Augmented Advocacy Series (Bermuda): PIPA and Anonymisation

Published: 29 Oct 2024

With the Personal Information Protection Act 2016 (PIPA) coming into force on 1 January, organisations in Bermuda face the critical challenge of balancing stringent data protection requirements with the increasing demand for data-driven information systems.

The use of these systems requires access to vast amounts of data, raising compliance concerns among tech-forward organisations.

PIPA applies to every organisation that uses personal information in Bermuda where that personal information is used wholly or partly by automated means or where it forms part of a structured filing system.

Under PIPA personal information (PI) means any information about an identified or identifiable individual.

The use of PI includes any operation performed on it, such as collecting, obtaining, recording, holding, storing, organising, adapting, altering, retrieving, transferring, consulting, disclosing, disseminating or otherwise making available, combining, blocking, erasing or destroying it.

Organisations must ensure that the use of PI is limited to specific purposes, as outlined under PIPA. If the purpose for using PI changes, consent should be obtained from the individual before their PI is used for the new purpose.

We note, however, that PIPA applies only to PI as defined above.

This means that where information is not about an identified or identifiable individual, that information will fall outside of PIPA’s scope.

Accordingly, where data is appropriately anonymised so that it does not constitute personal information, it can be used for other purposes, including information systems.

PIPA does not mention or define the term “anonymisation”. Interestingly, the 2024 amendment to the Bermuda Health Council Act 2004 refers to anonymisation of identifying information; however, it does not provide a definition, either.

Absent further regulatory guidance on this point and based on the definition of PI in PIPA, PI is therefore “anonymised” when it cannot be used on its own, or with any other information, to deduce or determine the identity of the individual to whom it relates, directly or indirectly.

There are various factors to consider when determining the degree of anonymisation needed. It is often not as simple as removing one’s name, address or phone number.

The amount and type of information needed to identify an individual can vary based on factors such as location and the source or form of the information.

Information may be unique — and thus identifying — within Bermuda’s smaller population compared with large, densely populated cities such as London or New York.

Biometric and genetic information are examples of PI that pose a higher risk of identification due to their distinctive nature, particularly in smaller populations.

Some more examples:

In a medical context: a distinct set of physical characteristics or medical conditions, that are not expressly associated with the name of an individual, could identify an individual patient and thus constitute PI.
In a finance context: a unique combination of rare financial instruments, investment types, and geographic locations could identify a specific investor.
In a real estate context: details about a property transaction, such as a landmark building or a specific location in a niche market, could lead to the identification of the buyer or seller.

As modern technology’s reliance on data continues to increase, organisations must be cognisant of the implications for data protection.

Anonymising data is one method of safeguarding PI but it requires careful examination and consideration of various factors.

When in doubt, obtaining consent from the individual to which the PI relates is the safest approach to ensuring your organisation remains compliant with its PIPA obligations.

Failing to adhere to these obligations could result in a potential fine of up to $250,000 or imprisonment for up to two years.

Authored by Associate Ligaya Sanchez-Wilson and Trainee Akira McDonald.

First Published in The Royal Gazette, Legally Speaking column, October 2024

More publications

7 Aug 2026

New CIMA Rules on AML/CFT/CPF Compliance and Financial Sanctions Issued in the Cayman Islands

On 20 July 2026, further to an industry consultation, the Cayman Islands Monetary Authority (CIMA) published the following two new Rules set to introduce binding risk management, governance, sanctions screening and other compliance requirements for regulated financial service providers in the Cayman Islands: (i) Rule on Effective Compliance Programmes for the Prevention and Detection of Money Laundering, Terrorist Financing and Proliferation Financing for Financial Services Providers (AML Rule); and (ii) Rule on Compliance with Financial Sanctions and Targeted Financial Sanctions (Sanctions Rule and, together with the AML Rule, the Rules). All CIMA-regulated financial services providers, including investment funds, insurers and reinsurers that are conducting ‘relevant financial business’ as defined under the Proceeds of Crime Act (Revised) (POCA) (FSP), are encouraged to review and update their documented framework of AML/CFT/CPF and sanctions compliance policies, procedures, controls, oversight and reporting mechanisms (Compliance Programmes) to ensure compliance with the Rules by the time they come into force on 18 September 2026.

Martin Byers, Maree Martin, Miriam Smyth, Menelik Miller

6 Aug 2026

The Rights of Sanctioned Litigants to access to the Court: Court of Appeal issues Key Decision in the BVI

The Eastern Caribbean Court of Appeal has delivered a significant judgment in AO Alfa-Bank v Kipford Ventures Limited, overturning a stay of proceedings and reinstating a US$142 million freezing injunction. The decision provides important guidance on access to justice, sanctions, and interim relief in the BVI.

Andrew Willins, KC, Tamara Cameron

JPLs, Directors and Arbitration: Grand Court Clarifies the Scope of Provisional Liquidators' Powers

5 Aug 2026

Good faith in action, not just belief: the UK Supreme Court’s decision in Saxon Woods Investments Limited v Costa and its significance in the Cayman Islands

May a company director depart from a strategy his board has agreed, in the sincere belief that he knows a better route to the company’s success? In Saxon Woods Investments Limited v Costa [2026] UKSC 21, the Supreme Court held that, whatever the answer, a director cannot pursue his own strategy by concealing it from, and misleading, his fellow directors. The Court confirmed that the good faith duty is not confined to a director’s sincerely held view of the company’s best interests; it also governs the means by which the director acts. The decision is an authoritative statement of the content of the fiduciary duty of loyalty, and is likely to be influential in the Cayman Islands. The decision will interest directors, those who advise or appoint them, and stakeholders affected by directors’ conduct.

Alan Bercow, Daniel Coelho

30 Jul 2026

Contingent Creditors, Standing And The Winding Up Jurisdiction: Analysing Re Petrosaudi International

The Cayman Islands Court of Appeal has delivered a highly significant judgment in Re PetroSaudi International.[1] The Court clarified the circumstances in which an alleged contingent creditor will have standing to petition to wind up a company under section 94(1)(b) of the Companies Act, and confirmed that there is no jurisdiction to make a winding up order on an ex parte without notice basis.[2] Our article analyses the Court of Appeal’s decision, and considers its implications for insolvency practitioners.

Harriet Ter-Berg, William Spence

30 Jul 2026

Final Means Final: Wei v Wang and the Common Law Enforcement of Foreign Judgments in the Cayman Islands

English Court Reaffirms Pro-Enforcement Approach to Foreign Judgments In Wei v Wang [2026] EWHC 1892 (Comm), the Court confirmed that exceptional avenues of review do not undermine the finality of a judgment and reiterated the limited scope of the natural justice defence.

Alan Bercow, Zuhair Farouki

28 Jul 2026

Drelle Overturned in Latest UK Supreme Court Decision

The United Kingdom Supreme Court in its recent decision in Drelle v Servis-Terminal LLC [2026] UKSC 29 (Drelle SC) has overturned the controversial decision of the English Court of Appeal in Servis-Terminal LLC v Drelle [2025] EWCA Civ 62 (Drelle CA), and in doing so has provided welcome clarity on the effect of unrecognised foreign judgments in cross-border bankruptcy and insolvency contexts. This is likely to have a wide-reaching impact – not only in the UK but also offshore – and particularly in the British Virgin Islands following the recent decision in JJW Hotels & Resorts Holding Inc v Rhodes (BVIHCM2025/0296) (JJW Hotels) (which relied heavily on Drelle CA), and in the Cayman Islands where previous authorities had recognised the ability, in the corporate context, for petitioners to present winding up petitions on the basis of an unrecognised foreign judgment.

Daniel Mitchell, Harriet Ter-Berg, Jae Shin

28 Jul 2026

Bermuda’s digital asset foresight bearing fruit

The wisdom of Bermuda’s pioneering approach in the digital asset business space has been underlined by the latest global economic impact figures compiled by McKinsey & Company, the global management consulting firm.

George McCallum

24 Jul 2026

Thalassa Investments LP: Section 22 and Specific Discovery - Strategic Considerations for Limited Partners Seeking Information and Documents

In Thalassa Investments LP [2026] CIGC (FSD) 32, the Grand Court refused an application by limited partner petitioners for specific discovery from the general partner in just and equitable proceedings to wind up a Cayman Islands ELP. The ruling was against the backdrop of serious lack of probity allegations made against the general partner by the petitioners. Notwithstanding those allegations, the Grand Court declined to make orders requiring discovery of various categories of documents to be used at trial. The ruling brings into focus the multiple routes potentially open to limited partners seeking information and/or documents from an ELP where there are allegations of mismanagement by the general partner. The limited partner may issue substantive proceedings (or, as in this case, present a just and equitable winding up petition) against the general partner and partnership, and then obtain documents through the usual discovery process. Alternatively, the limited partner may pursue its substantive right to true and full information under section 22 of the Exempted Limited Partnership Act first in order to help inform the bringing of a substantive claim, as was the approach in the Neoma (Abraaj) and the Port Fund litigation. Thalassa illustrates that the nature of the information sought, who holds it, and the legal basis on which disclosure is sought are all highly relevant to the outcome. The decision also highlights that section 22 and discovery serve different purposes, are governed by different legal tests and can produce different outcomes. The strategic question is not whether section 22 or the discovery process may be preferable in the abstract, but which legal framework best aligns with the limited partner’s objectives and the nature of the information sought.

Susan Fallan, Daniel Coelho, Hannah Oh

17 Jul 2026

Where foreign law governs international transactions: Key impact and considerations for Mauritian parties

We live in an era where the world’s economies, populations and cultures are growing interdependently thanks to cross border transactions and Mauritius, as an international financial centre holds an important position in the arena. We pride ourselves in the hybrid legal system that is in place constituting of a blending of both common law and civil law. Such legacy allows us to participate in international transactions, whether in the context of financings, mergers and acquisitions, joint ventures or commercial contracts, without much difficulty. It is therefore common for Mauritian entities to enter into agreements governed by foreign laws. One of the key clauses to the agreements governing these cross-border transactions is the choice of law and the agreed forum for dispute resolutions. This article explores the extent to which a Mauritian party can submit itself to the foreign laws governing international transactions.