Privacy Authority Fines Beit Shemesh Municipality Over Data Breach

Israel's Privacy Protection Authority has imposed a NIS 64,000 fine on the Beit Shemesh Municipality following a severe security incident that exposed sensitive personal information of approximately 4,600 residents. The breach occurred through the municipality's website, granting access to welfare and medical data, categorized as particularly sensitive.

The incident stemmed from a malfunction in the municipality's GIS system, which involved a third-party vendor. An investigation by the authority revealed significant failures in the municipality's data protection practices. It was found that the municipality violated regulations by allowing the external vendor continuous access to and processing of the welfare database without legally reporting the vendor as a data controller.

Furthermore, the municipality's information security procedures were deemed critically weak. They failed to define the vendor's permissible actions with the data, the systems the vendor could access, or the duration of the engagement. Crucially, the procedures did not even reference the required security agreements with external parties.

The initial fine was NIS 80,000, but it was reduced because the municipality had no prior financial penalties or administrative enforcement measures for similar violations in the preceding five years. The authority's administrative review process concerning the vendor is still ongoing.

Adi Menachem Bar, Director of Enforcement at the Privacy Protection Authority, stated, "The obligation to comply with the Privacy Protection Law and its regulations is intended to ensure the protection of personal information collected in databases within various organizations. In this case, it involved particularly sensitive personal information, including medical information and welfare data on residents, which was exposed to the public, with all that this implies."