7amleh / August 25, 2021
Executive Summary
This study seeks to identify the reality of privacy and protection of digital personal data in Palestine1 in terms of the collection, processing and use of Palestinian users’ data. It addresses some of the human rights violations faced by Palestinian users as well as the key parties that violate their data privacy. It also identifies the main features and principles of the desired Palestinian privacy and data protection law. Qualitative research methodology was used in preparing this research, through the use of two tools for data collection and analysis. The first tool, focus groups, utilized three geographically distributed groups who participated from the West Bank, the Gaza Strip, and East Jerusalem. The number of participants ranged from 14-16 participants. The second tool is the in-depth, personal interviews with a sample of 12 individual stakeholders with the experience and knowledge of the case under study.
The focus groups showed that the concept of privacy and personal data is relatively new and not fully known, especially in Jerusalem, and that efforts are needed to publicize it and its importance. This is considered a main reason for the low percentage of those who read and are familiar with the privacy policies of sites, applications and services before using them. The majority of participants agree on the necessity and importance of enacting a comprehensive Palestinian law on privacy and data protection to be applied in all Palestinian areas whose main objective is to protect Palestinians’ data and prevent the violation of their privacy.
On the other hand, and due to the specificity of the political, security and human rights situation related to the Palestinian cause and its dimensions, the parties that seek to violate and breach the privacy of Palestinians and their private data vary, according to what the participants in the focus groups and personal interviews indicated. These parties can be classified as follows: the Israeli occupation, the Palestinian Authority, private sector companies and external parties, including global social media platforms such as Facebook. The reasoning for these violations varied, the most prominent including security goals, political goals, commercial and advertising goals.
The majority of participants in focus groups and in-depth interviews expressed, as per their classifications and geographic areas, great interest in the importance of enacting a Palestinian law and legislation to protect the privacy and data of Palestinians. All civil society organizations and sectors participate, and work with governmental and legal authorities, to support the enactment and adoption of this law in all Palestinian areas. The focus was on the proactive role of Palestinian civil society, in the process of raising societal awareness of the law and the importance of privacy and protection of personal data at the popular and official levels. This is the first fundamental step towards enacting the law, where citizens must be made aware of privacy and data protection in the digital era before the law is enacted, and in light of the low percentage of those who are well informed about the concept of privacy and personal data.
This can be compared with the perceptions of European citizens about privacy and data protection through opinion polls on the trend of European public opinion with regard to privacy and data protection during 2012. The results showed that European citizens are aware of the basic principles of the concept of privacy and data protection; however their awareness of the specific aspects of privacy as an individual right and a social principle was rare. The majority of Europeans believe that they have lost control of their personal data, in addition to their data not protected, which requires regulating laws.
In-depth interviews revealed that several private or public parties may be working on collecting Palestinians’ personal data, and although they do not have sufficient technical and logistical ability to process this data and analyze it using artificial intelligence algorithms and techniques, yet, in the coming years, the process may become more accessible by all parties who collect personal data. It is only a matter of time until these companies and agencies have the ability to process this data, due to the analysis and processing of this level being used in major international companies such as Facebook and others.. Therefore, in order not to create chaos regarding the analysis of user data and behavior, it is necessary to develop a regulating law that manages and protects the privacy of Palestinian users and serves as the main step towards building permitted and prohibited actions and within the framework of data collection, processing and use.
In the same context, the privacy policies of companies and various entities that should be approved by users and subscribers, must be clear and consistent with the law itself. The law must also detail them so as to put an end to the indiscriminate privacy policies, or those policies that violate the privacy of individuals indirectly. The standard should be that the data of users who agree to privacy policies, are preserved and not violated by these policies.
One of the biggest problems and gaps that emerge from the absence of such a law is that the door to jurisprudence regarding privacy and data protection remains open. It is not understood what data is allowed or prohibited and how it should be analyzed, used and utilized, which forces the Palestinian user to deal with different privacy policies for each company and/or a party according to what it deems appropriate and meets its needs. This in result may hold these bodies accountable and responsible if they make a mistake or do not abide by privacy standards that are not stipulated locally; this is why we are facing a real issue regarding privacy.
The report showed that there is a lot of information being collected, while companies are not transparent about their data collection, the nature of its use, processing and exchange with internal or external third parties, carrying out these operations under cover. The issue is, that in the absence of a party responsible for monitoring and following up on this issue, we cannot know the extent to which our data is hacked on a daily basis.
The contradiction in statements given by the owners of private sector companies, human rights organizations and participants in the focus groups was clear. The respondents indicated, for example, that the Palestinian security forces, whether in the Gaza Strip or the West Bank, have the ability to access any information held by private sector companies, whether by legal means or through cooperation with these parties and the use of concealed methods, nepotism and wasta (tr: who you know), for public or personal purposes. The laws enacted and applied in the West Bank and Gaza facilitated this breach of privacy, which demands a thorough review of previous laws and regulations in a serious manner in order to change these laws and harmonize them with international standards, especially the Cybercrime Law.
Ministries and agencies responsible for following up on privacy issues with private sector companies create computerized systems that try to protect and preserve privacy, and limit access to data; however, the controls of these computerized systems remain incomplete and inaccurate or are not linked to a law that clarifies what information these systems must provide, what they must withhold, and who has the authority to view, program and maintain these systems. Government agencies and ministries are still working on diligence in this matter. The absence of the law on which these systems are based, is the biggest loophole through which any violation of privacy can be committed. One cannot speak about the issue of privacy in the absence of a supervisory body based on laws and legislation, and judicially approved standards and provisions for monitoring Palestinian users’ data.
Eventually, the report suggested a set of recommendations, such as the formation of a Palestinian commission to protect and regulate privacy and personal data, and the need to pass a comprehensive Palestinian privacy and data protection law. The report presented the most important features of the desired Palestinian law in this context, in addition to stressing the importance of public and official awareness of the issue of privacy and data protection in Palestine.
VIDEO (Arabic) : https://privacy.7amleh.org/
