The Privacy Protection Authority at the Ministry of Justice has issued an administrative decision regarding violations of the Privacy Protection Law by A.D. Karting Chutzot (2014) Ltd, an operator of karting tracks, including the facility at Chutzot HaMifratz in Haifa. According to information published by 'NWS News,' the proceedings were initiated following a customer complaint. The customer alleged that she was required to provide sensitive personal information—including her ID number, date of birth, details about her children, and residential address—to register for activity on the company's website without receiving the detailed notification required by law.
During the Authority's investigation, it was found that the privacy policy and terms of use on the company's website failed to meet the requirements of Section 11 of the Privacy Protection Law. Among the identified deficiencies, it was noted that customers were not informed whether they were legally obligated to provide the information, the purposes of data collection, the party responsible for the database, or how to exercise rights to view or correct the information. Furthermore, the Authority noted that at the time the complaint was filed, the company’s website lacked a comprehensive privacy policy entirely.
The karting company argued to the Authority that the errors were made in good faith or constituted "de minimis" infractions, but this position was rejected. The Authority clarified that the duty to notify is a substantive obligation and a cornerstone of protecting individual autonomy, rather than merely a technical requirement. It was further noted that the company corrected the deficiencies only after the investigation was launched. The original fine of 20,000 NIS was reduced to 12,000 NIS, taking into account the company's lack of prior violations and its actions taken to rectify the situation and prevent future recurrences.
Advocate Adi Menachem Beer, Director of the Enforcement Division at the Authority, stated that such violations undermine an individual's ability to make an informed decision before disclosing personal data. On behalf of the company, it was reported to 'NWS News' that the company acted in full coordination with the Authority and attaches supreme importance to the security of its customers' information.