Background
Nona Day filed a class-action certification request in March 2024 against Clalit Health Services, Israel’s largest health-maintenance organization, alleging a serious security lapse in its telephone service center (reached by dialing *2700). According to the petition, any caller could obtain personal or medical information about a Clalit member simply by entering that member’s national ID number — no additional verification was required. Day argued this breached Clalit’s duties of medical confidentiality and violated its members’ right to privacy. The claim was brought under Item 1 of the Second Schedule to the Class Actions Law, 2006, which covers consumer claims against a “business” (as defined in the Consumer Protection Law) in connection with a customer relationship.
The litigation had a complicated procedural history. A prior certification request had been filed before the Tel Aviv Regional Labor Court in September 2022 but was struck out in January 2024 after Day herself asked to transfer it to the District Court following Clalit’s jurisdictional challenge. The new petition was filed in the Lod Central District Court. After written submissions, one hearing, and failed settlement talks, the District Court (Judge Carmit Ben-Eliezer) dismissed the petition on 13 August 2025, holding that Clalit operated its telephone center in its public, statutory capacity under the National Health Insurance Law, 1994 — not as a “business” for Consumer Protection Law purposes — and therefore could not be sued under Item 1 of the Second Schedule. The court also imposed costs of NIS 25,000 on Day. Day appealed.
At a pre-appeal hearing on 4 February 2026, the Supreme Court (Justice Ofer Grosskopf writing, joined by Justices Yael Wilner and Ruth Ronen) proposed that Clalit remedy the privacy deficiency and that the parties then agree on a compensated withdrawal. After several status updates, Clalit reported in May 2026 that it had implemented a technological fix: the automated telephone service now delivers information only when the caller’s mobile number is registered in Clalit’s systems and matches the national ID entered; if no match is found, no information is disclosed. Clalit also added privacy-policy notices on its website, patient guide, and mobile application. The petitioner and her counsel reviewed and accepted these changes as satisfactory, effectively mooting the substantive class action, though the parties could not agree on fees.
The Court’s Holding
The Supreme Court accepted the appeal, annulled the District Court’s judgment in its entirety (including the cost award), and struck the certification request rather than dismissing it. The court explained that, because Clalit had cured the problem underlying the petition and the petitioner was satisfied with the remedy, there was no longer any utility in continuing the class action. Ending the proceedings by withdrawal — rather than dismissal — was appropriate because a withdrawal order does not create res judicata against individual class members, leaving open the right of any member who suffered actual harm to sue on the same cause of action independently.
On the question of fees and compensation in a withdrawal scenario, the court applied the framework set out in CA 8114/14 Markit Products Ltd v. Sonol Israel Ltd (2018) (“the Markit rule”). Under that rule, fees are the exception rather than the norm when a class action ends in withdrawal from a certification request. Courts may award them only when the petition disclosed a prima facie cause of action and the proceedings produced genuine, concrete benefit for class members — and even then the amounts should be materially lower than those awarded after a successful settlement or judgment. The court found both conditions met: the petition was not frivolous, it raised a legitimate prima facie privacy claim involving sensitive medical information, and Clalit itself acknowledged that the filing accelerated implementation of the technological fix benefiting approximately 5.5 million members.
Nevertheless, the court sharply reduced the amounts sought. It awarded petitioner Day a personal reward (gmal) of NIS 25,000 (plus VAT) and attorneys’ fees of NIS 100,000 (plus VAT) — a fraction of the NIS 159,000 reward and NIS 636,000 in fees requested. The court noted that the scope of the potential privacy harm had not been fully established, that the technical fix was not complex, that the actual proceedings at both the Labor Court and District Court levels were relatively brief and straightforward, and that each party bore partial responsibility for the prolonged litigation: Day had refused reasonable settlement offers, while Clalit had delayed remedying the deficiency for years. The court also directed Clalit to reimburse Day for court fees paid in the District Court proceedings, but declined to order a payment to the statutory class-action fund under Section 27a of the Class Actions Law, as that request was unsupported by any evidentiary foundation.
Key Takeaways
- A class-action certification request that is mooted by the defendant’s voluntary remedial action should be ended by withdrawal (striking) rather than dismissal, preserving individual class members’ rights to sue for actual damages.
- Under the Markit rule, fee awards in withdrawal cases require both a prima facie cause of action and demonstrable, concrete benefit to the class; amounts must be calibrated downward compared to settled or adjudicated cases, and upward only in proportion to genuine public importance.
- Clalit’s telephone service centre authentication gap — allowing access to member information with only a national ID number — constituted a cognisable prima facie privacy violation involving medical information, notwithstanding Clalit’s statutory public-health role.
- The Supreme Court noted, without deciding, that in light of RCA 8772/23 Maccabi Health Services v. Anonymous (2024), exclusive subject-matter jurisdiction over this type of claim likely belongs to the Labor Court, not the District Court — a point relevant for future filings of similar class actions against health funds.
- Procedural misconduct by both sides — the petitioner’s refusal of court-mediated settlement offers and Clalit’s years-long delay in fixing a known vulnerability — was treated as roughly offsetting, affecting but not eliminating the fee award.
Why It Matters
The decision reinforces that health maintenance organizations in Israel are not fully insulated from consumer-protection class actions by virtue of their statutory status; a petition premised on a privacy deficiency in their service operations can constitute a legitimate class claim and, if pursued to a successful remedy, entitle counsel to at least modest compensation even when the case ends in withdrawal. It also sends a clear signal to defendants: dragging out a known privacy vulnerability while litigation is pending will be treated as a negative factor when courts assess the proportionality of any fee award.
More broadly, the ruling applies and refines the Markit framework in the context of medical privacy — an area of heightened sensitivity under Israeli law — and illustrates how courts can use the pre-appeal hearing mechanism to engineer practical, non-adversarial solutions (a technological fix plus withdrawal) that protect class members without requiring a full merits adjudication. Practitioners advising clients facing class-action certification in the health or privacy space should note both the jurisdictional guidance pointing toward the Labor Courts and the court’s willingness to use withdrawal with modest compensation as a pragmatic resolution tool.