Compensation for invasion of privacy: claims and case law

Service page: Defamation lawyer: protecting your reputation.

Someone published a photo of you without permission? Someone gave your address to a marketing company you never asked to hear from? Your medical file was accessed without authorization? This is not just annoying. It may be an invasion of privacy under section 2 of the Protection of Privacy Law, which is a civil wrong (section 4), and when done willfully also an offense (section 5), and you can claim compensation, even without proving that you suffered actual financial damage (section 29A).

What counts as a privacy violation under the law?

Section 2 of the Protection of Privacy Law, 5741-1981, defines a list of infringements. Not every nuisance is a privacy violation; it has to fall into one of these categories:

• Surveillance and photography: spying on or trailing a person in a way that may harass them, or other harassment (2(1)); eavesdropping that is prohibited by law (2(2)); and photographing a person when they are in the private domain (2(3)).
• Disclosing personal information: copying the content of a letter or an electronic message that was not intended for publication, or using its content, without permission (2(5)); breaching a duty of confidentiality set by law or by agreement (2(7)–(8)); and publishing a matter concerning the intimate personal life of a person, including their sexual history, their state of health or their conduct in the private domain (2(11)).
• Commercial use of a name and photo: using a person’s name, nickname, photograph or voice for profit (2(6)).
• Database: wrong information: wrong information in itself is not on the list in section 2, but a person who finds that the information about them in a database is not correct, complete, clear or up to date may ask for it to be corrected or deleted (section 14).
• Passing on information from a database: using information about a person’s private affairs, or passing it to another, other than for the purpose for which it was given (2(9)); and passing on or publishing something obtained through an invasion of privacy (2(10)).
• Using information for another purpose: using information that was given for purpose X for a different purpose Y (2(9)).
• Publishing embarrassing photos: publishing a person’s photograph in public in circumstances in which the publication may humiliate or demean them (2(4)).

Examples from real life (in each, the decision depends on the circumstances): an employer that gave a former employee’s details to a collection company without being required to do so: this may be a privacy violation (2(9)). A friend who posted on WhatsApp a photo you sent them privately: this may be a privacy violation, for example if the publication may humiliate you (2(4)) or concerns your intimate life (2(11)). A website that sold its customer list to a third company: this may be a privacy violation (2(9)).

How much compensation can you claim for invasion of privacy?

You do not have to prove financial damage. The Law allows compensation without proof of damage (“statutory compensation”): the court sets the amount according to the circumstances of the case, up to the cap in section 29A.

• Basic statutory compensation: up to the index-linked cap in section 29A, NIS 72,221.22 per infringement as of the update of 16 October 2026 (the amount stated in the Law is NIS 50,000), without proof of damage.
• Increased compensation, serious circumstances: a person who proves actual damage, such as harm to their reputation (good name), loss of a job or psychological harm, can claim compensation for it under tort law (section 4); and if it was proved that the invasion was committed with intent to harm, the cap on compensation without proof of damage is doubled (section 29A(b)(2)).
• Several infringements: compensation without proof of damage is not given more than once for the same invasion of privacy (section 29A(c)); separate infringements are each examined on their own.
• Exemplary damages for database duties: since Amendment No. 13 (in force from 14 August 2025), the court may award damages that do not depend on harm, up to NIS 10,000, when a controller or a holder of a database breached one of the duties in section 15A(a), for example did not let you inspect the information about you (section 13), or did not notify you that it refuses to correct or delete wrong information (section 14(c)). For some of these causes of action you must first contact the controller or holder and wait 30 or 90 days. Such damages are not awarded more than once for the same act or omission (section 15A(c)).
• Legal costs: if you win, the court will usually also order the defendant to pay legal costs.

In practice: a civil claim for an amount that does not exceed NIS 2,500,000 is heard in the Magistrates’ Court (section 51(a)(2) of the Courts Law [Consolidated Version], 5744-1984). Institutional violations on a wide scale, such as a company that sold a customer database, can justify filing a class action, but as a rule, in a class action compensation without proof of damage is not awarded (section 20(e) of the Class Actions Law, 5766-2006 (חוק תובענות ייצוגיות, התשס״ו-2006)).

What do you have to prove in a claim for invasion of privacy?

A claim has three main elements:

1. There was an invasion of privacy: the invasion is included in the list of sections in the Law (see above).
2. The defendant is responsible: proof that the defendant is the one who committed the invasion, or that responsibility can be attributed to them (for example, an employer is responsible for the acts of its employees).
3. No recognized defense applies: the Law recognizes defenses that permit an invasion of privacy. If the defendant manages to prove one of them, the claim may fail.

Defenses the defendant may raise (section 18):

• Consent of the injured person, express or implied (sections 1 and 3).
• A public interest that justified the invasion in the circumstances of the case, and for a publication, provided that it was not false (section 18(3)).
• An invasion in good faith in fulfilling a legal, moral, social or professional duty (section 18(2)(b)), for example a body that is required by law to provide information.
• A professional duty, such as a doctor’s mandatory reporting.

What is the limitation period for a claim for invasion of privacy?

The limitation period depends on when the invasion took place. Section 26 of the Law, which set a limitation period of two years, was repealed by Amendment No. 13, so an invasion committed from 14 August 2025 is subject to the general limitation period of 7 years (section 5 of the Prescription Law, 5718-1958 (חוק ההתיישנות, התשי״ח-1958)). An invasion committed before that date is still subject to the previous law: two years (section 75 of Amendment No. 13). In other words: if you discovered that someone violated your privacy, it is advisable to act without delay.

How do you actually file a claim for invasion of privacy?

Four practical steps:

1. Document now: screenshots, printouts, recordings, email copies: every piece of evidence you have. Digital evidence disappears. Do this before you do anything else.
2. Consult a lawyer: an assessment of the strength of the case, the realistic amount of the claim, and whether it is worth trying to settle out of court.
3. Demand letter: sometimes a formal legal letter is enough to get the other side to pay and stop, without going to court.
4. Filing a claim: in the Magistrates’ Court, when the amount of the claim does not exceed NIS 2,500,000, or in the District Court above that amount (section 51(a)(2) of the Courts Law). Together with filing the claim, you can ask for a temporary injunction that prohibits the defendant from continuing the invasion.

Filing a complaint with the Privacy Protection Authority

Besides a civil claim, you can file a complaint with the Privacy Protection Authority, a unit in the Ministry of Justice headed by the head of the Authority. The Authority mainly supervises databases: its inspectors may conduct an administrative inquiry (section 23L), and the head of the Authority has the power to order that a violation stop (section 23Y) and to impose monetary sanctions (section 23Z). A complaint is especially relevant against bodies that hold information (companies, employers, service providers), and it can be filed in parallel with the civil claim.