Privacy and a loyalty club: what you may collect under Amendment 13

What Amendment 13 is, in short

Israel's Privacy Protection Law dates from 1981. Amendment No. 13 was published in the official gazette in 2024, and changed large parts of it. For a small business owner with a loyalty club, three changes are important to understand:

• New terms. The law now speaks of a "controller" of a database, the one who decides the purposes of processing the information. A "holder" is an outside party that processes the information on its behalf.
• "Personal information" is defined broadly: any data about an identified person, or a person who can be identified with reasonable effort. A phone number next to a list of visits is personal information.
• Enforcement. The Privacy Protection Authority now has tools such as financial sanctions. That is not a reason to be afraid, but it is a reason to put things in order.

What to tell the customer when you collect

Section 11 of the law says that whoever approaches a person to get personal information from them for storage in a database must attach a notice. By the wording of the section, the notice includes:

1. Whether they have a legal duty to give the information, or whether it depends on their choice, and what will happen if they do not agree.
2. For what purpose the information is requested.
3. Who the controller of the database is, and how to contact them.
4. To whom the information will be given, and for what purposes.
5. That they have a right to see the information about them and to ask to correct it.

For a club this does not need to be a long document. A few clear lines on the join page, and a link to a full privacy policy, cover most of the section. What matters is that the customer sees them before typing the number, not after.

Collect only what you need

Section 8 of the law says that personal information in a database is processed only for the purpose lawfully set for it. In plain words: if the purpose is to count visits and give a reward, there is no reason to ask for a home address.

Every field you add is more information you need to protect, and one more reason for the customer to give up halfway through joining. The question to ask before every field: what do I do with this tomorrow morning?

Be careful with notes

The law defines "information of special sensitivity", which includes, for example, information about a person's state of health. At a beauty salon or laser clinic it is easy to write in a customer's note something like a sensitivity or a medication. If it is truly needed for the treatment, think about where it is right to keep it. A club note is not a medical file.

Use it only for the purpose you stated

Collecting is half the story. The other half is what you do with the list afterwards. Section 2 of the law lists the acts that are an invasion of privacy, and one of them is using knowledge of a person's private affairs, or passing it to someone else, for a purpose other than the one it was given for.

• A customer gave a number to collect visits. That is the purpose. Sending them advertising requires separate consent. The details are in the article on the anti-spam law.
• A neighboring business offers to "swap lists" so you can advertise to each other? That is passing it to someone else, for a purpose the customer never heard of.
• A staff member who leaves takes the list of regulars with them? That is exactly the case where only those who need it should see the full list.

Who owns the list

By the definitions in the law, the "controller" is the one who decides the purposes of the processing, and the "holder" is an outside party that processes the information on its behalf. In a club run through a provider, the business is usually the controller, and the provider is the holder.

This means two things. The list belongs to you, and you need to be able to take it. And the responsibility is yours too: section 17 of the law places responsibility for securing the information on both the controller and the holder.

• In Shortip: your customer list, to a file, at any moment.
• A file you exported is another copy of the information. Keep it in a protected place, and delete it when it is no longer needed.
• Who on your team sees the full list? Only those who need to.

Access, correction and deletion

Section 13 gives every person the right to see the personal information about them held in a database, and access must be possible in Hebrew, Arabic or English. Section 14 lets them ask to correct or delete information that is not correct, complete, clear or up to date. If the controller refuses, it must give notice of that.

In a digital club, most of this is already solved by itself. Every customer has their own page: how many visits, what they received, when the next reward is. They see their information without asking anyone.

When the customer deletes the card

In Shortip the customer is in control: they can delete the card or ask for no advertising. These are two different actions, and it is worth understanding the difference.

What does this mean for you? If you exported the list to a file earlier, this customer is still in it. Do not use an old copy to contact someone who asked to leave.

A checklist for your club

1. The join page has a few lines that explain why you ask for the number, and who is responsible.
2. There is a link to a full privacy policy.
3. You ask only for details that have a use in the club.
4. Consent to advertising is separate from joining.
5. There is no medical or sensitive information in notes, unless it is truly needed and kept properly.
6. One person is responsible for handling a customer's request to see or delete their information.
7. Files you exported are deleted when they are no longer needed.

Frequently asked questions

This article is not legal advice. It summarizes the wording of the law as of its update date. For a question about your business, ask a lawyer.