We just wanted to wish you a happy holiday: privacy risks in holiday routines

Holiday eve at the office: a greeting goes to the client list, gift packages go out via a courier, someone works from home, and a photo from the holiday toast awaits posting.

Four routine actions, raising different and sometimes overlapping legal questions. It is worth stopping to check before the holiday.

Four checks before you leave

• The greeting: only a holiday greeting, or has a marketing message crept in? In Small Claims 57901-12-20 Strausser, the court held that a "Happy New Year" greeting with promotional content and a link to a lecture was an "advertisement", because the test is the substance of the message, not its form.
• The delivery file: which details really need to go to the supplier, what may it do with them, and what happens to them once delivery is complete?
• Remote work and permissions: who can still access information, and how do you verify who is connecting from home?
• The photo: who appears in it, what can be read in the background, and to what use did the people photographed agree?

In practice

What does the law say?

• A holiday greeting that includes a commercial offer requires consent (see Small Claims 57901-12-20 Strausser). An "advertisement" under the Israeli anti-spam provision differs from direct mail under the Privacy Protection Law. A plain greeting with no commercial element may fall outside the definition.
• Transferring data to a delivery company is subject to Regulation 15 of the Data Security Regulations and requires a contract, a security risk review and data minimization.
• Working from home over the holidays requires restricted permissions (Regulation 8) and secure identity verification for remote access (Regulation 14(c)).
• Publishing employee photos for marketing requires consent under section 2(6) of the Privacy Protection Law, and care that no documents or client screens appear in the background.
• Note: consent loses its force without full transparency (see, for example, Class Action 25669-04-21 Keren Aviv v. Meta Platforms, Inc).

So what should you do?

• Check both the content of the greeting and the recipient list. A marketing or promotional message is subject to consent or to meeting the conditions of a legal exception.
• Give the supplier only the details needed for delivery. Check whether Regulation 15 applies and set out permitted use, security and return or deletion at the end.
• For remote workers, ensure secure access and enable multi-factor authentication (MFA), for example a code sent by SMS.
• Before posting, make sure the people photographed approved the intended use, and check that no personal or confidential information appears in the background.