On 12 October 2026 Israel's Privacy Protection Authority announced that its head, Adv. Gilad Semama, had written to Police Commissioner Daniel Levi and to the police's internal privacy supervisor, Chief Superintendent George Kivorkian. He asked them to find out how videos and personal details from the investigation into Mali and Liel Yahalomi reached the media.
Background: Vienna, Argentina and Bank of Jerusalem
Mali Yahalomi and her daughter Liel, from Modiin, disappeared in Vienna. A gag order was placed on the case, and the investigation went to Lahav 433, the police's national crime unit. On 14 August 2026 they were found in Argentina, and they returned to Israel about two months after they disappeared, as reported by Channel 13 News.
Mali is a long-time employee of Bank of Jerusalem. While she was missing, rumours of embezzlement spread and the bank's share price fell. The bank told the stock exchange it had found no sign of unusual activity in its funds or assets, and the share recovered. CEO Yair Kaplan wrote to staff that apart from her being an employee, no link had been found between the bank and the case, according to Davar.
What the Authority is asking the police to do
According to the letter, a wide range of personal information about the two was published, including correspondence, searches they ran in AI tools, details of their finances and financial transactions, and where and when they landed. The Authority wants to know how all of this left the police. It also asked the police to examine what was weighed before publication was allowed, to draw lessons for the whole system and to report the findings back to the Authority.
This is an instruction to investigate, not a finding that a breach took place. The Authority has not published findings yet, and we will update this page when it does.
Why the letter went to an internal supervisor
Under section 23K of the Privacy Protection Law, the police is a security body. The law's obligations apply to it, but oversight works differently. For now, the Authority's regular supervision does not apply to the police. Instead there is an internal privacy supervisor, appointed by the head of the body in consultation with the head of the Authority. The head of the Authority may instruct that supervisor to look into a specific matter, which is what happened here. If the supervisor does not do so within a reasonable time, the head of the Authority may act directly. From 14 August 2028 the Authority's regular supervision will also apply to the police, except for databases classified "secret" or higher.
The internal privacy supervisor is a different role from the Data Protection Officer (DPO) that the law requires many organisations to appoint. You can read about that duty and who it applies to in who needs a DPO and on our Amendment 13 page.
The case shows that for the Authority, a leak is first a question of who touched the information and who decided to release it. An organisation that is not a security body should still be able to answer that question on its own. If you don't have a procedure for it yet, start with our information security procedure template. If you are already dealing with a leak, see security incident response.
The Authority's full announcement is on the Privacy Protection Authority website (Hebrew).