Every time you enter the store – you may become part of a database

In quite a few stores in Israel, employees record customers without asking them, using smartphones or surveillance cameras. Most often, the documentation is done as a “working tool” for the purpose of improving the service, preventing theft, or analyzing customer behavior. But alongside the business needs, it is important to emphasize that the store maintains a database of its customers, and after Amendment 13 to the Privacy Protection Law, there is a high legal risk and exposure to fines.

The Privacy Protection Authority clearly stated: a database of customer photographs is considered an “information database” as defined in the Privacy Protection Law. It is enough that the person can be identified indirectly – by time, place, or crossing with POS data – for us to fall into the world of database laws, and not just into “service” or “security” aspects.

The Authority mentions that even the very documentation of a person’s presence at a certain place and time can be personal and sensitive information. When a business keeps recordings of customer visits over time, it not only “records traffic in the store” – it is equipped with information that outlines life patterns: buying habits, financial status, and even clues to medical conditions or beliefs. It is enough to think about a customer who appears every few days at a pharmacy or a store that sells sensitive products, to understand how much personal information may be revealed even without saying a word.

Hence, the question is not only whether it is “pleasant” for the client to be photographed, but whether the business complies with the obligations applicable to the owner of a database, for example: it is forbidden to photograph “just to be safe”. It is necessary to define in advance what the purpose is, such as preventing violence or securing a cash register, and it is forbidden to make a secondary use, for example – for marketing, employee training or advertising on networks, without an appropriate definition.

After Amendment 13 to the Privacy Protection Law, which entered into force in August 2025, violations of the rules for operating cameras in business are a real reason for heavy sanctions. Failure to post signage clearly notifying customers, keeping photographic documentation without a legal basis, placing cameras in a disproportionate manner, the lack of authorization and access procedures for employees, or lax security of the database – all of these are considered violations of the provisions of the law and the directives of the Privacy Protection Authority.

Alongside each of them there is a risk of significant financial sanctions: starting with minimal fines of tens of thousands of shekels for a small business up to hundreds of thousands of shekels and even more when it comes to large entities or repeated violations.

Bottom line, any business that uses cameras must stop and check if it is operating legally: set goals, hang signage, secure the database and manage permissions. Those who do not do so may pay dearly.