The EU’s decision to reaffirm Israel’s adequacy status was received by the local privacy community with relief, and with some surprise. The relief is due to the importance of the decision for the local economy, and the negative economic and political implications that would have occurred, had an adverse decision been reached. The moderate surprise is due to the persistent gaps between Israeli data protection law and the GDPR which are quite substantial.

Importance

The adequacy status, first awarded in 2011, is important for both local data-driven businesses, with the Israeli thriving high-tech industry, as well as for traditional, offline businesses, such as tourism, medical services for foreign patients, and education. While Israel is the EU’s 25th largest trade partner, for Israel, the EU is its largest trade partner (alternating in some years with the US).(1) The adequacy status, which streamlines data transfers from the EEA to Israel, is more important for small and medium businesses, as larger businesses have already taken care of themselves by voluntarily adopting GDPR-style data policies and practices. The latter phenomenon was confirmed in a study undertaken by Professor Guy Mundlak and the author, illustrating the de facto Brussels Effect, to borrow Anu Bradford’s term.(2)