The translation is intended solely for the convenience of the reader. This translation has no legal status and although every effort has been made to ensure its accuracy, the Bank of Israel does not assume any responsibility whatsoever as to its accuracy and is not bound by its contents. Only the original Hebrew text is binding and the reader is advised to consult the authoritative Hebrew text. Proposed Credit Data Law, 5776-2015 Chapter A: Objective Objective 1. (a) The objective of this law is to establish a general arrangement for sharing credit data, including regulations governing the collection of credit data from the information sources set forth in law, saving them in a central register operated by the Bank of Israel, and transmitting credit data from it to credit bureaus for their processing and transfer to credit providers, among others, while protecting the privacy of the customers to whom the data refer and preventing greater than necessary breaches of privacy, for the following purposes: (1) Enhancing competition in the retail credit market; (2) Expanding access to credit; (3) Reducing of discrimination in the granting of credit and of economic gaps; (4) Creating an anonymous database for use by the Bank of Israel in carrying out its functions. (b) Alongside the general arrangement for sharing credit data set forth in Subsection (a) above, this law is designed to establish an arrangement for the collection, management, and maintenance, in the course of business, of individuals’ credit data solely in their activity as businesses, for the purpose of providing them to another party. Chapter B: Definitions Definitions 2. In this law: ―Credit report‖ - A report containing credit data, as used in Article B of Chapter G,; ―Consolidated data report‖ – A report containing all the information about a customer included in the register, as used in Article D of Chapter G; ―Credit rating‖ – An assessment of the probability that a customer will make the payments that he has undertaken; Unofficial translation—Only the Hebrew version is binding. 1 ―Public infrastructure company‖ – An owner of a license to provide an essential service and an owner of a supply license, as defined in the Electricity Sector Law, 5756-1996,1 and also a company as defined in the Water and Sewage Corporation Law, 5761- 20012 and a local authority supplying water to its residents; ―Bank of Israel Law‖ – The Bank of Israel Law, 5770-2010;3 ―Banking (Licensing) Law‖ – The Banking (Licensing) Law, 5741-1981;4 ―Protection of Privacy Law‖ – The Protection of Privacy Law, 5741-1981;5 ―Companies Law‖ – The Companies Law, 5759-1999;6 ―Penal Law‖ – The Penal Law, 5737-1977;7 ―Creditworthiness assessment – An assessment of whether a customer should be granted credit, or of the level of risk incurred by granting such credit, as used in Section C of Chapter G. ―Customer‖ – An individual who is not a minor, including in his activity as a business; ―Credit bureau‖ – A possessor of a credit data service license; ―Business information bureau‖ – A possessor of a business information service license; ―The register‖ – The credit register established according to Chapter E; ―Identifying information‖ – Information that includes an identifying particular of a customer, or information from which a customer’s identifying particulars have been separated, but the customer to whom the information pertains can be identified with a reasonable effort; ―Nonidentifying information‖ – Information about a customer that is not identifying information; ―Paid authorized representative‖ – One whom the customer has given a power of attorney to receive a consolidated data report about him, and who fulfills one of the following criteria, excluding a credit bureau to which the customer has given such a power of attorney for the purpose of obtaining services based on credit data from that credit bureau, as set forth in Section 13(2): (1) He is paid for obtaining the consolidated data report on behalf of the customer, or for providing services based on such a report; (2) He obtains a consolidated data report on behalf of others in the course of business, or provides service based on such a report in the course of business; 1 Sefer Hahukim 5756, p. 208. Sefer Hahukim 5761, p. 454. 3 Sefer Hahukim 5770, p. 452. 4 Sefer Hahukim 5741, p. 232. 5 Sefer Hahukim 5741, p. 128. 6 Sefer Hahukim 5759, p. 189. 7 Sefer Hahukim 5737, p. 322. Unofficial translation—Only the Hebrew version is binding. 2 2 ―The Supervisor‖ – The supervisor of credit data sharing, appointed under Section 62; ―Debit card issuer‖ - An auxiliary corporation, as defined in the Banking (Licensing) Law, that issues debit cards; ―Authorized source‖ – A credit provider, other than a banking corporation, a debit card issuer, or a public infrastructure company, whose institutional records kept for the purpose of payments are institutional records for which the conditions set forth in Section 36 of the Evidence Ordinance (New Version), 5741-19718 are fulfilled; ―Information source‖ – Any information source obligated to transfer the information to the register, or an entity permitted to transfer information to the register under the provisions of Section 16; ―Credit data user‖ – A credit provider permitted to obtain a credit report from the credit bureau according to Chapter G, Article B, and if the Minister determines, under Section 30, an additional entity permitted to receive such a credit report – and also such an entity; ―The Governor‖ – The Governor of the Bank of Israel appointed under Section 6 of the Bank of Israel Law; ―Officeholder‖ – As defined in the Companies Law; ―Credit provider‖ – Anyone providing credit in the framework of a credit transaction in the course of business, and anyone mediating in the course of business in credit transactions between lenders and borrowers of the type defined by the Minister; ―Credit data‖ – Data, as detailed below, about the customer, including identifying particulars about him, as defined by the Minister according to Section 100, and which are required for the purpose of assessing the probability that the customer will make the payments that he has undertaken; (1) Data about payments undertaken and actually made by the customer, including the terms of the undertaking, and legal orders or restrictions imposed on the customer in respect of non-payment; (2) Data concerning requests by the customer for credit, including requests submitted by a credit bureau to the Bank of Israel in accordance with Section 7, for credit data from the register; (3) Data concerning the volume of credit that the customer is permitted to take; (4) Data concerning the types and characteristics of the customer’s bank accounts, and the existence of related accounts; ―Business‖ – As defined in the Protection of Privacy Law, 5741-1981;9 ―Credit transaction‖ – Includes the provision of credit in the sale of an asset or providing a service, except for marketing of a credit transaction; 8 9 Laws of the State of Israel, New Version 18, p. 421. Sefer Hahukim 5741, p. 248. Unofficial translation—Only the Hebrew version is binding. 3 ―Identifying particular‖ – First name, last name, ID number, and any other information that can lead, directly or indirectly, to the identification of a specific customer; ―Business information service license‖ – A license to operate a business information service, granted according to Chapter J; ―Credit data service license‖ – A license to operate a credit data service, granted according to Chapter D; ―Credit data-based service‖ – One of the services listed in Section 13; ―Business information service‖ – Collection, management, and maintenance of credit data about a customer exclusively for his activity as a business , for the purpose of communicating them to another party, in the course of business; ―Credit data service‖ – Obtaining and holding credit data contained in the register from the Bank of Israel for the purpose of communicating them to another party, or for the purpose of providing a creditworthiness assessment to another party, in the course of business; ―Control‖ – As defined in the Securities Law, 5728-1968,10 and every term in this definition shall be interpreted according to said law; ―The Minister‖ – The Minister of Justice; ―Banking corporation‖ – As defined in the Banking (Licensing) Law. Chapter C – General Provisions 3. Collecting, maintaining, and c credit data by the Bank of Israel The Bank of Israel shall collect credit data from the information sources, retain the data in a database, and transmit them to credit bureaus and customers, all for the objectives of this law and the uses stipulated in it, according to its provisions. 4. A prohibition on collecting, retaining, and transmitting credit data by anyone other than the Bank of Israel (a) No one other than the Bank of Israel shall collect credit data, retain data that he has collected for the purpose of disclosing them to another party, or transmit them to another party in the course of business. (b) Notwithstanding the provisions of subsection (a) above: (1) A credit bureau is entitled to operate a credit data service; (2) A business information bureau is entitled to operate a business information service. 5. Operating a credit data service No one shall operate a credit data service other than a credit bureau, and only in accordance with the terms of the license granted to him. 10 4 Sefer Hahukim 5728, p. 234. Unofficial translation—Only the Hebrew version is binding. 6. Operating a business information service No one shall operate a business information service other than a business information bureau, and only in accordance with the terms of the license granted to him. Chapter D: Credit Data Service Licensing 7. A credit data service license (a) The Supervisor is authorized to grant a credit data service license (in this chapter – a license) to a party requesting one who fulfills all of the following conditions: (1) The party making the request is a company, as defined in the Companies Law; (2) The party making the request is not a controlling interest in a user of the credit data or in a paid authorized representative, and is not controlled by such a user or said authorized representative or by a controlling interest in such user or said authorized representative; (3) The party making the request has registered the database as a database according to the Protection of Privacy Law; (4) The party making the request has provided a guarantee according to the provisions of Section 8; (5) Neither the party making the request, nor a controlling interest or officeholder of the entity making the request, have been convicted of an offense, the substance, severity, or circumstances of which renders them unworthy of receiving a license, and no indictment for such an offense has been filed against any of the above parties for which a final verdict has not yet been rendered. (b) If the Supervisor has reasonable grounds for assuming that the party requesting the license will use the information he obtains for purposes not in the law, or will not meet the requirements under this law, he is authorized to refrain from granting him a license. (c) The Governor shall establish regulations regarding how a request for a license is to be submitted in accordance with this paragraph, the particulars to be included in it, and the documents to be attached to it. 8. A guarantee (a) As a condition for granting the license, the Supervisor shall require the party requesting the license to deposit a guarantee with the Supervisor of the required amount, taking into account the volume of the business. The Governor is authorized to set regulations in this matter, include the type of guarantee, how the amount is determined, how it is deposited, its purposes, the conditions under which it can be realized, and how it is to be realized. (b) If the Supervisor becomes aware that the circumstances have changed in a way requiring a change in the guarantee, he is authorized to order a change in it. 9. Reporting changes to the Supervisor Unofficial translation—Only the Hebrew version is binding. 5 If a change occurs in any of the particulars provided to the Supervisor by the party requesting the license as part of his request, or in the documents attached to it, the party shall report this to the Supervisor as soon as possible, and no later than 10 days from the day he becomes aware of the change, and shall attach the documents pertaining to the matter. 10. Conditions in the license The Supervisor is authorized to set conditions and restrictions in the license for the purpose of guaranteeing the activity of a credit bureau in accordance with the provisions under this law, including requirements pertaining to information security. 11. Cancellation or suspension of a license (a) The Supervisor is authorized to cancel or suspend a license if he finds that one of the following conditions holds: (1) The license was granted on the basis of fraudulent or erroneous information; (2) Any of the conditions for granting the license is no longer fulfilled; (3) The credit bureau has violated any of the provisions under this law, or any of the Supervisor’s instructions, or any of the license conditions; (4) The credit bureau did not begin to operate a credit data service within two years of the date on which the license was granted, or discontinued the operation of the service during such a period; (5) The credit bureau has decided on voluntary liquidation, or the Court has appointed a receiver or ordered its liquidation; (6) There are valid grounds for concluding that the public good justifies cancellation or suspension of the license. (b) The Supervisor shall give the Registrar, as defined in Section 7 of the Protection of Privacy Law, notice that the license has been canceled or suspended, and shall publish an announcement of it to the public in a manner to be determined by the Governor. 12. Operating a credit data service and the designation of the business. (a) As part of its operation of a credit data services, a credit bureau is permitted to engage in the following activities: (1) To obtain credit data included in the register from the Bank of Israel, and to store them for the purpose of writing a credit report or a creditworthiness assessment for another party, and in order to deliver the report or assessment to another party; (2) To obtain a consolidated data report from the Bank of Israel for the purpose of delivering it to a customer or a paid authorized representative, and to deliver it to him. Unofficial translation—Only the Hebrew version is binding. 6 (b) A credit bureau shall not engage in any business that is not such a credit data service, as set forth in subsection (a), without having received permission for it from the Supervisor. (c) The Supervisor shall not provide the authorization mentioned in subsection (b) unless he is convinced that the additional, requested business will not detract from the objectives of this law, or from the proper conduct of a credit data service, or from the interests of the users of credit data or those of the customers. (d) The provisions of this Section shall not apply to the following activities by a credit bureau: (1) Providing credit data-based services; (2) Operating a business information service if the credit bureau has obtained a business information service license, and providing any service based on information obtained in the framework of such activity. 13. Credit data-based services In addition to operating a credit data service, as described in Paragraph 12, a credit bureau is entitled to provide the following services: (1) Services as listed below for a credit provider, based on credit data obtained from the register for the purpose of issuing a credit report: (a) A customer’s credit rating; (b) Notice of a change in the credit rating of a customer, or in the credit data about him included in the register; (c) Advice in these matters: (1) A credit transaction agreement with a customer and the terms of the transaction; (2) The viability of instituting collection measures for a customer who is late in making payments he has undertaken; (3) The level of risk incurred in the aggregate credit granted by a credit provider to all his customers, or to some of them; (2) Services as listed below for a customer, based on a consolidated data report: (a) The customer’s credit rating; (b) Advice concerning improvement of the customer’s credit rating; (c) Notice of a change in the credit rating of the customer, or in the credit data about him included in the register. Chapter E: Establishing a Credit Register and its Purposes 14. Setting up the credit register and its purposes (a) The Bank of Israel shall establish a register that will include credit data obtained from information sources according to the provisions of Chapter F. The register shall Unofficial translation—Only the Hebrew version is binding. 7 also include information on requests to correct information, submitted under Chapter H as well as data about customer queries for the register according to the law. (b) The register shall be used exclusively for the following purposes: (1) Delivering credit information to credit bureaus about a specific customer for the purpose of preparing a credit report or creditworthiness assessment report about that customer, in accordance with the provisions of Chapter G, Articles B and C, or for the purpose of delivering these reports to a paid authorized representative in accordance with the provisions of Chapter G, Article E; (2) Delivering to the customer information about him, in accordance with the provisions of Chapter G, Article D; (3) Establishing an anonymous database for use by the Bank of Israel in carrying out its functions under the Bank of Israel Law, in accordance with the provisions of Section 42; (4) Establishing an anonymous database for use by the credit bureaus in developing statistical models needed in order to provide services based on credit data, in accordance with the provisions of Section 43. (c) The technological system used for the register shall minimize, to the greatest extent possible, with due consideration of the acceptable available alternatives, the risk of breaches of customers’ privacy and the risk of breaches of information security in the register. The system shall be designed in consultation with the Registrar, as defined in Section 7 of the Protection of Privacy Law. 15. Register manager The register shall be managed by a Bank of Israel employee, to be appointed by the Governor (hereafter – the register manager). Chapter F: Transferring Information to the Register and Maintaining It 16. Transferring credit data to the register by the information sources (a) The information sources listed below shall transfer credit data to the register for the purpose of their inclusion in the register: (1) The official receiver; (2) The Execution Office; (3) The Bank of Israel; (4) A Court (5) A public infrastructure company; (6) A banking corporation; Unofficial translation—Only the Hebrew version is binding. 8 (7) A debit or credit card issuer. (b) The credit data transferred by the information sources under subsection (a) shall be of the type determined by the Minister, with the consent of the Governor and the Minister of Finance, subject to the following provisions: (1) The credit data transferred by the Bank of Israel shall be data concerning the customer being a restricted or severely restricted customer according to the meaning of those terms in the Checks without Cover Law, 57411981;11 (2) The credit data transferred by the Court shall be data concerning a restriction order issued under Section 7 of the Companies Law; (3) The data transferred by a public infrastructure company shall be data concerning payments for electricity or water consumption. (c) Notwithstanding the provisions of subsections (a) and (b), the Minister is authorized, with the consent of the Governor and the Minister of Finance, to decide that one of the information sources listed in subsection (a) that fulfills the conditions to be determined shall not be required to transfer credit data to the register. (d) An authorized source is permitted to transfer to the register credit data of the type determined by the Minister, with the consent of the Governor and the Minister of Finance, and the Minister is authorized, in consultation with the Minister of Finance, if he has found that it is necessary to achieve the objectives of this law, to allow additional information sources to transfer credit data of the type determined to the register. (e) Notwithstanding the provisions of subsection (d), the Minister is authorized to determined that one of the information sources listed in that subsection is obligated to transfer credit data to the register, as stated in that subsection, and the Governor is authorized, in consultation with the Minister, to determine that a source of such information whose volume of credit granted to customers exceeds a sum to be determined is obligated to transfer such credit data. (f) An information source shall employ all reasonable measures to ensure the accuracy and reliability of the credit data that he transfers to the register under this paragraph. The Supervisor is authorized to order that specific means be taken to ensure such accuracy and reliability. (g) The Supervisor shall stipulate the method for transferring credit data to the register under this paragraph and the date for their transfer, and is authorized to issue detailed instructions for the credit data to be transferred, subject to the types of credit data stipulated by the Minister under subsections (b) and (d). 17. Restrictions on the transfer of credit data to the register The Supervisor is authorized to prohibit or restrict the transfer of credit data to the register by an information source if he believes that it is necessary in order to fulfill 11 9 Sefer Hahukim 5741, p. 136. Unofficial translation—Only the Hebrew version is binding. the objectives of this law, and if exceptional circumstances stipulated by him are fulfilled. 18. Retaining credit data in the register (a) The Bank of Israel shall retain the credit data that were transferred to the register by an information source according to Section 16. (b) Notwithstanding the provisions of Subsection (a), the Bank of Israel is authorized not to retain the credit data transferred from a given information source in the register, if it finds that the information source of has not taken reasonable measures to ensure the accuracy and reliability of the credit data in accordance with the provisions of Subsection 16(f), or has not taken information security measures in accordance with the provisions of Section 57, or if other exceptional circumstances stipulated by the Supervisor occur. 19. A customer request to omit his credit data from the register (a) A customer is entitled to request from the Bank of Israel that credit data about him be omitted from the register (in this section – an opt-out request). (b) If a customer has submitted an opt-out request, the Bank of Israel shall not retain credit data about him for delivery to the register after the date on which the request was submitted, and shall delete from the register the customer’s identifying particulars included in the credit data about him in the register on the date the request was submitted, except for such identifying particulars included in the credit data delivered to a credit bureau according to Chapter G before that date, which shall be retained in the register solely for documentation purposes. Identifying particulars according to this subsection shall be deleted, so that it will no longer be possible to link the credit data from which the identifying particulars have been deleted to the customer. (c) If the customer withdraws the opt-out request from the Bank of Israel, the Bank of Israel shall retain the customer’s credit data that is transferred to the register after the date on which the request was withdrawn. (d) If a credit bureau asks the Bank of Israel for credit data from the register about a specific customer, and there are no credit data about the customer in the register because the customer has submitted an opt-out request, the Bank of Israel shall notify the credit bureau of this, and the credit bureau shall inform the user of the credit data of it. (e) Notwithstanding the provisions of Subsections (a) and (b): (1) If an information source transfers to the register legally published credit data or other credit data, determined by the Minister with the Governor’s consent, clearly showing that the customer was not making the payments he had undertaken (in this subsection – nonpayment data), the customer shall not be permitted to submit an opt-out request until five years after the date on which said data were transferred (in this subsection – the restriction period); Unofficial translation—Only the Hebrew version is binding. 10 (2) If an information source transferred to the register data concerning non-payment after the customer submitted an opt-out request, the Bank of Israel retain store in the register all the credit data about the customer sent to the register from the date of their transfer onward, despite the request. At the end of the restriction period, the customer shall be entitled to resubmit an optout request. (f) If the provisions of Subsection (e) apply to a customer, the Bank of Israel shall inform the customer of this, and at the end of the restriction period shall notify the customer of his right to resubmit an opt-out request. (g) Customer requests under this section shall be submitted as stipulated by the Governor. 20. Period for keeping information in the register (a) The Bank of Israel shall retain the information that is in the register described in Section 14(a) for a period of 12 years from the date on which it was transferred to the register. Five years after said date, the information shall be stored for the remainder of the period solely for documentation purposes (in this section – the documentation period) (b) During the 12-year period noted in subsection (a), a credit bureau, credit data user, or a paid authorized representative shall be permitted to obtain from the Bank of Israel the data retained in the register previously disclosed to them, as set forth in Chapter G, Sections B–E, provided that these data are required for a legal proceeding, oversight, or supervision, or other needs stipulated by the Minister. Nothing in this subsection shall derogate from the customer’s right to receive these data, as set forth in Article D of Chapter G. (c) At the end of the documentation period, the Bank of Israel shall delete from the register the customer’s identifying particulars pertaining to the information for which the above-mentioned period has expired, so that it will no longer be possible to link this information to the customer. Chapter G: Access to Information in the Register and the Uses of the Information Article A: General Regulations 21. Disclosing information from the register No information from the register shall be disclosed, and no access to such information shall be provided, other than to the parties listed in this section, for the use listed in it, and in accordance with its provisions. 22. Designation of the use (a) A party that has obtained credit data contained in the register in accordance with the provisions of this chapter shall use them solely for the purpose for which they were requested. (b) Notwithstanding the provisions of Subsection (a), a credit bureau is also entitled to use credit data it has obtained for the purpose of preparing a credit report in order to provide services based on credit data. Unofficial translation—Only the Hebrew version is binding. 11 Article B: Credit Report 23. A credit provider’s request for a credit report from a credit bureau A credit provider is permitted to request from a credit bureau, a credit report on a customer containing credit data about that customer included in the register for the purpose of contracting a credit transaction with that customer, for the purpose of ensuring the fulfillment of the terms of a transaction, and for the purpose of determining the level of risk incurred from the aggregate credit granted its customers, or to some of them, provided that the conditions for transferring data for the purpose of a credit report, according to the meaning of these conditions in Section 26, are fulfilled. 24. A credit bureau’s request for credit data from the register for the purpose of a credit report If a request for a credit report about a customer has been submitted to a credit bureau, as stipulated in Section 23, and the credit bureau believes that the conditions for transferring data for the purpose of a credit report, according to the meaning of these conditions in Section 26, are fulfilled, the credit bureau is entitled to request credit data included in the register about that customer from the Bank of Israel. 25. Disclosing credit data from the register for the purpose of a credit report If the Bank of Israel is convinced that the conditions for transferring data for the purpose of a credit report, according to the meaning of these conditions in Section 26, are fulfilled, it shall disclose to the credit bureau credit data included in the register about the customer, according to the credit bureau’s request submitted in accordance with Section 24. 26. Conditions for transferring credit data for the purpose of a credit report (a) No credit data from the register about a customer under the provisions of this paragraph shall be transferred to a credit bureau, or from a credit bureau to a credit provider, unless all of the following conditions are fulfilled (in this paragraph – the conditions for transferring data for the purpose of a credit report): (1) The credit provider needs the credit data for the purpose of contracting a credit transaction with that customer in order to ensure the fulfillment of the transaction terms, or in order to determine the level of risk incurred from the aggregate credit granted to all of its customers, or to some of them; (2) The credit provider is an information source transferring credit data to the register under Chapter F, or has undertaken to transfer, as ordered by the Supervisor, such credit data; (3) The credit provider is not a low-risk credit provider; for this matter, ―low-risk credit provider‖ means a business providing credit as a result of the sale of an asset or providing a service for short periods, or for small sums, as ruled by the Minister; Unofficial translation—Only the Hebrew version is binding. 12 (4) The customer has consented to the disclosure of the credit data about him that is in the register, to a credit bureau, for the purpose of preparing a credit report, and to the credit report being disclosed to the credit provider. Such consent by a customer shall be given only for a specific credit transaction, and shall be valid no later than the end of the expiry date for the credit transaction. (b) Notwithstanding the provisions of Subsection (a)(2), the Minister is authorized to rule, with the Governor’s consent, that a credit provider of a type to be determined shall be entitled to request a credit report from the credit bureau, even though it does not transfer, or undertake to transfer, credit data to the register. (c) The Minister is authorized to issue regulations concerning the manner in which a customer grants consent, as stated in Subsection (a)(4), and concerning how the fulfillment of the conditions for transferring data for the purpose of a credit report is to be proven. 27. A customer request for non-disclosure of credit data about him in the register (a) A customer is entitled to request the non-disclosure of credit data about him that is included in the register for the purpose of preparing a credit report under the provisions of this section (in this subsection – an opt-out request). The Minister is authorized to rule that an opt-out request may be submitted for certain credit providers, and is authorized to establish conditions for such a request. (b) If a customer has submitted an opt-out request, the Bank of Israel shall not disclose credit data in accordance with the request, as long as the customer has not retracted it by asking the Bank of Israel to disclose credit data about him, and even if the credit provider has obtained the customer’s consent, as stated in Section 26(a)(4). (c) If a credit bureau has asked the Bank of Israel for credit data from the register about a specific customer, and the customer has submitted an opt-out request, the Bank of Israel shall notify the credit bureau of the request, and the credit bureau shall notify the credit provider of it. (d) Requests under this paragraph shall be submitted in a manner to be determined by the Governor. 28. Regulations governing disclosure of credit data from the register The Minister is authorized to issue regulations concerning the disclosure of credit data from the register for the purpose of a credit report under this section, and, among other things, is authorized to set conditions for such disclosure. 29. A credit provider refusing to contract a credit transaction or imposing stricter terms for it, due to a credit report (a) A credit provider who has received a credit report, and on the basis of the report has refused to contract a credit transaction, or has imposed stricter terms for a contracted credit transaction, shall immediately notify the customer of this, and shall disclose to him the credit report, the customer’s credit rating (insofar as it has been given to him), and additional particulars as ordered by the Supervisor. Unofficial translation—Only the Hebrew version is binding. 13 (b) The Minister is authorized to determine additional circumstances in which the provisions of Subsection (a) shall apply to a credit provider. 30. A credit report for a party that is not a credit provider The Minister is authorized, with the Governor’s consent, if he finds it necessary to achieve the purposes of this law, to determine what entities that are not credit providers are permitted to receive a credit report from a credit bureau, under conditions determined by the Minister, provided that the customer has given his consent, as stated in Section 26(a)(4). If the Minister has so determined, the same provisions applying to a credit provider permitted to receive a credit report shall apply to the entities stipulated in the Minister’s instructions, with the necessary changes and changes to be determined by the Minister. Article C: Creditworthiness Assessment 31. A credit provider’s request for a creditworthiness assessment from the credit bureau A credit provider is entitled to ask a credit bureau for an assessment on the question of whether to provide credit to a customer, or an assessment of the level of risk incurred in providing such credit (in this section – a creditworthiness assessment), provided that it informs the customer of its intention to obtain such an assessment, and that a request will be submitted to the Bank of Israel for the credit data about him included in the register for the purpose of obtaining the assessment. 32. A credit bureau’s request for credit data from the register for the purpose of issuing a creditworthiness assessment If a request for a creditworthiness assessment about a customer has been submitted to a credit bureau, as set forth in Section 31, the credit bureau is entitled to ask the Bank of Israel for credit data about that customer included in the register for the purpose of providing the creditworthiness assessment. 33. Disclosing credit data from the register for the purpose of a creditworthiness assessment (a) If a request has been submitted under Section 32 by a credit bureau to the Bank of Israel for credit data from the register for the purpose of a creditworthiness assessment, and the Bank of Israel has found that the credit data about that customer included in the register clearly indicate that the customer is not making the payments that he has undertaken, the Bank of Israel shall disclose the credit data about the customer included in the register to the credit bureau. In this matter, the Minister shall determine, with the Governor’s consent, circumstances that clearly indicate that the customer is not making the payments that he has undertaken. (b) If there are no credit data in the register clearly indicating that the customer is not making the payments he has undertaken, as set forth in Subsection (a), the Bank of Israel shall so notify the credit bureau, and the credit bureau shall inform the credit provider of this. Nothing in the provisions of this subsection shall derogate from the obligation to provide notice under Section 19(d). 34. Attaching published credit data to a creditworthiness assessment Unofficial translation—Only the Hebrew version is binding. 14 Together with the creditworthiness assessment, a credit bureau is entitled to disclose to a credit provider credit data about the customer that have been published in compliance with the law. 35. Providing an assessment to a public infrastructure company in terms of using collection measures (a) If a customer is in payment arrears to a public infrastructure company for consumption of electricity or water, as determined by the Minister, the company is entitled to ask a credit bureau for an assessment of whether to use collection measures with respect to that customer, provided that it has notified the customer of its intention to obtain an assessment, and that for the purpose of obtaining the assessment, a request for credit data included in the register about the customer will be submitted to the Bank of Israel. (b) The provisions of this Article applying to a creditworthiness assessment shall apply to an assessment under Subsection (a), with the necessary changes. (c) The provisions of this Section shall not apply to a public infrastructure company that does not transfer credit data to the register on account of the provisions of Sections 16(c) or 17. Article D: Consolidated Data Report Requested by a Customer 36. Providing a consolidated data report to a customer (a) A customer is permitted to receive a report from the Bank of Israel containing all the information about him included in the register (in this section – a consolidated data report) (b) A consolidated data report shall be delivered to the customer free of charge upon request, once a year. (c) The Bank of Israel is authorized to transmit to a customer, upon request, information about him included in the register in a framework other than a consolidated data report, or to deliver a consolidated data report to him more frequently than stipulated in Subsection (b) in exchange for payment to be determined by the Governor. 37. Obtaining a consolidated data report through a credit bureau A credit bureau is permitted, at the customer’s request, to receive a consolidated data report about said customer from the Bank of Israel. Article E: Consolidated Data Report Requested by a Paid Authorized Representative 38. Providing a consolidated data report to a paid legal representative A paid authorized representative is not entitled to receive a consolidated data report from the Bank of Israel about the customer whom he represents, other than through a credit bureau, and in accordance with the provisions of this section. 39. A request by a paid authorized representative to a credit bureau for a consolidated data report from the register Unofficial translation—Only the Hebrew version is binding. 15 If a paid authorized representative requests a consolidated data report about a customer from a credit bureau, the credit bureau is entitled to request such a consolidated data report from the Bank of Israel, provided that the credit bureau believes that the conditions concerning the legal representative determined by the Governor under Section 41 and the conditions ordered by the Supervisor for the purpose of obtaining the report from the register (in this subsection – the conditions for transferring a consolidated data report) are fulfilled. 40. Delivering a consolidated data report to a paid authorized representative through a credit bureau If the Bank of Israel believes that the conditions for providing a consolidated data report to a paid authorized representative are fulfilled, it shall provide a consolidated data report about the customer to the credit bureau according to the credit bureau’s request under Section 39. Delivery of the report shall be in accordance with the regulations issued by the Supervisor in this matter. 41. Conditions for transferring a consolidated data report The Governor is authorized, with the consent of the Minister, to set conditions that the legal representative must meet in order to obtain a consolidated data report about the customer, including the ways that the legal representative is entitled to use the credit data from the register and the period of time during which he may retain these data. Article F: Access to and Uses of Nonidentifying Information in the Register 42. Use of nonidentifying information by the Bank of Israel (a) The Bank of Israel is authorized to use nonidentifying information included in the register for the purpose of carrying out its functions under the Bank of Israel Law. (b) The Bank of Israel is authorized to transfer identifying information about customers that it possesses under its legal authority (in this subsection – external information) to the register for the purpose of cross-checking it with identified information included in the register and producing nonidentifying information necessary for the purpose of carrying out its functions under the Bank of Israel Law, provided that the external information is deleted from the register immediately after the nonidentifying information is produced. The cross-checking of the information referred to in this subsection shall be performed so as to avoid the exposure of identified information within the Bank of Israel to the greatest degree possible. 43. Access by a credit bureau to nonidentifying information in the register (a) The Bank of Israel is authorized to provide a credit bureau with access to nonidentifying information included in the register for the purpose of developing a statistical model required by the bureau in order to provide credit data-based services. (b) A credit bureau shall not copy or store nonidentifying information to which it has access under Subsection (a). The Minister, with the Governor’s consent, is Unofficial translation—Only the Hebrew version is binding. 16 authorized to determine circumstances under which a credit bureau is entitled to copy and store some of this nonidentifying information, in a manner and under conditions to be determined, as may be required for the purpose of devising a statistical model referred to in Subsection 43(a). Article G: Various Regulations Concerning Disclosure and Use 44. Identifying information about information sources The Bank of Israel shall not include in the credit data from the register that it discloses to a credit bureau under this section, for the purposes of preparing a credit report or a creditworthiness assessment, identifying particulars about the information source, other than the information sources listed in Sections 16(a)(1) through 16(a)(5). The Minister is authorized to determine additional particulars that should not be included in the disclosed credit data. 45. The period for which credit data will be disclosed (a) At the request of a credit bureau submitted in accordance with the provisions of Sections (b) or (c), the Bank of Israel shall deliver to a credit bureau for the purpose of preparing a credit report or a creditworthiness assessment only credit data whose date of inclusion in the register was during the five years preceding the date on which the credit bureau submitted the request. (b) The Minister is authorized to determine shorter periods than the period in Subsection (a) for types of credit data to be determined. 46. Methods of transmitting the information possessed by the Bank of Israel The Supervisor is authorized to stipulate methods of transmitting the information included in the register by the Bank of Israel according to this section, subject to the regulations issued under Section 28, including ordering that the information be transmitted by providing access to the register in a manner and under conditions to be stipulated. 47. The period for retaining credit data by a credit bureau and an authorized representative (a) A credit bureau that has obtained credit data from the register according to this section shall keep them for the minimum period required for the purpose of providing a credit data service or a service based on credit data, but no longer than the period stipulated by the Minister. (b) The Minister is authorized to determine the maximum period for keeping credit data by a paid authorized representative. 48. Maximum price that a credit bureau is entitled to charge The Governor is authorized to determine the maximum sum to be charged by a credit bureau for delivering a credit report, creditworthiness assessment, and consolidated data report in accordance with the provision of this chapter. If the Governor has set such a sum, a credit bureau shall not charge a sum in excess of the maximum sum set. 49. Data that should not be taken into account in a credit rating Unofficial translation—Only the Hebrew version is binding. 17 For the purpose of a customer’s credit rating, a credit bureau shall not take into account data concerning the customer’s gender, age, sexual orientation, race, religion, country of origin, nationality, or place of residence. 50. Retention of a credit report by a credit provider A credit provider is entitled to keep a credit report until the end of the period of the credit transaction with the customer with respect to whom the report was requested. If the report was requested for the purpose of a decision about contracting a credit transaction, and the transaction was not contracted, the credit provider shall delete the credit report within a period that does not exceed the period determined by the Minister. 51. Restriction on transferring credit data The Supervisor is authorized to prohibit or restrict disclosure of credit data included in the register to a credit bureau under this section, and to prohibit or restrict transferring credit data obtained by a credit bureau under this section to a user of credit data or to a paid authorized representative, if he believes that this is necessary for the purpose of complying with the purposes of this law, and under specific circumstances to be determined. Chapter H: Correction of Information Included in the Register 52. Correction of information by the information source If an information source discovers that credit data about a customer that it has transferred to the register are incomplete or inaccurate, or that a change has occurred in them for any reason whatsoever, the information source shall inform the Bank of Israel of this, and transfer the revised credit data to it, as instructed by the Supervisor. 53. Correction of information at a customer’s request (a) A customer is entitled to ask the Bank of Israel to delete information included in the register, complete such information, or revise it, if he believes that the information about him is incorrect or incomplete. (b) If a customer has submitted a request under Subsection (a), and the Bank of Israel believes that an inquiry by the information source is necessary for the purpose of handling this request, a note shall be made in the register about that information to the effect that an inquiry is being conducted about it, and the information source shall be contacted in order to clarify the matter. (c) If the Bank of Israel contacts the information source, as stated in Subsection (b), the information source shall conduct an inquiry about the matter, and transfer the results of the inquiry to the Bank of Israel. If the inquiry shows that it is necessary to complete or correct the information, the revised information shall be sent as well, as soon as possible, and no later than the date ordered, and in the manner ordered, by the Supervisor. (d) If the information source has not transferred the inquiry results within the period stipulated by the Supervisor, the Supervisor shall instruct the Bank of Israel concerning the actions to be taken in the register with respect to the information. Unofficial translation—Only the Hebrew version is binding. 18 54. Revision of the information in the register, and notification about the revision (a) The Bank of Israel is authorized to revise the information contained in the register according to the revised information transferred, and according to an inquiry conducted under Sections 52 or 53, whichever is relevant. If the Bank of Israel finds that there is a dispute between the information source and the customer concerning credit data contained in the register, it is authorized to record a note on the matter in the register, or to delete the credit data item in dispute. (b) The Supervisor is authorized to issue directives concerning the transmission of information revised under Subsection (a) to a customer, the credit bureau, credit data users, and paid authorized representatives. Chapter I: Preservation of Confidentiality and Information Security 55. Preservation of confidentiality (a) A person who has obtained information about a customer under this law shall not disclose it to another party, and shall make no use of it, other than according to the provisions of this law, or according to a court order. (b) If a person has received nonidentifying information originating in the register, he shall take no action to trace the identity of the customer to whom the information refers. 56. Restrictions on transferring information to public agencies Notwithstanding the provisions of Article 4 of the Protection of Privacy Law, information shall not be transferred to or from the register other than in accordance with the provisions of this law. 57. Information security (a) The Bank of Israel shall collect the information submitted to the register, store it, and disclose it – (1) In a manner that will ensure protection against leaks of information from the register, break-ins, and its transfer, exposure, deletion, use, alternation, or copying without legal permission; (2) In a manner that will prevent use of the information in contravention of the provisions of this law; (3) In a manner that will ensure that access to the information is in compliance with the provisions of this law, and will facilitate monitoring and supervision of how the register is used; (4) In a manner that will ensure than the nonidentifying information is stored and transmitted as such. (b) The Bank of Israel shall store the credit data in a database separately from any identifying particulars. It shall be made possible, however, to link the data to the identifying particulars for the purpose of revising the data in the register about a specific customer and disclosing them in accordance with the provisions of this law, and also for a different purpose, if directly required in order to operate the register, Unofficial translation—Only the Hebrew version is binding. 19 as determined by the Governor, with the consent of the Minister of Justice. Linking the data under this subsection shall be conducted as ordered by the Supervisor. (c) The Governor, with the consent of the Minister, is authorized to issue directives required for the security of the information submitted to the register, contained in it, and disclosed from it, including directives in the following matters: (1) The manner of collection and recording the information by the source of the information, so as to ensure the reliability, precision, and security of the information; (2) The manner of transferring the information to the register, the method used to store it in the register, the manner of its use, and the information security methods used; (3) The manner of providing access to information contained in the register, including for those with authorized access to identifying or nonidentifying information, and the means of identification required from a credit bureau in order to use the technological system for the register, as set forth in Section 14(c), including conducting transactions with it, and regulations concerning the monitoring of this system. Chapter J: Operating a Business Information Services 58. Licensing a business information service (a) The Supervisor is authorized to grant a license for a business information service (in this section – a license) to a party requesting one that fulfills all of the following conditions: (1) Companies Law; The party requesting a license is a company as defined in the (2) The party requesting a license has registered the database as a database under the Protection of Privacy Law; (3) The party requesting a license has provided a guarantee in accordance with the provisions of Section 8; (4) Neither the party requesting a license, a controlling shareholder in it, or an officeholder in it has been convicted of an offense whose substance, severity, or circumstances render him unfit to receive a license, and no indictment for such an offense in which a final judgment has not yet been made has been filed against any of these parties. (b) If the Supervisor has reasonable grounds for assuming that the party requesting the license will use the information obtained other than for the purposes of this law, or does not meet the requirements under the law, he is authorized to refrain from granting that party a license. (c) The Governor shall issue regulations concerning the manner of submitting a request for a license under this paragraph, the particulars to be included in it, and the documents to be attached to it. Unofficial translation—Only the Hebrew version is binding. 20 (d) The provisions of Chapter D shall apply to a license to operate a business information service, other than Sections 12 and 13. 59. Operating a business information service A business information bureau is entitled, in the framework of operating a business information service, to collect and retain any legally obtained information about a customer in such activity (in this section – credit data about a business), and to disclose it to another party, subject to any regulations issued by the Minister under Section 60. 60. Regulations governing the operation of a business information service The Minister is authorized to issue directives governing the operation of a business information service by a business information bureau in the following matters, among others: (a) The type of credit data about a dealer that a business information bureau is not permitted to collect, keep or disclose; (b) The sources of information from which a business information bureau is not permitted to collect credit data; (c) Prohibited uses of credit data about a business; (d) The manner of disclosing credit data about a business. 61. Retaining information A business information bureau shall retain the information it has collected in the framework of providing a business information service for at least seven years from the date on which the information was received. Chapter K: The Supervisor for Credit Data Sharing Article A: Appointment and Duties of the Supervisor 62. Appointment and duties of the Supervisor The Governor shall assign a Bank of Israel employee the responsibility for sharing of credit data under this law, including credit data service licenses and business information service licenses, supervising and monitoring the actions of the credit bureaus and business information bureaus, and the activities under this law of information sources transferring information to the register, users of credit data, and paid authorized representatives. Article B: Registries 63. Registries (a) The Supervisor shall manage the following registries: (1) A credit bureaus registry; (2) A registry of information sources transferring information to the register according to the provisions of Chapter F; (3) A credit data users registry; Unofficial translation—Only the Hebrew version is binding. 21 (4) A registry of paid authorized representatives of a type to be determined by the Governor; (5) A registry of business information bureaus. (b) The registries shall be open to public scrutiny on the Bank of Israel website. Article C: The Supervisor’s Directives 64. The Supervisor’s directives For the purpose of performing his duties, after consulting with the committee appointed under Article D, the Supervisor is authorized to take the following actions: (a) To issue directives concerning the activities and operations of the credit bureaus and business information bureaus, officeholders in those bureaus, and anyone employed by them for the purpose of achieving the purposes of this law, ensuring proper conduct by the bureaus, including their information security, and for the purpose of protecting the interests of the credit data users and the customers, including protection of the customer’s privacy. Such directives can be issued to all the bureaus, or to a specific type of bureau; (b) To issue directives to information sources transferring information to the register concerning their activities under this law for the purpose of achieving the purposes of this law and protecting the interests of the credit data users and the customers, including protection of their privacy. Such directives may be issued to all the information sources, credit data users, or paid authorized representatives, or to a particular type of information source. 65. Publishing the Supervisor’s directives (a) There is no obligation to publish in Reshumot (official State record) the Supervisor’s directives under Section 64, or any other instruction issued by the Supervisor under this law that is of legislative nature. The Supervisor, however, shall publish in Reshumot an announcement that such directives have been issued, and of their date of incidence. (b) The Supervisor’s directives mentioned in Subsection (a), and any change in them, shall be available for public scrutiny in the Supervisor’s offices, and shall be published on the Bank of Israel website. The Governor is authorized to determine additional ways of publishing them. Article D: The Advisory Committee for the Supervisor’s Directives 66. The advisory committee for the Supervisor’s directives (a) The Governor shall appoint a committee to advise the Supervisor on issuing directives under Section 64 (in this subsection – the committee). (b) The committee shall have five members, including: (1) One member who is a lawyer who is a state employee, to be appointed with the consent of the Attorney General; (2) One member who is a Ministry of Finance employee; Unofficial translation—Only the Hebrew version is binding. 22 (3) The other committee members shall be appointed from among the public or state employees, provided at least two committee members are from the public; (4) At least two of the committee members appointed from among the public shall be persons of prominence in the economy or present or former senior academic figures at a recognized institution, as the term is used in the Council for Higher Education Law, 5718-1958,12 with experience or education in the field of financial services; (5) One of the committee members shall be a specialist in information security or information technology. (c) The Governor shall appoint one of the committee members as committee chairperson, and another as vice-chairperson. (d) The committee shall convene at the request of the committee chairperson, or of the Supervisor, and its agenda shall include every topic under its authority requested by the chairperson or the Supervisor. (e) Three committee members, including the chairperson or vice-chairperson, shall constitute a legal quorum for committee meetings. 67. Conflict of interest (a) No person liable to frequently have a direct or indirect conflict of interest between his function as a committee member and his personal interest or another of his functions shall be appointed as a committee member. (b) A committee member shall refrain from taking part in a discussion at a committee meeting if the subject under discussion is liable to cause him a direct or indirect conflict of interest between his function as a committee member and his personal interest or another of his functions. In the course of his work on the committee, the committee member shall not deal with such a subject, including outside the committee meetings. (c) If a committee member realizes that the subject under discussion is liable to cause him a conflict of interest, as mentioned in Subsections (a) and (b), he shall notify the committee chairman of this in writing as soon as possible. If the committee member with the possible conflict of interest is the committee chairman, he shall notify the Governor. (d) For the purpose of this section, it is the same whether the other position is paid or unpaid. (e) In this Section – ―Personal interest‖ includes a personal interest of a relative or another entity in which he or his relative is a party at interest or an officeholder; ―Relative‖ – a spouse, parent, son or daughter or their spouse, brother or sister or their children, brother-in-law or sister-in-law, uncle or aunt, son-in-law or 12 Sefer Hahukim 5718, p. 191. Unofficial translation—Only the Hebrew version is binding. 23 daughter-in-law, father-in-law or mother-in-law, fiancé, grandson or granddaughter, including stepchildren, and any other member of a committee member’s household; ―Party at interest‖ – as defined in the Securities Law. 5728-1968. 68. The committee’s term in office (a) The term of a committee members shall be three years from the date of his appointment (b) A committee member whose term has expired may be reappointed for the same period of time. 69. Expiration of the committee’s term in office (a) A committee member’s position shall be terminated before the end of his term for any of the following reasons: (1) Governor. He resigned by delivering a letter of resignation to the (2) The Governor believes he is unable to fulfill his function. (3) He was convicted of an offense, the substance, severity, or circumstances of which render him unfit to fulfill his function, or an indictment has been filed against him for such an offense in which a final judgment has not yet been given. (b) A state employee appointed as a committee member who is no longer a state employee shall be removed from the committee. 70. Working procedures The committee shall establish its working procedures and order of its discussions, insofar as these have not been set forth in this law. 71. Status of the committee The existence of the committee, its authority, and the validity of its decisions shall not be affected by the removal of one of its members, defects in his appointment, or the continuation of his term. 72. Confidentiality Nothing in the committee’s discussions or material disclosed to it shall be revealed unless such disclosure is authorized by the Governor. Article E: Clarifying Complaints from the Public 73. Clarifying complaints from the public (a) The Supervisor shall hear complaints from the public he regards as well-founded concerning the actions of a credit bureau, a business information bureau, an information source transferring information to the register under Chapter F, a credit information user, and a paid authorized representative. Unofficial translation—Only the Hebrew version is binding. 24 (b) If a complaint affects a matter being heard in court or by an arbitrator, or one in which judgment has been pronounced by a court or an arbitrator, the Supervisor shall take this into account in his consideration of whether to hear the complaint. 74. Procedures for clarification (a) A complaint clarification shall be conducted in a manner regarded as proper by the Supervisor, which shall not be restricted by the rules for legal proceedings or the legal rules of evidence. (b) The Supervisor shall bring the complaint to the attention of the party that is the subject of the complaint, and shall provide that party with an opportunity to respond to it. 75. Results of the clarification (a) If the Supervisor finds that the complaint was justified, he shall notify the complainant and the party that is the subject of the complaint of this. In his response, the Supervisor is authorized to interpret a summary of his findings, and is authorized to order the party that is the subject of the complaint to redress the fault revealed by the hearing, either for the purpose of the case cited in the complaint or in general, in a manner and at a time ordered by the Supervisor. The Supervisor is authorized to instruct the register manager to correct the information in the register. If the Supervisor orders the correction of information in the register, the provisions of Section 54 shall apply, with the necessary changes. (b) If the Supervisor finds that the complaint was unjustified, or unworthy of clarification, he shall notify the complainant and the party that is the subject of the complaint of this. In his response, the Supervisor is authorized to interpret a summary of his findings. (c) If the hearing gives rise to a suspicion that a criminal offense has been committed, the Supervisor shall bring the matter to the attention of the Attorney General. Chapter L: Oversight 76. Definitions In this section – ―System data‖ means one of the following: (a) Data concerning the maintenance and management of information and databases by a credit bureau or a business information bureau, and the use of the data required for overseeing compliance with the provisions of this law by the bureau, provided that the data do not include identifying information; (b) Records that a credit bureau or a business information bureau is required to keep under this law, with respect to management, maintenance, or use of a database. Unofficial translation—Only the Hebrew version is binding. 25 ―Computer,‖ ―computer material,‖ ―penetration of computer material,‖ and ―output‖ have the same meaning as in the Computers Law, 5755-1995.13 77. Authorization for overseers (a) The Governor is authorized to select Bank of Israel employees as overseers, who will be given authority under this section for the purpose of overseeing compliance with the provisions of this law. (b) No person shall be appointed as an overseer under Subsection (a) unless he fulfills all of the following conditions: (1) He has not been convicted of an offense, the substance, severity, or circumstances of which, in the opinion of the Governor, render him unfit to be a overseer; (2) He has been trained in exercising the authority that will be given him under this section, as instructed by the Governor; (3) He meets other requirements, as instructed by the Governor; (4) He is trained in the penetration of computer material and production of output as part of such penetration for the purpose of exercising authority under Sections 78(4) and 79. 78. Overseer’s authorities In order to oversee the carrying out of the directives pursuant to this law, the overseer has the authority: (a) To require any person to disclose his name and address to the overseer, and to require him to present his ID card or other official certificate identifying him; (b) To require any person involved in a matter to disclose to him any information or document, including output, that can ensure to carrying out of the provisions of this law; (c) To require any person involved in the matter to present to him or deliver to him a copy of computer material, including systems data and sample information required in order to oversee compliance with the provisions of this law. Sample information in this paragraph means only the amount needed for oversight; (d) To penetrate computer information of a credit bureau or a business information bureau, under the provisions of Section 79; (e) To enter the site on which an agency subject to oversight operates, and any site on which he has grounds for assuming that an agency subject to oversight operates, providing that he does not enter a site used as a residence, unless in accordance with a court order. For the purpose of this matter, ―agency subject to oversight‖ means a credit bureau, a business information bureau, an information source that transfers information to the register, a credit data user, or a paid authorized representative. 79. Penetration of computer material of a credit bureau or a business information bureau. 13 Sefer Hahukim 5758, p. 366. Unofficial translation—Only the Hebrew version is binding. 26 For the purpose of overseeing compliance with this law by a credit bureau or a business information bureau, an overseer who fulfills the requirements of paragraphs (1) to (4) of Section 77(b) is authorized – (a) To penetrate computer material of a credit bureau or a business information bureau for the purpose of copying the systems data included in it, and to copy this system data and produce output from them, provided that no computer material not directly required in order to locate and copy the system data is penetrated; (b) To penetrate computer material of a credit bureau or a business information bureau for the purpose of collecting sample information. Under this subsection, only the amount of sample information necessary for oversight shall be collected. (c) To penetrate computer material of a credit bureau or a business information bureau for the purpose of copying information about a customer, to copy the information, and to produce output from it, provided that that customer involved has consented to this in advance in writing, and providing that no computer material not directly required in order to locate and copy that customer’s information is penetrated. 80. A demand for computer material or penetration of computer material— assistance from a specialist and deleting the information (a) In order to exercise the authorities under paragraphs (3) and (4) of Section 78, an overseer is authorized to use the services of a specialist, including one who is not a state employee, for the purpose of conducting an inquiry at the location of the party from which computer material is needed under the above-mentioned paragraphs, and for the purpose of a demand for computer material or penetration of computer material, if experience, know-how, or equipment not possessed by the overseer is needed for this demand or penetration, provided that the overseer is present at the site when the specialist is working and oversees his actions. The overseer shall inform the specialist that the confidentiality obligation applies to him. (b) Sample information collected under Section 78(3) and 78(4) shall be deleted from the Bank of Israel databases after the overseeing procedures for which it was collected have been completed, but no later than six months after the data on which they were delivered or collected, or at a later date set by the Minister. 81. Identification obligation An overseer shall exercise the authority granted him under this section only when performing his function, and under the following conditions: (a) He openly wears a tag identifying him and his position. (b) He carries a certificate signed by the Governor that states his position and authority, which he will present upon request. Chapter M: Penalties 82. Penalties Unofficial translation—Only the Hebrew version is binding. 27 (a) The penalty for the following offenses is one year of imprisonment or the fine stated in Section 61(a)(3) of the Penal Law: (1) Use of credit data obtained from the register other than for the purpose for which it was requested, in violation of the provisions of Section 22; (2) A credit provider who asked a credit bureau for a creditworthiness assessment without informing the customer, in violation of the provisions of Section 31; (3) A public infrastructure company that asked for an assessment of whether to institute collection proceedings for a customer without notifying the customer, in violation of the provisions of Section 35; (4) A credit bureau that copied or saved nonidentifying information, in violation of the provisions of Section 43(b); (5) A credit bureau or paid authorized representative that kept credit data longer than the period listed in Section 47; (6) A credit provider that kept a credit report longer than the credit transaction period, in violation of the provisions of Section 50, or that did not delete the credit report within the period listed in that paragraph; (7) A party that obtained nonidentifying information originating in the register, and took action to identify the customer to whom the information referred, in violation of the provisions of Section 55(b); (8) A business information bureau that retained information collected in the framework of providing a business information service for a period shorter than seven years from the date on which the information was received, in violation of the provisions of Section 61; (9) A party that received credit information about an employment candidate, or used such data, in violation of the provisions of Section 103. (b) The penalty for the following offenses is three years of imprisonment or the fine stated in Section 61(A)(4) of the Penal Law: (1) A party who collected credit data, kept them for the purpose of delivering them to another party, or delivered them to another party in the course of business, in violation of the provisions of Section 4; (2) A credit bureau or a business information bureau that has breached the terms of its license, in violation of Sections 5 or 6; (3) A credit bureau engaging in business that is not a credit data service without having received permission from the Supervisor, in violation of the provisions of Subsection 12(B); (4) A credit provider that has asked a credit bureau for a credit report without having obtained the customer’s consent, in violation of the provisions of Section 23; Unofficial translation—Only the Hebrew version is binding. 28 (5) A credit bureau that took into account data about a customer’s gender, age sexual orientation, race, religion, country of origin, nationality, or place of residence for the purpose of determining his credit rating, in violation of Section 49; (6) A party who disclosed information about a customer that he obtained under this law, or used it, in violation of the provisions of Section 55(a). 83. Liability of officeholders (a) An officeholder in the corporation must oversee and do everything possible to prevent the committing of an offense under this section by the corporation or by any of its employees. The penalty for violating this provision is half of the fine for that offense. (b) If an offense under this section has been committed by a corporation or any of its employees, it is presumed that the officeholder in the corporation has failed in his duty under Subsection (A), unless it has been proven that he did everything possible to fulfill that duty. (c) In this paragraph, ―officeholder‖ means an acting manager in a corporation, a partner (other than a limited partner), or an official responsible on behalf of the corporation for the area in which the offense was committed. Chapter N: Financial Sanction 84. Definitions In this section ―the basic sum‖ is whichever of the following sums is relevant: (a) For a credit bureau, business information bureau, information source transferring information to the register, and a credit data user – NIS 500,000; (b) For a paid authorized representative – NIS 10,000, and if a corporation, NIS 50,000. 85. Financial sanction (a) If a person has operated a credit data service or a business information service without possessing a license to do so, in violation of the provisions of Sections 5 or 6, the Supervisor is authorized to levy a financial sanction of NIS 50,000 against him, according to the provisions of this section. (b) If a party has violated any of the provisions under this law, as listed below, the Supervisor is authorized to impose a financial sanction of the basic sum against it, according to the provisions of this section: (1) A credit bureau or a business information bureau that has operated contrary to the conditions of its license, in violation of the provisions of Paragraphs 5 or 6: (2) A credit bureau conducting business that is not a credit data service without having obtained permission from the Supervisor, in violation of the provisions of Section 12(b); Unofficial translation—Only the Hebrew version is binding. 29 (3) An information source obligated to transfer information to the register under Section 16 that did not do so in accordance with the provisions of that section; (4) An information source that did not take reasonable measures to ensure the accuracy and reliability of the credit data transferred to the register, in violation of the Supervisor’s instructions under Section 16(f), or that transferred credit information in violation of the Supervisor’s instructions under Section 16(g); (5) A party that used credit data obtained from the register for a purpose other than the one for which it was requested, in violation of the provisions of Section 22; (6) A credit bureau that requested credit data from the Bank of Israel for the purpose of preparing a credit report without having proven that the conditions for transferring data for the purpose of a credit report were fulfilled, in violation of the provisions of Section 24; (7) A credit provider that refused on the basis of a credit report it received to contract a credit transaction, or set more stringent conditions for a credit transaction it had contracted, without notifying the customer of this and delivering the credit report or credit rating to him, in violation of the provisions of Section 29; (8) A credit bureau that requested a consolidated data report for a paid authorized representative without having proven that the conditions for transferring a consolidated data report were fulfilled, in violation of the provisions of Section 39; (9) A credit bureau that copied or saved nonidentifying information, in violation of the provisions of Section 43(b); (10) A credit bureau or a paid authorized representative that kept credit data longer than the period stipulated in Section 47; (11) A credit bureau that charged a sum in excess of the maximum amount determined by the Governor, in violation of the provisions of Section 48; (12) A credit provider that kept a credit report longer than the period of the credit transaction, in violation of the provisions of Section 50, or did not delete the credit report with the period stipulated in that paragraph; (13) A credit bureau that disclosed credit data to a credit data user or to a paid authorized representative, in violation of the provisions of Section 51; (14) An information source that did not notify the Bank of Israel of incomplete or inaccurate credit data, or data in which changes occurred, and did not transfer the revised data in accordance with the Supervisor’s instructions, in violation of the provisions of Section 52; Unofficial translation—Only the Hebrew version is binding. 30 (15) An information source that did not transfer to the Bank of Israel the result of an inquiry it conducted or its revision of information, in violation of the provisions of Section 53(c); (16) An information source that did not collect information and record it in accordance with the instructions issued by the Governor under SubSubsection 57(C)(1); (17) A business information bureau that violated instructions issued by the Minister under paragraphs (1)–(4) of Section 60; (18) A business information bureau that kept information collected in the framework of providing a business information service for a period shorter than seven years from the date on which the information was received, in violation of the provisions of Section 61; (19) A party that violated any of the Supervisor’s instructions issued under Section 64. 86. Notification of intent to impose a financial sanction (a) If the Supervisor has reasonable grounds for assuming that a person has violated any of the provisions under this law, as stated in Section 85 (in this section – the violator), and intends to impose a financial sanction under that provision, he shall deliver a notice to the violator of his intention to impose a financial sanction on him (in this section – notice of intent to charge). (b) In a notice of intent to charge, the Supervisor shall state the following, among other things: (1) violation; The act or failure (in this section – the act) constituting the (2) it; The amount of the financial sanction and the period for paying (3) The violator’s right to present his arguments to the Supervisor under the provisions of Section 87; (4) The authority to add to the amount of the financial sanction for a continued violation or repeated violation under the provisions of Section 89, and the date from which the violator shall be regarded as a continued violator for the purpose of that section. 87. Right to plea A violator who has been notified of intent to charge under the provisions of Section 86 is entitled to present his arguments in writing to the Supervisor concerning the intent to impose a financial sanction on him, and concerning its amount, within 30 days of the date on which the notice was delivered. The Supervisor is authorized to extend this period by an additional period of no more than 30 days. 88. The Supervisor’s decision and demand for payment Unofficial translation—Only the Hebrew version is binding. 31 (a) After considering the arguments presented to him under Section 87, the Supervisor shall decide whether to impose a financial sanction on the violator, and is authorized to reduce the amount of the financial sanction under the provisions of Section 90. (b) If the Supervisor decides under the provisions of Subsection (a) – (1) To impose a financial sanction on the violator – he shall deliver a written demand for payment of the financial sanction (in this section – a demand for payment) stating, among other things, the revised amount of the financial sanction and the period for its payment; (2) To refrain from imposing a financial sanction on the violator – he shall deliver written notice of this. (c) In the demand for payment or in a notice under Subsection (b), the manager shall state the reasons for his decision. (d) If the violator has not stated his arguments under the provisions of Section 87 within the period set forth in that paragraph, at the end of that period, the notice of intent to charge shall be regarded as a demand for payment delivered to the violator on that date. 89. Continued violation and repeat violation (a) In a continued violation, one fiftieth of the amount stipulated for that violation shall be added to the stipulated financial sanction for each day on which the violation was continued. (b) In a repeat violation, an amount equal to that financial sanction for that violation shall be added to the stipulated financial sanction. For this purpose, a ―repeat violation‖ is a violation of any of the provisions of this law, as set forth in Section 85, within two years of a previous violation of the same provision for which a financial sanction was imposed on the violator, or for which he was convicted. 90. Reduced amounts (a) The Supervisor is not authorized to impose a financial sanction less than the amounts set forth in this section, except according to the provisions of Subsection (b). (b) The Minister is authorized to determine cases, circumstances, and considerations in which a financial sanction lower than the amounts set forth in this section can be imposed, at rates to be determined. 91. Revised amount of the financial sanction (a) The financial sanction shall be according to the revised amount on the date on which a demand for payment is delivered, and for a violator who did not state his arguments to the Supervisor under Subsection (d) – on the date on which the notice of intent to charge was delivered. If a court appeal was filed under Section 96, and payment of the monetary sanction was delayed by the Supervisor or the Court as a result, the financial sanction will be according to the revised amount on the date on which a ruling on the appeal was issued. Unofficial translation—Only the Hebrew version is binding. 32 (b) The amounts of the financial sanction set forth in Sections 84 and 85 shall be revised on January 1 of each year (in this subsection – the revision date), according to the rate of increase in the known index on the revision date, compared with the known index on January 1 of the preceding year. For this purpose, ―index‖ means the Consumer Price Index published by the Central Bureau of Statistics. (c) The Supervisor shall publish an announcement of the revised amounts of the financial sanctions under Subsection (b). 92. Payment date for the financial sanction The violator shall pay the financial sanction within 30 days of the delivery of the demand for payment, as stipulated in Section 88. 93. Indexation and interest differentials If the violator has not paid the financial sanction on time, indexation and interest differentials for the period of arrears, as defined in the Adjudication of Interest and Linkage Law – 196114 (in this section – indexation and interest differentials), shall be added to the financial sanction, until it is paid. 94. Collection A financial sanction shall be collected for the state treasury, and the Taxes Ordinance (Collection)15 shall apply to its collection. 95. A financial sanction for violation of this law and for violation of a different law No more than one financial sanction shall be imposed for one act constituting a violation of any of the provisions of this law listed in Section 85 and of any of the provisions of a different law. 96. Appeal (a) A final decision by the Supervisor can be appealed to the Magistrates Court presided over by the President of the Magistrates Court. Such an appeal must be filed within 30 days of the date on which the violator received notice of the decision. (b) Filing an appeal under Subsection (a) shall not delay payment of the financial sanction, unless the Supervisor consents to such a delay, or it is ordered by the Court. (c) If the Court upholds an appeal filed under Subsection (a) after the financial sanction has been paid under the provisions of this section, and the Court orders the reimbursement of the amount of the financial sanction paid, or a reduction in the financial sanction, the amount paid or any part of it that has been reduced shall be reimbursed, plus indexation and interest differentials from the day it was paid until the day it is reimbursed. 97. Publication 14 15 Sefer Hahukim 5721, p. 192. Laws of the Land of Israel, Volume 2, p. (H) 1374, (E) 1399. Unofficial translation—Only the Hebrew version is binding. 33 (a) If the Supervisor has imposed a financial sanction under this section, the following particulars shall be published on the Bank of Israel website in a manner that ensures transparency about the exercise of judgment in making a decision to impose a financial sanction. (1) That a financial sanction has been imposed; (2) The substance and circumstances of the violation for which the financial sanction was imposed; (3) The amount of the financial sanction imposed; (4) If the financial sanction was reduced – the circumstances that led to the reduction and the rate by which it was reduced; (5) Particulars of the violator pertaining to the matter; (6) The name of the violator if it was a corporation. (b) If an appeal has been filed under Section 96, the Supervisor shall publish the filing of the appeal and its results. (c) Notwithstanding the provisions of Subsection (a)(6), the Supervisor shall publish the name of a violator who is an individual if he believes that this is necessary in order to warn the public. (d) Notwithstanding what is stated in this Section, the Supervisor shall not publish particulars constituting information that a public authority is enjoined from disclosing under Section 9(a) of the Freedom of Information Law, 5758-1998,16 and is authorized to refrain from publishing particulars under this section, which are considered information that a public authority is not obligated to disclose, under Section 9(b) of that law. (e) Publication under this paragraph of the imposition of a financial sanction on a corporation shall be for a period of four years, and for a financial sanction imposed on an individual, for a period of two years. (f) The Governor is entitled to establish additional ways of publishing the particulars mentioned in this paragraph. 98. Maintaining criminal responsibility (a) Payment of a financial sanction under this chapter shall not derogate from the criminal responsibility of a person in respect of a violation of any of the provisions in this law listed in Section 85 constituting a crime. (b) If the Supervisor has sent a notice of intent to charge due to a violation constituting a crime, as set forth in Subsection (a), no indictment shall be filed for that violation unless new facts have come to light justifying such an indictment. (c) If an indictment has been filed against a person for a violation constituting a crime, as set forth in Subsection (a), the Supervisor shall not institute proceedings against him under this chapter for that violation. If an indictment has been filed 16 Sefer Hahukim 5758, p. 226. Unofficial translation—Only the Hebrew version is binding. 34 under the circumstances set forth in Subsection (b) after the violator has paid a financial sanction, he shall be reimbursed for the amount paid, plus indexation and interest differentials from the date on which the amount was paid until the reimbursement date. Chapter O: Miscellaneous 99. Authentication of identity For the purpose of performing its function, the Bank of Israel is authorized to take action to authenticate a customer’s identity, 100. Identifying particulars included in credit data The Minister shall determine the identifying particulars of a customer to be included in credit information that an information source shall transfer to the register under Chapter F, and the identifying particulars to be included in credit data from the register delivered by the Bank of Israel under Chapter G. 101. Retaining data designated for a specific credit bureau The Governor is authorized to rule that an authorized source transferring credit data to the register under Subsection (d) is entitled, given that conditions set by the Governor are fulfilled, to ask the Bank of Israel to store the credit data sent in a different database from the other credit data, and that they be delivered only to the specified credit bureau. If the Governor grants this request, the Bank of Israel shall store the information in a database accordingly, and shall grant access to this stored information only to the credit bureau specified by the information source. 102. Notifying a customer of the beginning of data collection The Supervisor shall notify a customer of the beginning of collection of data about him in the register, and of his right to submit an opt-out request under Section 19, or a request for non-disclosure of data under Section 27. 103. Prohibition of demanding credit data for employment purposes (a) No person shall directly or indirectly request credit data about a person for the purposes of employing him, including through a statement or written questionnaire. No person shall receive or use such data. (b) The Labor Tribunal shall have special authority to hear a civil proceeding concerning a violation of the provisions of Subsection (a). 104. Restrictions on including data in the register and disclosing them for reasons of state security or foreign relations At the request of the head of a security agency or someone authorized by him, the Bank of Israel shall not include in the register specific credit data, and shall not disclose specific credit data from the register for reasons of state security or Israel’s foreign relations, in accordance with a procedure to be established for this purpose by the Bank of Israel and the security agencies, with the approval of the Knesset Foreign Affairs and Defense Committee Subcommittee for Intelligence and Secret Services. In this paragraph, ―security agency‖ means the Israel Defense Forces, the Israel Security Agency, the Unofficial translation—Only the Hebrew version is binding. 35 Institute for Intelligence and Special Operations (Mossad), the Ministry of Defense, and support units of the Ministry of Defense. 105. Extending incidence for corporations For the purpose of achieving the aims of this law, the Governor, in consultation with the Minister, is authorized to rule that all or some of the information sources obligated to disclose credit data, in whole or in part, about a customer under Chapter F are also obligated to transfer to the register credit data about corporations of a type to be determined. The Governor shall issue regulations concerning the type of credit data to be transferred, the method for storing them in the register, the conditions for delivering them from the register, and their use. 106. Tort damages An act or failure in violation of the provisions of this law is a civil wrong, and the provisions of the Civil Wrongs Ordinance (New Version)17 shall apply to it, subject to the provisions of this law. 107. Implementation The Minister is responsible for implementing this law, and is authorized to issue regulations for its implementation. 108. Fees (a) The Governor, in consultation with the Minister of Finance, is authorized to issue an order for fees, as follows:\ (b) Fees under this paragraph shall be paid to the Bank of Israel. 109. Prohibition of contingency Nothing should be made contingent on the provisions of this law. 110. Repeal of the Credit Information Service Law The Credit Information Service Law, 5762-200218 is hereby repealed. 111. Amendment of the Private Investigators and Security Services Law The definition of ―private investigator‖ in Section 1 of the Private Investigators and Security Services Law, 5732-197219 shall read ―for a business information bureau according to the Credit Data Law, 5776-2015‖ instead of ―for license owners under the Credit Information Service Law, 5762-2002.‖ 112. Amendment of the Checks without Cover Law Section 15 of the Checks without Cover Law, 5741-198120 shall read ―implementation of the Credit Data Law, 5776-2015‖ instead of ―implementation of the Credit Information Service Law, 5762-2002.‖ 17 Laws of the State of Israel, New Version 10, p. 266 Sefer Hahukim 5762, p. 104; 2007, p. 415. 19 Sefer Hahukim 5732, p. 90. 20 Sefer Hahukim 5741, p. 136; 2014, p. 736. Unofficial translation—Only the Hebrew version is binding. 18 36 113. Amendment of the Banking (Service to Customer) Law Paragraph (5) in Section 5a1(b) of the Banking (Service to Customer) Law, 5741198121 is deleted. 114. Amendment of the Administrative Affairs Courts Law In item 17 in the first addendum in the Administrative Affairs Courts Law, 57602000,22 ―Credit Data Law, 5776-2015‖ replaces ―Credit Information Services Law, 5762-2002.‖ 115. Incidence (a) This law will take effect two years from the date of its publication, and the Minister is authorized, with the Governor’s consent, to issue an order postponing this date if he finds that the postponement is necessary in the preparations for putting into effect the credit data sharing arrangement under this law (hereafter – the date of incidence). (b) Notwithstanding the provisions of Subsection (a), the Governor is authorized, with the Minister’s consent, to rule that the provisions of this law, including the Supervisor’s directives, concerning delivery of information to the register by information sources, as set forth in an order, shall become effective on an earlier date than the date listed in Subsection (a), if he finds that this is necessary in the preparations for putting into effect the arrangement cited in Subsection (a) on the incidence date. 116. First regulations The first regulations under Section 57(c) shall be issued by the incidence date. 117. Transitional provisions (a) A party that held a business information service license before the incidence date, and that was not granted a license by the Supervisor under Chapter J by the incidence date, and a party who held a credit data service license before the incidence date, shall delete the credit data in the register that he holds on the incidence date, in accordance with the Supervisor’s instructions. (b) Notwithstanding the provisions of Section 102, the notification in that section given to customers that data collection for them in the register will begin on the incidence date shall be published for all customers in the records and in the three most widely distributed daily newspapers in Israel, provided that one of them is in Hebrew and one in Arabic. (c) The Minister, with the consent of the Governor and the Minister of Finance, shall determine the period to which the credit data to be transferred to the register on the incidence date, or on the date determined under Subsection (b), whichever is relevant, refer. The Minister is authorized to determine such a period, which shall begin before the publication of this law. 21 22 Sefer Hahukim 5741, p. 258; 2014, p. 338. Sefer Hahukim 5760, p. 190. Unofficial translation—Only the Hebrew version is binding. 37 (d) Any party violating any of the provisions of the Credit Services Law, 5762-2002 (in this paragraph – the Credit Services Law), as set forth in Section 42 of that Law, as these provisions were formulated before the incidence date, shall continue to be subject to the provisions of Sections 42 through 48 of that law, in the version in effect at that time. (e) If a violation under Sections 49 or 50 of the Credit Services Law was committed before the incidence date, the repeal of that law in Paragraph 110 of this law shall not be regarded as repeal of the prohibition of that offense for the purpose of Section 4 of the Penal Law. Unofficial translation—Only the Hebrew version is binding. 38