ILITA – the Israeli Law Information and Technology Authority issued on August 23, a draft guidance on the application of the direct mailing provisions under the Protection of Privacy Act (PPA).

ILITA is a justice department authority and includes the Databases Registrar – the Israeli privacy commissioner. ILITA's guidelines reflect their interpretation of the PPA, but they are not obligatory.

The direct mailing provisions under the PPA are mainly aimed at regulating data brokers and transmission of messages to recipients based on their characteristics. The proposed guidelines wish to end over 20 years of uncertainty over the privacy implications of direct mailing under the law.

Direct Mailing v. Spam

The direct mailing provisions under the PPA are predominantly aimed at regulating personal data service providers (e.g., data brokers) and the use a person's characteristics (e.g. profiling) to send that person messages through any type of communication.

In contrast, the Spam law, which is part of the Communications Law, sets out the terms for sending commercial messages through certain types of media (e.g. email and text messages), and is aimed at preventing the harassment of recipients of such messages.

There is a partial overlap between the laws, and in some cases messages sent to individuals must comply with both.

The Purpose of the Proposed Guidelines

Chapter B of the PPA includes provisions related to the processing of personal information in databases, and the use of personal information for direct mailing. Since its enactment in 1996 as an amendment to the PPA (the PPA itself was enacted 15 years earlier), some of the direct mailing provisions under the PPA remained vague and somewhat inconsistent with other provisions of the law.

The proposed guidelines offer ILITA's view of how the direct mailing provisions should be interpreted and implemented properly.

Main Provisions

The proposed guidelines set-out the following main provisions:

  • Required Consent. If a data base owner (a semi-equivalent to a 'controller' under EU data protection laws) wishes to use or transfer personal information to a third party for the purpose of direct mailing services, data subjects must provide a clear and separate consent to such data use or transfer.
  • General Customer Relations Messages. Messages sent by a company to all of its customers, are not direct mailing messages, and therefore out of the PPA direct mailing provisions' scope.
  • Direct Mailing to Existing Customers. Messages sent by a company to a certain segment of its customers, based on their characteristics, (e.g., age group, history of purchases, etc.), constitute direct mailing. there is no need for a separate consent, but the company must inform its customers of its intentions to send messages, as part of their general contract. Each message must indicate that it is a direct mailing message and a way to inform the company of the customer's wish to stop receiving messages ('unsubscribe').
  • Direct Mailing to Non-Active Customers. Messages sent by a company to a certain segment of past or potential customers, based on their characteristics, (e.g., age group, history of purchases, etc.), constitute direct mailing. Each message must indicate that it is a direct mailing message. The company must further include in each message its name, address, an unsubscribe option, the source of the customer's details, and if applicable – the registration number of the direct mailing services' data base which was the source of the customer's details.
  • Messages Sent by a Direct Mailing Service. In addition to the above requirements, a direct mailing service provider must further include in each message the customer's right to be completely removed from the provider's mailing list.
  • Removal. An individual may require a data base owner to completely remove the individual's details from the data base, if the data base is used for direct mailing purposes only. If the data base is used for other legitimate purposes, the individual may require the data base owner to remove the characteristics which serve for sending that individual direct mailing messages.

Next Steps

ILITA requests comments from the public to the draft guidelines by September 20, this year, and will presumably release the final version of the guidelines by the end of this year.

The draft guidelines are accessible (in Hebrew) on ILITA's website.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.