Following a severe security incident: Beit Shemesh Municipality to pay tens of thousands of shekels

The Privacy Protection Authority imposed a financial sanction of 64,000 shekels on the Beit Shemesh Municipality following a serious information security incident. The personal information of approximately 4,600 residents, including sensitive medical information, was exposed through the municipality's website due to a malfunction by an external provider in the GIS system. The municipality violated regulations by not reporting the provider as a holder of the database.

The Privacy Protection Authority at the Ministry of Justice announced a financial sanction of 64,000 shekels imposed on the Beit Shemesh Municipality, following a serious information security incident. During the incident, personal information of approximately 4,600 city residents was exposed through the municipality's official website, including medical information defined as having special sensitivity. The security incident occurred through the GIS system used by the municipality, due to a malfunction by an external provider. The incident came to light following a journalist's inquiry, and the authority opened an administrative proceeding during which the system was shut down. During the investigation, it was found that the municipality violated privacy protection regulations by not reporting the external provider as a holder of the information database, and also violated the information security procedure by not regulating the purposes of use of the information by the external party, the types of information, the access system, and the duration of the engagement. The municipality argued that the provider was not a "holder" and that the violations stemmed from a "good-faith administrative gap," but the authority rejected these claims, determining that the provider meets the definition due to its continuous access to the information lasting nearly two years. The original sanction stood at 80,000 shekels and was reduced.