Israel's Tech Sector Faces New EU Privacy Rules and California Lawsuits
Translated & summarized from Globes by baba
Israeli tech companies must now comply with the EU's Cyber Resilience Act, requiring 24-hour reporting of security incidents for digital products sold in the EU, with potential fines up to 15 million euros. Separately, California has reformed its privacy laws, limiting private lawsuits under CIPA, a move that will take effect in 2027. This change aims to reduce the burden on companies, though CCPA regulations still require diligent data management.
The story in 5 lines · by baba
- Israeli tech firms must report EU security incidents within 24 hours under the Cyber Resilience Act.
- Non-compliance with EU regulations can lead to fines of up to 15 million euros.
- California's CIPA law, which spurred thousands of lawsuits, will have its private enforcement removed.
- The California CIPA reform, signed by Governor Newsom, takes effect retroactively in 2027.
- The EU's Cyber Resilience Act applies to digital products marketed within the European Union.
Israeli tech companies are facing increased regulatory scrutiny both in Europe and the United States. In the European Union, the new Cyber Resilience Act mandates that manufacturers of digital products marketed within the EU must report security incidents to cyber authorities within 24 hours of becoming aware of a vulnerability. This initial report must be followed by a more detailed one within 72 hours, and a final report within two weeks or one month, depending on the severity. These obligations apply to a wide range of products, including mobile apps, web applications, hardware components, and integrated hardware-software systems, regardless of the company's location. Failure to comply can result in fines of up to 15 million euros or 2.5% of the company's global annual turnover. This is the first step towards broader provisions taking effect in December 2027.
Experts emphasize that the EU law focuses on the existence of exploited vulnerabilities or serious security incidents, not solely on the breach of personal data. To prepare, companies are advised to map relevant products, update vulnerability management procedures, establish rapid reporting assessment mechanisms, and form multidisciplinary response teams. This EU legislation is part of a larger trend of European regulatory action, following GDPR, DSA, and DMA, with a significant extraterritorial reach.
Meanwhile, in California, Israeli tech companies have been targeted by numerous lawsuits under the California Invasion of Privacy Act (CIPA). This law, originally intended to prevent wiretapping, has been used by private plaintiffs to file class-action lawsuits over the use of common technologies like tracking pixels and analytics tools. Reports indicate over 4,700 such lawsuits have been filed since 2022. Companies receiving warning letters often resorted to disabling tracking and marketing systems, which significantly hampered their business operations by limiting data for targeted advertising and budget optimization.
However, a significant development offers some relief: California lawmakers have passed an amendment that revokes the right of private citizens and attorneys to file CIPA lawsuits, consolidating enforcement power with the Attorney General. Governor Gavin Newsom signed the legislation, which will take effect retroactively from January 1, 2027. Despite this positive change, the California Consumer Privacy Act (CCPA) remains in effect, requiring companies to maintain transparent and proper data management practices.