The lesser-known side of the recording law: exposure to huge fines for privacy violations

Social networks have been in an uproar in recent days over the new law that requires some businesses to record sales calls when the product value is over 750 NIS. While supporters are happy about the possibility that fraud and the scamming of the elderly will be reduced, opponents argue that the cost will burden businesses and be passed on to the consumer - while at the same time a wave of lawsuits will occur against businesses that do not comply with the law.

The new law, initiated by Knesset members Iman Khatib-Yasin, Merav Cohen, and David Bitan, passed after a long legislative process and with the broad agreement of a series of government ministries and the Small Business Agency. Its goal is to fight the phenomenon of exploiting vulnerable populations and to strengthen the ability of consumers to prove what was said in sales calls in cases where a dispute arises. However, alongside the many advantages, the law involves imposing costs on businesses, regulatory burden regarding information retention under the Privacy Protection Law, and exposes businesses to fines.

Exposure to huge fines

The law, which will come into effect in March 2027, defines the nature of the transactions that must be recorded. For example, the sale of goods (excluding food) requires recording only when it comes to calls initiated to the consumer. Other transactions that must be recorded are mediation for obtaining a loan, locating funds, checking medical rights, checking eligibility for a tax refund (not by an accountant or tax advisor), internet services, credit data improvement, and ongoing transactions for maintenance, medical, and gas supply services. The obligation to record is also imposed in the case of marketing calls initiated by banks, insurance companies and agencies, financial service providers, and pension funds.

The business will be required to provide the consumer, upon request, with the recorded call within 10 business days for free (a fee may be charged for a repeat request). The business representative is required to notify at the beginning of the call that the call is being recorded and that the consumer is entitled to receive the recording of the call. Businesses will need to keep the recording for a period of two years from the day it was made if the transaction was completed, or for a period of 6 months if the transaction was not completed.

Another innovation is the sanction for those who do not record and do not provide the recordings upon request. The Consumer Protection Authority will be able to impose a fine of 26,500 NIS on a corporation, and a fine of 14,750 NIS on an individual. A business that does not record and against which a civil proceeding is opened - the consumer's version will be accepted.

However, the law will also impose obligations on businesses under the Privacy Protection Law. "The Privacy Protection Authority provides guidance on how to use the information collected and protect it. The type of content of the information is relevant to the required method of storage," explains Adv. Amir Zolti, partner and head of the hi-tech department at the Lipa & Co. firm, which specializes in privacy law. "The obligations of holding personal information will apply to businesses - obtaining consent for recording and storage, use for the purpose for which the information was provided, taking the necessary measures for physical and virtual protection of the database, providing the right of access, correction, and deletion to the data subjects, not keeping information beyond the required period, and reporting loss, hacking, or damage."

This means exposure to huge fines. Amendment 13, which came into effect exactly a year ago, dramatically expanded the Authority's supervision and enforcement powers, and gave it the ability to impose heavy financial sanctions totaling hundreds of thousands of NIS. The Authority has begun to exercise its powers, and only recently imposed an unprecedented fine on the Meuhedet HMO in the amount of 256,000 NIS following a delay of about two months in reporting a serious security incident - a systemic failure that allowed insured persons to view sensitive medical information of their relatives.

Burden on small businesses?

The Federation of Israeli Chambers of Commerce claims that the burden on businesses is too heavy, and in their position, regulation should focus on specific areas where failures have been discovered and not become a sweeping obligation. It is argued that the new law will require the implementation of expensive technological protection systems in a way that will economically burden businesses, and that the cost will be passed on to the consumer.

Adv. Roi Cohen, president of Lahav (Chamber of Independent Organizations and Businesses), says that "this is a draconian requirement," and according to him, "it would have been correct to exclude small independent entrepreneurs who will now be forced to bear heavy costs of recording systems and keeping calls for two years. Why is the customer's signature on the price quote and terms not enough? We will demand to amend the legislation."

Adv. Noa Willinger, a partner in the litigation and preventive regulation department at Agmon with Tulchinsky, also agrees that the economic and operational burden of the recording obligation will be felt more among small businesses. "Many companies record calls anyway. For them, the law creates certainty regarding the length of time the recordings must be kept and the possibility of charging for repeat requests to receive them. Small businesses, on the other hand, which until today did not have the infrastructure for recording, secure storage, and quick retrieval of calls, are forced to set up new mechanisms."

According to Nofar Yaakov, chair of the Mortgage Consultants Association and a business owner herself, "the law imposes a blanket decree on independent entrepreneurs and micro-businesses. On one hand, a heavy financial and bureaucratic burden is imposed on us without budgets and IT departments, and on the other hand, we are exposed to draconian legal sanctions. We call on the legislator to come to their senses and make the necessary adjustments, so that consumer protection does not itself become a disproportionate decree on small businesses."

Alongside the criticism, it is important to emphasize that the goals of the law are extremely important - to avoid consumer deception and to fight aggressive marketing calls.

"The benefit outweighs the damage"

Knesset member Merav Cohen, who led the law, rejects the claims of harm to small businesses. According to her, "the law applies only to businesses prone to misconduct. As for the obligations under the Privacy Protection Law - the fact that there are other laws that burden businesses cannot exempt us from the public duty to protect consumers, and in particular vulnerable consumers, from economic exploitation."

According to her, the implications of privacy laws were examined during the legislative process, as were the costs for businesses to implement the law. "It is not for nothing that the Small and Medium Business Agency at the Ministry of Economy did not oppose the proposal," she says. "Regarding the obligations of information security - the significant obligations apply only to databases that more than 10 employees have access to, which does not characterize small businesses. In most cases, it is a marginal cost of recording, storage, and retrieval. If in a minority of extreme cases this also requires some adjustment of information security - this is a completely proportionate cost compared to the huge economic damage that this legislation is intended to prevent."

In the Consumer Protection Authority, they also emphasize that the law applies only where many cases of harm to consumers have been identified. According to legal advisor Adv. Aya Dvir Rajuan, "regarding goods, it is only about telemarketing, and only in a situation where the business calls the consumer. The law applies to many businesses that are already required to record, such as telecommunications companies. Regarding the burden on additional businesses that will have to record - in the overall balance, the benefit outweighs the damage."

According to the regulatory impact assessment conducted by the Consumer Protection Authority in 2017 (which was checked in 2022 and the data remained the same), the costs derived from implementing the recording solution are low and will not harm the revenues of small businesses. Since a large part of businesses record calls even today, the law will not require the purchase of a system but rather its adaptation. It was also written that the law will contribute to competition in the economy, since businesses will compete on quality and price without using unfair practices.

Recording services in large companies reach hundreds of thousands of NIS, but these companies already record anyway. As for small businesses, the cost of purchasing a system is about 700-1,000 NIS, and to this are added costs of maintenance, recording storage, and information security.