Customer data leak and a class action: the cause of action, the route and the remedies

Service page: Class actions and consumer claims lawyer.

A customer database leak is an event in which many people are harmed, each suffering a small damage that is hard to quantify. This is exactly the situation the class action was created for. But the route is not self-evident: the Protection of Privacy Law, 5741-1981 has no express provision that allows a class action, so the cause of action comes in through another door. Here is the legal structure, section by section.

Harmed by a data leak: what can you demand?

How to get through the gateway: section 3 and the Second Schedule

Section 3(a) of the Class Actions Law, 5766-2006 states that a class action may be filed only in a claim listed in the Second Schedule, or in a matter for which an express provision of law states that a class action may be filed. The Protection of Privacy Law has no such provision. So in most cases, a customer data leak is sued under item 1 of the Second Schedule:

The Consumer Protection Law, 5741-1981 defines a “dealer” as anyone who sells an asset or provides a service as a business, including a manufacturer. A company that collected customer details while selling or providing a service is a dealer, and the information given to it is “a matter between it and a customer”. This is why a leak from a commercial website, a retail chain or a service provider falls under item 1. A leak from a body that is not a dealer needs another basis.

The cause of action itself: what exactly was breached

Section 2 of the Protection of Privacy Law lists the acts that are an invasion of privacy. In the context of a leak, three are especially relevant. Paragraph (9): using knowledge of a person’s private affairs, or passing it to another, other than for the purpose for which it was given. Paragraph (7): breach of a duty of confidentiality set by law. And paragraph (8): breach of a duty of confidentiality set by an express or implied agreement, such as a privacy policy that the company itself published. Section 4 states that an invasion of privacy is a civil wrong (tort), to which the provisions of the Torts Ordinance [New Version] apply.

Alongside this stands section 17. Under it, the controller of a database and the holder of a database are each responsible for the data security of the database. This is an independent duty, and its breach is the evidential core of a leak case. What matters is not the break-in itself, but the gap between the measures that were taken and those that were required.

The amounts: section 29A, and the distinction that people miss

Section 29A of the Protection of Privacy Law allows, in a civil claim under section 4, compensation without proof of damage up to an amount the Law states as NIS 50,000. It allows up to double that amount when it is proved that the invasion was done with intent to harm. As in the Prohibition of Defamation Law, 5725-1965, the amount here is also linked. Under section 29A(d), it is updated on the 16th of each month by the consumer price index, with the May 2007 index as the base index. So the cap in force in the update of 16 October 2026 is NIS 72,221.22, and double the amount is NIS 144,442.44. But this is a remedy of an individual claim: section 20(e) of the Class Actions Law forbids awarding exemplary damages or compensation without proof of damage in a class action. In a certification motion in a leak case, damage must be established (financial or non-financial), without relying on section 29A.

Here a distinction is needed that people get wrong again and again. Amendment 13 to the Law added section 15A, which allows exemplary damages (statutory damages) of up to NIS 10,000. But only for a closed list of breaches. These are: not registering a database that must be registered; not giving notice under section 11 or 23D; refusing to allow inspection under sections 13 and 13A; not correcting or not deleting information, and not giving notice of a refusal to correct it; and not notifying the head of the Authority of receiving information on a regular basis under section 23D(c). A data leak in itself is not on this list. If you build a certification motion on section 15A because of a security incident, you are building on a foundation that does not exist.

The reporting duty: what it really says, and when

The duty to report a security incident is not set in the Law but in the Protection of Privacy Regulations (Data Security), 5777-2017. Regulation 11(d) states that in a severe security incident, the controller of the database must notify the Registrar (today: the head of the Privacy Protection Authority) immediately, and must also report on the steps it took. The Registrar has the power to order the controller, after consulting the head of the Israel National Cyber Directorate, to notify the data subject who may be harmed by the incident as well.

A “severe security incident” is defined in regulation 1 according to the security level that applies to the database. In a database at the high security level, it is an incident in which information from the database was used without authorization or beyond it, or in which the integrity of the information was harmed. In a database at the medium security level, it is such an incident concerning a material part of the database. Note: the Regulations have no “72 hours”. The requirement is immediate notice. Since Amendment 13, not giving such notice is exposed to a monetary sanction under section 23Z(h) and item 21 of the Third Schedule to the Law. It is NIS 80,000 for a database at the medium security level and NIS 320,000 for a database at the high security level (base amounts; they are updated on 1 January each year under section 23FF(b), and in 2026 they are NIS 81,890 and NIS 327,560). It is double the amount for a high-level database that holds information on one million people or more.

Amendment 13: what changed from August 2025

Amendment 13 to the Protection of Privacy Law came into force on 14 August 2025 and changed the balance of enforcement. The main points relevant to a leak case: a route of administrative monetary sanctions was set up. Section 23Z(a) gives the head of the Authority the power to impose NIS 150,000 (a base amount; in 2026, NIS 153,540 under section 23FF) for registration and notice breaches, and double the amount when the database includes personal information on one million people or more. A duty to appoint a privacy protection officer was added for certain bodies (sections 17B1–17B3). And the powers of supervision and administrative inquiry were expanded.

Why this matters to a class plaintiff: an administrative proceeding before the Authority creates documentation and findings that can be relied on in the certification motion. And why it matters to a defendant: the same documentation can be used against it. So managing the incident before the Authority and before customers is a legal decision, not only a technical one. For a business that has received a certification motion: the defense against a motion to certify a class action.

Who to sue: the controller, the holder and the supplier

Section 17(a) places responsibility for data security on two parties in parallel: the controller of the database and its holder. In practice, an Israeli company’s customer database often sits with an external supplier, such as a cloud provider, a software house or a service center, and the leak happens there. This does not transfer the responsibility. From the customer’s point of view, the company to which they gave their details remains the controller.

Regulation 15 of the Data Security Regulations governs outsourcing relationships. It requires written terms on the scope of use of the information, the access systems and how supervision is done. The outsourcing document is one of the first documents requested in the proceeding. Sometimes it is the one that decides whether the right defendant is the company, the supplier, or both as joint tortfeasors under the Torts Ordinance [New Version]. In a certification motion, it is worth finding out the chain of holding before filing, and not discovering it in the response.

The certification tests: where cases fail

Section 8(a) of the Class Actions Law sets four cumulative conditions. The claim must raise material questions of fact or law common to all the class members, with a reasonable possibility that they will be decided in the class’s favor. A class action must be the efficient and fair way to decide the dispute. There must be reasonable grounds to assume that the class members’ interests will be represented and managed in an appropriate way. And they must be represented and managed in good faith.

In leak cases, the common question usually exists: the measures the defendant took were the same toward all customers. The difficulty is the damage. For the applicant themselves, section 4(b)(1) makes it easier: it is enough to show that damage was prima facie caused to them. But at the level of the class, it must be shown why the exposure caused damage that can be compensated, and not only inconvenience. Cases built on a precise account of the type of information that leaked (ID numbers, means of payment, medical information) and on actual use made of it stand up better than cases that rely on the incident alone.

The remedies: section 20, and the fund

Section 20 sets how the remedy is awarded. The court may order payment to each class member who proved entitlement, require each member to prove their entitlement, or award monetary compensation in a total amount and set how it is divided. This is on condition that the amount can be calculated precisely on the basis of the evidence. A balance that was not divided is transferred to a fund set up under section 27A, and the court assigns it to a field close to the subject of the claim.

Section 20(c) gives a way out when individual payment is not practical, for example when the people harmed cannot be identified at a reasonable cost. The court may order another remedy in favor of the class or of the public. In leak cases, this is sometimes the real remedy: a change of policy, deletion of excess information, and funding protection against identity theft.

And as for time: section 26 sets a special limitation arrangement. If the class action was certified, all the class members are treated as if they filed a claim on the date the certification motion was filed. If the motion was dismissed or struck out, the limitation period of a class member’s claim will not end before one year has passed from the day the decision became final.

For a business that has had an incident: the first three hours

• Stopping and documenting: cutting off the attack vector, preserving logs, and orderly documentation of the incident as required by regulation 11(a), which requires documentation of every security incident.
• Classification: is this a “severe security incident” according to the security level that applies to the database? The classification decides whether a duty of immediate notice to the Registrar has arisen.
• A decision on notifying customers: the Registrar has the power to order it. But sometimes notifying on your own initiative is the right decision even before an order, both for reasons of trust and to reduce the damage to customers.
• Checking procedures: the security procedure under regulation 4, the risk survey under regulation 5, and the outsourcing arrangements under regulation 15. These are the three documents that will be examined first.

Frequently asked questions

Can you file a class action over a leak of customer data?

Yes, but not directly under the Protection of Privacy Law. Section 3(a) of the Class Actions Law, 5766-2006 allows filing only in a claim listed in the Second Schedule, or in a matter set by an express provision of law, and the Protection of Privacy Law has no such provision. So a leak from a customer database is sued under item 1 of the Second Schedule: a claim against a dealer, as defined in the Consumer Protection Law, in connection with a matter between it and a customer. The substantive cause of action is invasion of privacy under section 2 of the Protection of Privacy Law, and mainly paragraph (9): using knowledge of a person’s private affairs, or passing it to another, other than for the purpose for which it was given. This comes together with breach of the data security duty in section 17.

How much compensation can you get for a data leak?

Section 29A of the Protection of Privacy Law allows, in a civil claim, compensation without proof of damage up to an amount the Law states as NIS 50,000. It allows up to double that amount when it is proved that the invasion of privacy was done with intent to harm. Under section 29A(d), the amounts are updated on the 16th of each month by the consumer price index, with the May 2007 index as the base index. So the cap in force in the update of 16 October 2026 is NIS 72,221.22, and double the amount is NIS 144,442.44. In a class action, compensation without proof of damage is not awarded (section 20(e) of the Class Actions Law), so damage must be proved. How the remedy is awarded and divided is set under section 20. When individual payment is not practical, the court may order a remedy in favor of the class or the public.

How soon must a data leak be reported?

The reporting duty is set in the Protection of Privacy Regulations (Data Security), 5777-2017, not in the Law itself. Regulation 11(d) states that in a severe security incident, the controller of the database must notify the Registrar (today: the head of the Privacy Protection Authority) immediately and report on the steps it took. It also states that the Registrar may order the controller, after consulting the head of the Israel National Cyber Directorate, to notify the data subject who may be harmed as well. A “severe security incident” is defined in regulation 1 according to the security level. In a high-level database, it is any use of the information without authorization, or harm to its integrity. In a medium-level database, it is such an incident when it concerns a material part of the database. The Regulations have no 72-hour deadline.

What changed in Amendment 13 to the Protection of Privacy Law?

Amendment 13 came into force on 14 August 2025. It set up an administrative enforcement route. Section 23Z(a) gives the head of the Privacy Protection Authority the power to impose a monetary sanction of NIS 150,000 for registration and notice breaches. This is a base amount, updated on 1 January each year under section 23FF; in 2026 it is NIS 153,540. It is double the amount when the database includes personal information on one million people or more. Section 23Z(h) and the Third Schedule also set sanctions for breaching the Data Security Regulations, including not reporting a severe security incident. The amendment added a duty to appoint a privacy protection officer in certain bodies under sections 17B1 to 17B3. It expanded the powers of supervision and administrative inquiry. And in section 15A it added exemplary damages of up to NIS 10,000 for a closed list of breaches, which does not include a security incident in itself.

Does the Privacy Protection Authority really impose a monetary sanction for late reporting?

Yes. According to the Privacy Protection Authority’s announcement of 21 July 2026, as checked on 17 October 2026, a monetary sanction of NIS 256,000 was imposed on the Meuhedet health fund. It was for not meeting the duty to report a severe security incident immediately under regulation 11(d) of the Protection of Privacy Regulations (Data Security), 5777-2017. This was the first sanction of its kind since Amendment 13 came into force. According to the same announcement, the fund knew of the incident as early as November 2025 and reported it to the Authority only on 27 January 2026. The Authority stressed that the reporting duty arises when the incident becomes known, and that waiting for the checks to be completed empties the requirement of immediacy of its content.