Personal Information Protection Act: Bermuda Fund Compliance

PIPA imposes certain personal information use rules, limitations, prohibitions and other prescriptions. Those include: the prohibition on collecting, using and maintaining any personal information that is excessive to the purposes that the personal information was lawfully and reasonably collected for; and the prohibition on retaining any personal information for any longer than is necessary for the purpose it was collected for.

PIPA also imposes a range of administrative and operational requirements on organisations. Although not an exhaustive list, these include: the appointment of a privacy officer; the adoption of suitable measures and policies to give effect to the organisation’s compliance with PIPA; the provision of a clear and easily accessible statement (“Privacy Notice”) informing individuals about specified aspects of the organisation’s practices and policies regarding its use of personal information; ensuring that all personal information is appropriately safeguarded from the harms addressed in PIPA; and, the prohibition from exporting any personal information to overseas third parties unless the export allowance criteria stipulated in PIPA can be satisfied.

As noted above, PIPA potentially applies to anyone that uses personal information in Bermuda. As such, these considerations are applicable to Bermuda based service providers of non-Bermuda funds.

The Office of the Privacy Commissioner for Bermuda has broad powers of investigation, dispute resolution, compliance oversight and the ability to take remedial or punitive action against organisations falling foul of PIPA.

In addition to actions that may be open to the Privacy Commissioner or individuals to enforce obligations under PIPA, the Bermuda Government’s Department of Public Prosecutions can also bring actions against organisations and individuals for PIPA related offences.

We recently highlighted that the Office of the Privacy Commissioner has now issued its first annual report and that its contents signal a change in focus from education and implementation to enforcement.

In the context of a Bermuda fund, we would advise that care is taken to ensure that the following steps have been undertaken:

• a review and (to the extent needed) update to policies and procedures to facilitate the Bermuda fund’s compliance with PIPA (policies are of course only as good as their implementation);
• adequate disclosure of the implications of PIPA to investors and the Bermuda fund in the fund’s offering documentation; and
• the appointment of a privacy officer and publication of a Privacy Notice which can either be accessed and viewed at a given URL or annexed to/form part of the fund’s subscription materials.

The Appleby team has advised a number of clients in this area and remains available should anyone need assistance with PIPA compliance and related risk mitigation of enforcement actions.