Beit Shemesh Municipality Fined for Sensitive Data Breach

Israel's Privacy Protection Authority has imposed a NIS 64,000 fine on the Beit Shemesh Municipality following a severe security incident involving its Geographic Information System (GIS). The breach, which occurred due to a malfunction with a system provided by an external vendor, exposed sensitive welfare and medical information of approximately 4,600 residents via the municipality's website.

The incident came to light after a journalist discovered and reported the vulnerability. The Privacy Authority launched an investigation into both the municipality and the external vendor. Access to the compromised system was immediately blocked.

The Authority determined that the Beit Shemesh Municipality violated privacy protection regulations by failing to list the external vendor as a data 'holder' in its welfare database, despite the vendor processing personal information and having ongoing access to the system for nearly two years. The municipality's information security procedures were also found to be deficient regarding external contractors, lacking clear guidelines on usage purposes, data types, access systems, and contract durations.

The municipality's arguments, including claims that the vendor was not a 'holder' or that the violations stemmed from a 'good faith administrative gap' after a legal amendment, were rejected. The Authority ruled that the vendor met the definition of a 'holder' given their access, and the municipality should have complied with the law upon its effective date.

The original fine was NIS 80,000, but it was reduced because the municipality had no prior privacy enforcement actions against it in the preceding five years. The Authority's investigation into the external vendor is ongoing. A representative from the Authority emphasized the importance of adhering to privacy laws when engaging external vendors and ensuring the protection of sensitive personal data.