Fine for privacy violation: Karting company fined 12,000 shekels

The Privacy Protection Authority at the Ministry of Justice imposed today (Wednesday) a financial penalty of 12,000 shekels on the company A.D. Karting Chutzot, following a violation of the Privacy Protection Law. The decision was made after an administrative inquiry procedure was opened following a complaint filed against the company, which provides karting and motorsport services.

According to the findings of the investigation, customers who were asked to register for activities through the company's website were required to enter extensive personal information, including their ID number, full name, date of birth, phone number, city of residence, and even details about their children. However, the company did not present users with a full notice as required by law, which includes, among other things, the purposes of collecting the information, whether there is a legal obligation to provide it, the identity of the database owner, to whom the information will be transferred, and the option to review or correct it.

It was also found that at the time the complaint was filed, a full privacy policy was not available on the company's website, as required. Following the findings, the Authority notified the company of its intention to impose a financial penalty and allowed it to present its arguments before the final decision was made.

The Authority rejected the company's arguments, including the claim that it was a matter of "de minimis" or a "good faith violation." It was determined that even such arguments do not justify refraining from establishing a violation or imposing a fine. It was further noted that the correction of the deficiencies was carried out only after the procedure was opened and not at the company's initiative.

The original penalty considered was 20,000 shekels, but it was reduced to 12,000 shekels due to the lack of previous violations and steps taken to prevent the recurrence of the case.

Advocate Adi Menachem-Beer, Director of the Enforcement Division at the Privacy Protection Authority, emphasized that the duty to notify is not merely a technical requirement, but a fundamental principle intended to allow citizens to make an informed decision regarding the provision of their personal details. According to her, the violation of this duty directly harms the right to privacy and a person's control over information concerning them, and the Authority will act to enforce such offenses with determination.

The Privacy Protection Authority clarified that they will continue to work to enforce the law and provide responses to public inquiries, with the goal of ensuring citizens' rights and protecting their personal information.