Beit Shemesh Fined for Exposing Medical Data of 4,600

The Privacy Protection Authority at the Justice Ministry has imposed a financial penalty of ₪64,000 on the Beit Shemesh municipality following a serious data security incident. The breach allowed access through the municipal website to personal information from the welfare department of approximately 4,600 city residents, including medical information classified as particularly sensitive data.

The municipality and the Privacy Authority learned of the incident after a journalist discovered the vulnerability and reported it. Following the disclosure, the Authority launched administrative proceedings against both the municipality and an external contractor engaged by the city. The system was immediately shut down and access to the information was blocked.

Welfare Director Shlomo Brilliant (Photo: S.B.)

At the conclusion of the Authority's investigation, Beit Shemesh was found to have violated privacy protection regulations by failing to list the external contractor as a data custodian in the welfare database's definition documents. This omission occurred despite the contractor serving as an external entity that processed personal information on behalf of the municipality and maintained ongoing access to the database systems.

Additionally, deficiencies were found in the data security protocol regarding engagement with external entities. The protocol failed to regulate the purposes of use, types of information permitted for processing, access systems, duration of engagement, and other external contractors. The protocol also lacked references to engagement agreements and the security procedures of those entities.

The Authority rejected the municipality's arguments that the contractor did not qualify as a "custodian" or that the violations stemmed from an "administrative gap in good faith" following the entry into force of Amendment 13 to the law. The Authority determined that the contractor met the definition of "custodian" under the circumstances, having been granted access to the database systems for nearly two years, and that the municipality was required to prepare and comply with the law's provisions and regulations on time.

The original financial penalty for the two violations stood at ₪80,000—₪40,000 per violation—but was reduced to ₪64,000. The reduction was granted because in the five years preceding the violation, no financial penalties or administrative enforcement measures had been imposed on the municipality for violating those same provisions.

Mayor Shmuel Greenberg (Photo: Yaakov Lederman, Flash90)

Attorney Adi Menachem Be'er, director of the enforcement division at the Privacy Protection Authority, stated: "The obligation to meet the requirements of the Privacy Protection Law and its regulations is designed to ensure protection of personal information collected in databases at various organizations. In this case, we are dealing with particularly sensitive personal information, which included medical information and welfare data about residents, that was exposed to the public, with all that entails."

Be'er added: "An organization that engages with external contractors and allows them access to a database of this type is required to strictly observe the provisions of the law and regulations regarding the regulation of engagement with external contractors serving as custodians of the database. We will continue to enforce the obligations listed in the law and regulations to strengthen protection of public privacy."

Administrative proceedings, opened by the Authority against the external contractor, have not yet concluded.