Article 32 of Electronic Transactions Law

Except in cases authorized by law, government entities, public authorities or institutions, companies, non-governmental entities or their employees may not wrongfully access, disclose or publish any personal data or information recorded in records or electronic processing systems relating to persons' employment affairs, social history, health condition, or components of their financial estate, or other personal data recorded with any of the entities specified in this Article or their employees by virtue of their functions, unless this is done with the consent of the person to whom such data or information relates or his legal representative, or pursuant to a reasoned judicial decision. The entities specified in the first paragraph of this Article shall be obliged to state the purpose of collecting the said data and information, and such data and information shall be collected within the limits of that purpose.