On 9 January 2026, a Mizrahi Tefahot Bank customer emailed the bank's privacy officer at privacy@umtb.co.il. He asked to inspect the personal data the bank holds about him: the collection file for his car loan, call records, correspondence, and the report of the economic investigation conducted on him.
The reply came on 4 February 2026, at 15:27. It was sent by a Mizrahi Tefahot Bank employee whose email signature presents her as head of the Measurement and Control Section, Retail Division, Consumer Credit Center. Five other employees were copied. Every address in the email is a Mizrahi Tefahot Bank address, ending in umtb.co.il.
The attached letter opens with the words "Mizrahi Tefahot Bank Ltd. and Mizrahi Tefahot Leasing Ltd.". It is signed in one name only: "Mizrahi Tefahot Leasing Ltd.".
Three items were withheld. "Economic investigation: your request is denied". "Background check report: your request is denied". "Internal correspondence between lawyers: your request is denied". The reasoning is identical in each case: "this is information exchanged between the company and its lawyers", and it is therefore "protected by attorney-client privilege" under the Evidence Ordinance [New Version], section 48(a).
On internal calls, the letter stated: "we do not hold the information requested". According to the customer, he was not given the messages in which a Mizrahi Tefahot Bank employee told him that there was no loan in his name.
Three weeks earlier, on 13 January 2026, Yaniv Perlov took the witness stand at the Haifa Execution Office. Asked whether the company had received a private investigation on the customer in January 2024, he answered: "I'm not familiar with it".
In brief
- A data subject access request sent to Mizrahi Tefahot Bank was answered by a bank employee, with five bank employees copied, in the name of Mizrahi Tefahot Leasing.
- The economic investigation report, the background check report and the correspondence with the lawyers were withheld on grounds of attorney-client privilege.
- The courts have held that attorney-client privilege is not a blanket privilege, and that passing a document through a lawyer does not make it privileged.
- At the hearing, the lawyer on the file said the company had "simply changed its name". The person who appeared for the creditor testified that he is a Mizrahi Tefahot Bank employee.
One company, two names, one email address
At the hearing on 13 January 2026, attorney Dotan Tzur, counsel for the receiver, explained who the creditor is. According to the transcript, he said that the company that lent to the customer "was not liquidated and not dissolved, did not merge", and that it had "simply changed its name" from Agud Leasing (Igud Leasing) to Mizrahi Tefahot Leasing.
The same transcript records: "The creditor (Mizrahi Tefahot Leasing Ltd.): no appearance". In its place appeared Yaniv Perlov, the declarant in the execution request. Asked whether he is an employee of Mizrahi Tefahot Bank, he answered: "Yes. It's a subsidiary". He added that the company's offices in Lod are the bank's head offices.
On 5 March 2026, the same bank employee sent a further reply, this time with two bank employees copied. It stated: "Agud Leasing Ltd. and Mizrahi Tefahot Leasing Ltd. are the same company". The reply was signed: "Mizrahi Tefahot Leasing Ltd., privacy requests mailbox".
In other words, before the Execution Office the company is presented as an entity that merged with no one and merely changed its name. Facing the customer, his privacy requests are handled by bank employees, from bank mailboxes, in the same correspondence.
What the customer asked for, and what he received
The reply of 4 February came with a transcript, an account ledger, a payment schedule, a warning notice, text messages and a summary of correspondence. What had been gathered on the customer outside his dealings with the company, an economic investigation and a background check, was withheld.
The reply of 5 March went further. It described the customer's requests as a "fishing expedition" and as "an abuse, in bad faith, of legal proceedings and legal rights". The customer was required to direct any further request for documents "through the competent courts". It also claimed that the law does not entitle him to know "the names of the officials who operate the database".
Of the investigation report, it said again that it is "protected by attorney-client privilege".
What does attorney-client privilege cover
The Evidence Ordinance [New Version], section 48(a), provides that a lawyer is not required to give in evidence communications and documents exchanged between the lawyer and the client that have "a substantive connection to the professional service provided by the lawyer to the client". The purpose is to allow clients to speak freely with their lawyer.
The Privacy Protection Law, 1981 recognises this. In the wording the bank itself quoted, the right of access does not require the disclosure of personal data "in breach of a privilege established under any law". The question is whether the privilege actually applies to the document.
The Tel Aviv District Court, Economic Department, answered that question in a decision of 14 December 2016 (Class Action 19158-12-14 Zach v. Masad (Holdings) Ltd.). A company refused to disclose documents, arguing that they had been exchanged between it and its lawyers. The court rejected the argument.
The decision held that attorney-client privilege "is not a blanket privilege". A party claiming privilege must show, for each document separately, that it concerns a specific professional service by the lawyer, or that it was prepared for existing or anticipated legal proceedings. The court also held: "the mere fact that various proceedings took place between the parties, or that such proceedings were anticipated over the years, does not spread a wide net of immunity".
The court added that documents received from third parties do not become privileged merely because they passed through the lawyers. Otherwise, it wrote, clients could route any document through their counsel so that it would be covered by the privilege.
Why this matters here
The Zach decision concerned the discovery of documents in a lawsuit, not a request for access under the Privacy Protection Law. Its principle, however, belongs to the law of privilege itself: privilege is assessed document by document, not by the mere presence of a lawyer in the picture.
An economic investigation report on a person is information about that person: where he lives, what his phone numbers are, what assets he owns. According to the customer, the investigation was conducted in January 2024. The pledge execution request was filed in June 2024. The replies did not say when the report was prepared, who commissioned it, or for which proceeding.
The reason given, "information exchanged between the company and its lawyers", is precisely the kind of reason the court held to be insufficient on its own. These documents indicate that the refusal rested on a sweeping claim rather than on an examination of the document.
There is one more thing the reply confirms. If the report "was exchanged between the company and its lawyers", then it exists, and it passed from the company to the law firm. At the hearing, the company's representative said he was "not familiar" with it.
Who signed, and who is responsible
The Privacy Protection Law places the duty to answer an access request on the database controller. When the reply is sent from bank mailboxes, by bank employees, and signed in the name of the subsidiary, the customer cannot tell whose database holds his data. That is exactly the question he asked in his letter of 6 March 2026, and it went unanswered.
Read also: Bank secrecy: where did the personal data you gave Mizrahi Tefahot Bank end up? · Defamation in front of a bank representative: is Mizrahi Tefahot Bank liable for the words of attorney Dotan Tzur? · Mizrahi Tefahot Leasing car loan?
What this article does not establish
This article does not establish that the investigation report is not privileged. Only a court that reviews the report can decide that. The Zach decision was given by a single court and in a different type of proceeding. The messages stating that there was no loan in the customer's name are described according to his account.
Questions for Mizrahi Tefahot Bank
- Who is the controller of the database holding the customer's personal data: the bank or Mizrahi Tefahot Leasing?
- Why do bank employees answer privacy requests in the name of the subsidiary?
- When was the economic investigation report prepared, who commissioned it, and for which proceeding?
- Was each document examined separately before it was deemed privileged?
- Where are the messages in which the customer was told that there was no loan in his name?
This article is based on the access request of 9 January 2026, the bank's replies of 4 February and 5 March 2026, the customer's letter of 6 March 2026 and the transcript of the hearing of 13 January 2026 in file 515509-06-24, Haifa Execution Office. The employees' names and email addresses are not published. The bank's response will be published if received.
Frequently asked questions about the right of access to personal data
What is the right of access to personal data?
Under section 13 of the Privacy Protection Law, 1981, every person is entitled to inspect the personal data about them held in a database. The request is submitted to the database controller, for example a bank, and the regulations set a deadline for its reply.
What does attorney-client privilege cover?
Under the Evidence Ordinance [New Version], section 48(a), the privilege covers communications and documents exchanged between a lawyer and their client that are substantively connected to the professional service the lawyer provides to the client. The courts have held that it is not a blanket privilege and that each document must be examined separately.
Does a document become privileged because it was sent to a lawyer?
No. The Tel Aviv District Court held in a decision of 14 December 2016 that the mere fact that documents passed through a company's lawyers does not automatically make them privileged.
Can a bank refuse a data subject access request because legal proceedings are under way?
The Privacy Protection Law recognises exceptions to the right of access, including information whose disclosure would breach a privilege established by law. The existence of legal proceedings between the parties is not listed in the law as a general ground for refusal. The courts have held that proceedings between parties do not spread a wide net of immunity over all documents.
What can I do if the bank refuses my request to access my personal data?
You can file a complaint with the Privacy Protection Authority and appeal the refusal to the Magistrates' Court, under the Privacy Protection Regulations. Keep the request, the reply and the names of those who signed it.