Amendment 13 to the Privacy Protection Law, which took effect in August 2023.

The authority found that the municipality failed to properly list the external vendor as a data holder in its welfare database documentation, despite the vendor having ongoing access to the systems. Deficiencies were also identified in the information security procedures concerning external contractors, which did not adequately regulate the purpose of data use, types of information processed, access systems, or the duration of contracts.

The municipality's arguments, including that the vendor was not a "data holder" or that the violations were due to an administrative oversight, were rejected. The authority determined that the vendor met the definition of a data holder given their nearly two-year access to the database systems. The initial fine of NIS 80,000 was reduced because the municipality had no prior financial sanctions or administrative enforcement measures for similar violations in the preceding five years.

The Privacy Protection Authority stated that organizations contracting with external vendors who access sensitive personal data must strictly adhere to legal requirements. The authority indicated that it would continue to enforce privacy laws to strengthen public data protection, noting that its administrative investigation into the external vendor is ongoing.