On 11 October 2026, Israel's Privacy Protection Authority, headed by Gilad Samama, ordered the Israel Police to conduct an internal investigation into how footage and personal information about Mali and Liel Yahalomi reached the media. The mother and daughter were found on a bus in Argentina on 14 August after a week-long search. Media coverage had drawn on their private correspondence, AI-tool searches, finances and movements.
The Authority said the source was, in at least some cases, the police themselves, apparently contrary to the force's own guidelines. As of this writing it has announced no finding that the Privacy Protection Law was violated. Ynet's report describes the matter as a suspected violation. The facts are unsettled, and this analysis does not assume that any specific leak occurred.
The strongest case for disclosure
Police disclosure in a missing-persons case is not inherently illegitimate. When two people vanish, speed matters. Releasing a photograph, a last known location or a travel route can produce the public tip that ends a search. Investigators also work under pressure from families, and a vacuum of official information can feed speculation that is worse than accurate disclosure. A regulator that second-guessed every release would risk slowing the very cooperation that finds people.
That argument has real force for the first days of a search. It weakens sharply once the question changes from where is this person to what did they write, search for and spend.
Where the justification runs out
The categories reportedly published were private correspondence, AI-tool queries, financial transactions and location history. Those do not help anyone find a missing person who has already been found. Their effect is to expose the inner life of two people, one of them a child of a family at the centre of national attention.
This is the core policy distinction. Data gathered to locate a person is gathered for a narrow purpose. Using it to satisfy public curiosity is a different purpose, and a state that collects sensitive data under urgent circumstances has to treat it as held on trust. The Authority's own framing points the same way. It asked the police inspector to examine the criteria the force weighed, "to the extent they were weighed," before authorising publication. That wording suggests the regulator is not sure any criteria were applied at all.
What the law now allows the regulator to do
Israel rewrote its privacy statute recently. Amendment 13 to the Protection of Privacy Law was put to the Knesset for its second and third readings on 24 July 2024. According to analysis published by the IAPP, it took effect on 14 August 2025 and empowers the Authority to impose monetary sanctions, issue administrative orders and conduct criminal investigations.
The Yahalomi episode therefore arrives at an early test of this regime, and the response so far is notable for what it is not. The Authority has not opened its own enforcement proceeding. It has asked the body whose conduct is in question to examine itself, then report back with findings and lessons learned.
There is a defensible reason for that choice. An internal privacy inspector knows the force's procedures, can trace who accessed what, and can fix processes faster than an outside regulator. Internal review is also cheaper and less adversarial, which fits a proportionate approach to regulation.
Its weakness is structural. An inspector who reports inside the organisation under review has an obvious incentive problem, and a review whose results go only to the regulator may never reach the public. If the police find no wrongdoing, nobody outside can test that conclusion.
What proportionate limits would look like
Pro-innovation, pro-speech positions do not require indifference to state data handling. A free society depends on the public trusting that information given up to the state, or seized by it, will not be used beyond its purpose. Where that trust erodes, people share less with institutions and become more guarded online. That is a cost to the open internet as well as to individual dignity.
A proportionate framework would rest on a few plain rules:
- Purpose limits written down. Police should have a published policy defining which categories of investigative data may be released in missing-persons cases and which may not, with private communications, search histories and financial records presumptively excluded.
- A named decision-maker and an audit trail. Every media release of case material should record who authorised it and on what criterion, so a later review can verify the answer rather than rely on recollection.
- Public reporting of outcomes. The Authority should publish the findings of the inspector's review, redacted as needed, so the process is checkable.
- Escalation if self-review fails. If the review is inconclusive or finds no source, the Authority should use its Amendment 13 powers directly instead of treating the matter as closed.
None of this restricts the press. Journalists publishing what they receive is a separate question, and any remedy should stay aimed at the officials who hold the data. Penalising reporting would be the wrong lesson from this case.
What to watch
Two things will show whether this is a genuine accountability mechanism or a formality. The first is whether the police findings are made public. The second is whether the Authority finds a violation and attaches a consequence, or only draws up recommendations. Until then, the case stands as a reminder that rules on what the state may collect matter only if equally clear rules govern what it may release.