Biometric data: legislation and privacy protection

Service page: Digital commerce and AI lawyer: terms, privacy and direct mailing.

What counts as biometric data, and why is it specially protected?

Your fingerprint cannot be changed or replaced. If it is exposed, it cannot be taken back. This is exactly what makes biometric data the most protected category under Israel’s privacy rules. The Protection of Privacy Law, 5741-1981, as amended by Amendment No. 13, defines a “biometric identifier” used for computerized identification, such as a fingerprint, an iris scan, a facial template or a voice, as “information of special sensitivity” (section 3). Genetic information is also in this category. Information in a database may be processed only for the purpose lawfully set for the database (section 8(b)). Regulation 2(c) of the Data Security Regulations requires a check once a year of whether more information is kept than necessary. A breach can lead to a monetary sanction, a civil claim (section 31B) and, in some circumstances, also criminal liability.

When may biometric data be collected, and when is it absolutely prohibited?

The starting point: whoever asks a person for personal information in order to process it in a database must tell the person whether there is a legal duty to provide it, for what purpose it is collected and to whom it will be passed on (section 11). When the collection relies on consent, it must be “informed consent” (section 3). Using information for a purpose other than the one for which it was given is an invasion of privacy (section 2(9)). So it is not possible to get general consent and then use the data for any purpose that comes up. For example, a person who consented to a fingerprint scan to enter a building did not consent to the same scan being used to monitor performance.

The provisions apply to private and public bodies alike. But security authorities, including the police, bear no liability under the Law for an invasion done reasonably within their duties (section 19(b)). Collection of biometric identification means by authorities is regulated by specific laws. A bank or an employer that installs a biometric system should document the notice and the consent, and use the data only for the defined purpose.

Your rights: access, correction and deletion

The Protection of Privacy Law gives every person a right to inspect the personal information about them held in a database, including biometric data (section 13). Under the Inspection Regulations, the inspection must be allowed, as a printout or on screen, within 30 days of receiving the request (regulation 2(a)). If the information is not correct, complete, clear or up to date, you can ask to correct or delete it (section 14). Using information for a purpose other than the one for which it was given is an invasion of privacy (section 2(9)).

Amendment No. 13 to the Protection of Privacy Law, 5784-2024 (in force from 14 August 2025) did not add a general right of deletion. Under the Law and the regulations made under it, a right to demand deletion of information that is no longer needed exists only in a database that holds information transferred to Israel from the European Economic Area. The right covers that information and any other information in the same database (regulations 2–3 of the Protection of Privacy Regulations (Provisions Regarding Information Transferred to Israel from the European Economic Area), 5783-2023 (תקנות הגנת הפרטיות (הוראות לעניין מידע שהועבר לישראל מהאזור הכלכלי האירופי), התשפ״ג-2023)). From a database used for direct mailing, any person may demand in writing that the information about them be deleted (section 17F(b)). Note: do not confuse the provisions of the Israeli Protection of Privacy Law with the European GDPR rules. The rights in Israel exist, but their details are different.

When may the police collect biometric data without consent?

There are legal exceptions that allow enforcement authorities to collect biometric data without prior consent, but always under set conditions:

• Investigation of offenses: a police officer is authorized to take fingerprints and other identification means from a suspect questioned under caution, from a defendant and from a convicted person. The officer may include the identification data in the police database (sections 11B and 11M of the Criminal Procedure (Enforcement Powers – Body Search and Taking of Means of Identification) Law, 5756-1996 (חוק סדר הדין הפלילי (סמכויות אכיפה – חיפוש בגוף ונטילת אמצעי זיהוי), התשנ״ו-1996)). A suspect’s genetic identification data is deleted only at the end of seven years from the taking, or 60 days after the proceeding ended without a conviction, whichever is later (section 11W).
• Border crossings and airports: the Inclusion of Biometric Means of Identification and Biometric Identification Data in Identification Documents and in a Database Law, 5770-2009 (חוק הכללת אמצעי זיהוי ביומטריים ונתוני זיהוי ביומטריים במסמכי זיהוי ובמאגר מידע, התש״ע-2009) authorizes office holders, including Ministry of Interior employees, police officers and aviation security staff, to compare a facial image or a fingerprint with the data in the identification document. As a rule, the data taken for this purpose is deleted right after the comparison (section 6).
• National security: the facial images taken to issue identity cards and passports are kept in a classified biometric database (section 10 of the same Law). Information from it is passed on to the security authorities under set rules (section 21). As a rule, passing it to the police for an investigation requires an order of the District Court (section 17).

Government authorities, not only private companies, are also subject to limits. The assumption that a government authority may collect biometrics freely, as it wishes, is wrong.

Your employer asked for your fingerprint? What it may do and what it may not

An employer that wants to collect biometric data from employees, to enter secure facilities or to record attendance, needs at least: prior notice under section 11 of the Law (the purpose, whether providing the data is mandatory or voluntary, and to whom the information will be passed on); informed consent; and security under the Data Security Regulations. As a rule, a database with biometric data must be at least at the medium security level (the First Schedule to the Regulations sets exceptions, for example for facial images of employees used only to manage the business). Using the biometric data for a purpose other than the one defined is an invasion of privacy (section 2(9)).

In addition, if there is a less intrusive alternative (for example, a magnetic card instead of a fingerprint scan), an employee can argue that the employer was not entitled to impose the biometric solution. The labor courts examine proportionality: is the biometric system necessary, or would less be enough?

How must biometric data be stored and secured? Authorities and businesses that hold biometric data must apply the Protection of Privacy Regulations (Data Security), 5777-2017: a written security procedure, access limited to authorized persons, and encryption when information is transferred over a public network (regulation 14(b)). A severe security incident requires immediate notice to the Privacy Protection Authority. The Authority may order that the people affected be notified (regulation 11(d)). A breach can give them a right to sue.

Asked for your fingerprint? What the notice must include

Under section 11 of the Law, as amended by Amendment No. 13, the request for the information must include:

• whether providing the information is a legal duty or depends on your consent, and what happens if you do not consent (paragraph (1));
• for what purpose the information is requested (paragraph (2));
• the name of the controller of the database and how to contact them (paragraph (2a));
• to whom the information will be passed on, and for what purposes (paragraph (3));
• that you have a right of access and a right to ask for correction of the information (paragraph (4)).

Did you not get such a notice? You can demand it from the controller. If 30 days have passed since the demand without a notice, the court may award exemplary damages of up to NIS 10,000, without proof of damage (section 15A(a)(2)).

Was your privacy invaded? How much compensation can you claim?

A person whose privacy was invaded, for example when biometric data was used for a purpose other than the one for which it was given, can claim compensation under the Protection of Privacy Law. In a claim for a civil wrong under section 4, this is possible even without proof of damage, up to the ceiling in section 29A. Breaching the Law’s provisions on databases, or the regulations made under it, is a civil wrong (tort) (section 31B). Section 15A allows exemplary damages for certain breaches of a database owner’s duties. The amounts awarded vary with how serious and how wide the breach is.

If it is proved that the invasion was done with intent to harm, the ceiling for compensation without proof of damage is doubled (section 29A(b)(2)). The court may also order the payment of legal costs.