The Israeli Privacy Protection Authority (the “PPA”) published a draft position paper regarding international transfers of personal information, in which it recognizes the significant practical difficulties that regulations on international data transfers raise. This publication deals with the interpretation of Regulation 3 of the Privacy Protection Regulations (Transfer of Information to Databases Outside the State's Boards), 5761-2001 (the “Regulations”).

Under the cross-border data transfer regulations, a database owner transferring personal information from Israel to a person or entity in another country must, among other things, bind the foreign data recipient to a written undertaking according to which the recipient will not further transfer the information onward to any other person or entity, whether or not in that jurisdiction.

Recognizing that the regulations practically preclude foreign data recipients from using third-party service providers or sub-processors, the PPA’s position paper explains that Regulation 3 is not in line with developments in technology and international trade relations that have taken place since regulations were promulgated two decades ago.

The PPA’s position paper clarifies that despite textual reading of the regulation, the onward transfer of information from the foreign recipient to a third party will be deemed lawful if the owner of the Israeli database provides its written consent to the onward transfer, and either the data subject themselves consent to the onward transfer as well or another legal basis for the transfer enumerated in the regulation is used.