Israel Education Ministry Ruled to Have Violated Privacy Laws in Major Data Leak

The Privacy Protection Authority at the Ministry of Justice announced on Thursday that it has concluded an administrative oversight procedure against the Ministry of Education, ruling that the ministry violated the Privacy Protection Law and data security regulations following a severe data leak involving personal and sensitive medical information of approximately 21,000 special education students from the Haredi sector.

The oversight procedure was launched in March 2025 following media reports indicating that the data had been disseminated online to unauthorized parties. The investigation revealed that in May 2024, ministry employees created a digital form to streamline placements and exported a data file containing identifying details, addresses, religious affiliation, and detailed medical information regarding students' disabilities. The file and form were set with an open link without any protection or password, and were sent to role holders in educational institutions.

The authority ruled that the ministry failed in managing permissions, system management and operation, data encryption, and that it lacked a database definition document, a data security procedure, or a valid risk assessment. Furthermore, the Ministry of Education's claim that its ISO/IEC 27001 international standard certification exempts it from compliance with regulations was rejected. The authority emphasized that this constitutes a severe violation of Section 17 of the Privacy Protection Law, which underscores the obligation of public bodies to protect sensitive information of minors.