On September 16, 2026, Israel's Privacy Protection Authority (PPA) fined the Beit Shemesh Municipality NIS 64,000, according to a JFeed report. A flaw on the municipal website had exposed welfare-department records, including medical information, of about 4,600 residents. A journalist found the flaw and reported it, and the system was shut down. The PPA did not fine the municipality for being breached. It fined the municipality for two governance failures that preceded the breach.
What the PPA actually penalised
According to the same report, the municipality had not listed an external contractor as a data custodian in the welfare database's documentation, even though that contractor had ongoing access for nearly two years. Its protocol for working with outside entities was also deficient. The base penalty was NIS 80,000, or NIS 40,000 per violation. It was cut to NIS 64,000 because the municipality had no similar penalties in the previous five years. Proceedings against the contractor were still open when the report was published. We could not retrieve the PPA's own decision, so these details rest on the news report, which we have not been able to check against the primary text.
The case follows a NIS 256,000 fine, imposed on July 21, 2026, on a health maintenance organisation for failing to report a data security incident promptly, as Pearl Cohen's client update describes it. That update calls it the PPA's first administrative fine for late breach notification and links to the PPA's Hebrew announcement. Both fines rest on powers granted by Amendment 13, which took effect on August 14, 2025.
The case for this kind of enforcement
The strongest argument for fining process failures is that they are what actually predict harm. A contractor missing from the documentation is a contractor nobody audits. Before Amendment 13, fines were only a few thousand shekels, and a regulator that can only punish after leaks happen, and only in token amounts, deters nobody. Municipalities hold sensitive data on welfare recipients, children and patients, and residents have no way to opt out of dealing with them. Globes reported in July 2025 that Amendment 13 lets the PPA investigate, issue warnings, demand guarantees and impose fines without going to court, with penalties of NIS 320,000 per breach for organisations hit by a cyber intrusion caused by non-compliance. Seen this way, a NIS 64,000 penalty is restrained, not draconian.
Why proportionality still matters
A pro-innovation reading accepts that argument and then asks three questions.
- Is the standard knowable in advance? Fining an entity for omitting a processor from a specification document is fair only if the obligation is plain. The PPA published a professional guide to Amendment 13, which is the right instrument. Regulators should keep issuing this kind of guidance before they fine, and should publish the full text of each decision so that others can learn from it.
- Is the penalty scaled to risk and conduct? The reduction for a clean five-year record shows a graduated approach. That discipline matters more than the headline figure. A fine that tracks culpability pushes organisations to disclose problems early. A fine that ignores it pushes them to hide problems.
- Does enforcement reach the real risk? The contractor, the party with the access, is still in proceedings. If enforcement lands mainly on public bodies, which are easy to reach, and lightly on private vendors, the incentives will be skewed.
There is also a cost to small public bodies. Large authorities can afford privacy officers and annual audits. Smaller municipalities, and the startups that sell them software, may find that documentation duties consume the budget that would otherwise go to real security. Amendment 13 already limits database registration mainly to public bodies and large paid-access databases, which is a sensible narrowing of box-ticking. The regulator should keep to that principle by prioritising controls that reduce exposure over forms that merely record it.
What to watch
Two fines in three months, one for late reporting and one for documentation gaps, suggest the PPA is working through the categories of duty in the amended law one at a time. Three things will determine whether this stays proportionate. The first is whether decisions are published in full, with accessible summaries. The second is whether penalties for similar failures stay consistent across public and private defendants. The third is whether the PPA brings its larger per-breach powers to bear only where harm and negligence are clear.
For vendors selling to Israeli public bodies, the practical lesson is simple: be on the data custodian list, in writing, before you get access. For the PPA, the Beit Shemesh case is a good start precisely because the fine is modest and the reasoning is about process. If the regulator keeps penalties tied to demonstrable negligence and keeps its guidance ahead of its enforcement, Israel can raise its privacy standard without turning compliance into a tax on innovation.