Data Protection Guide 2023: Bermuda

Collecting personal information

Subject to certain limited exceptions, such as where the use is necessary to comply with a court order, organisations can only collect or otherwise use personal information where one or more of the following conditions are met:

• the personal information is used with the consent of the individual where the organisation can reasonably demonstrate that the individual has knowingly consented;
• except in relation to sensitive personal information (see below), a reasonable person giving due weight to the sensitivity of the personal information would consider that the individual would not reasonably be expected to request that the use should not begin or should cease and that the use does not prejudice the individual’s rights;
• the use of the personal information is necessary for the performance of a contract to which the individual is a party or for taking steps at the individual’s request with a view to entering into a contract;
• the use of the personal information pursuant to a provision of laws that authorise or requires such use;
• the personal information is publicly available and will be used for a purpose consistent with its public availability;
• the use of the personal information is necessary to respond to an emergency that threatens the life, health or security of an individual or the public;
• the use of the personal information is necessary to perform a task carried out in the public interest, or in the exercise of official authority vested in the organisation, or in a third party, to whom the personal information is disclosed; or
• the use of the personal information is necessary in the context of an individual’s present, past or potential employment relationship with the organisation.

The use of personal information means carrying out any operation on personal information, including collecting, obtaining, recording, holding, storing, organising, adapting, altering, retrieving, transferring, consulting, disclosing, disseminating or otherwise making available, combining, blocking, erasing or destroying it. However, that delineation may not be exhaustive and may include commercial exploitation, reliance upon for business purposes and in order to undertake assessments, and to engage in marketing activities.

Currently, as a matter of corporate governance best practice and in anticipation of PIPA’s proclamation into full force, many organisations have posted privacy notices that they may have “borrowed” from affiliated companies outside of the jurisdiction. However, before PIPA is proclaimed into full force, those organisations will want to review and revise where necessary those privacy notices to bring them into bespoke compliance with PIPA.

What constitutes valid consent?

Organisations who wish to rely on an individual’s consent to use their personal information are required to provide clear, prominent, easily understandable, accessible mechanisms for the individual to give consent. However, as noted, organisations are not obliged to provide such mechanisms where it can be reasonably implied from the individual’s conduct that they consent to their personal information being used for the purposes that they have been notified of. However, organisations cannot rely on implied consent in relation to the use of sensitive personal information (see below).

When an individual consents to personal information disclosure by an intermediary for a specified purpose, that individual will be deemed to have consented to the use of that personal information for the specified use purpose.

An individual will also be deemed to have consented to the use of their personal information for the purpose of coverage or enrolment under an insurance, trust, benefit or similar plan, if the individual has an interest in or derives a benefit from that plan.

Personal information already under an organisation’s control as at the date PIPA comes into full force will be deemed to have been collected with the individual’s consent. Therefore, personal information may continue to be used for the purposes for which it was collected. However, an individual’s consent for the collection and use of their personal information is not irrevocable. Organisations should be prepared to address individuals that may wish to expressly withdraw their consent when PIPA comes into force.

Individuals have the express right under PIPA to request organisations to cease using their personal information : for the purpose of advertising, marketing or public relations; where such use is causing (or is likely to cause) substantial damage, substantial distress to the individual or to another person; or where the personal information is no longer relevant for the purposes of its use.

Sensitive personal information

PIPA, like its North American counterparts, recognises the sensitivity and confidentiality of personal information lies on a continuum of both degree and corresponding regulatory oversight. Therefore, PIPA includes a category of “sensitive personal information” (SPI) that demands special treatment. SPI includes information relating to an individual’s race, national or ethnic origin, colour, sex, sexual orientation, sexual life, marital status, physical or mental disability, health, family status, religious beliefs, political opinions, trade union membership, and biometric or genetic information. Biometric information is defined as information relating to the physical, physiological or behavioural characteristics of an individual which allows his unique identification, such as facial images or fingerprint information.

Both SPI and all other personal information must be protected and kept secure in a manner “that shall be proportionate” and “appropriate”, in part, to the sensitivity of the personal information collected, stored and used by organisations. Therefore, organisations must be cognisant of the additional security safeguards required for sensitive personal information under PIPA. Such proportional safeguards might involve: obtaining separate consent; increased IT security; more frequent security testing and oversight; more onerous security and protection measures contractually imposed on third party data processors; or perhaps even data segregation and enhanced encryption solutions. Organisations retaining third-party service providers to store, process, use or otherwise manage any SPI, whether those service providers are domestic or overseas, must ensure the terms and conditions of those service contracts properly, adequately and robustly reflect (and flow down) the onerous nature of the organisation’s duties, requirements and statutory obligations to safeguard and protect such SPI.

Retention of Personal Information

Organisations must ensure the personal information they hold is accurate, kept up to date and is not retained longer than is necessary to fulfil the original collection purpose. PIPA does not prescribe data retention periods. Therefore, an assessment will need to be undertaken to determine how long personal information may be legally required to be kept in order to comply with a broad range of PIPA’s and other legal requirements, as well as how long it should be retained in accordance with PIPA’s “necessity of purpose” test. For example, business records containing personal information may be subject to a broad range of retention term requirements, including employment, as potential evidence in litigation or dispute resolution, or for other regulatory reasons.

Accessing Personal Information

Individuals are entitled to access and correct their personal information, and to direct that their personal information not be used for advertising, direct marketing or public relations (as noted above).

Individuals have the right to request access to:

• personal information about the individual in the organisation’s custody or control;
• the purposes for which the personal information has been and is being used by the organisation; and
• the names or types of persons to whom, and circumstances in which, the personal information has been and is being disclosed.

PIPA does not clearly stipulate whether or not an individual can require the organisation to provide access to only a delineation of the personal information about the individual that has been collected, shared and used by the organisation; or if the organisation is required to provide the individual with access to the actual records or documents in which such personal information is contained. Subject to the issuance of guidance on this topic, it is arguable that the public policy objectives of PIPA achieved as long as an individual can view, correct, qualify, clarify, augment or add to such information, which can be disclosed to the individual without having to provide the records and documents in which such personal information resides. Such records and documents will often (if not always) contain unrelated confidential and proprietary information of the organisation that would require time-consuming and expensive redaction. The organisation may choose to provide a copy of any such document but it is unclear (at this time) if it is obliged to do so.

When a personal information access request is delivered in writing by an individual to an organisation, the organisation must respond within 45 days. This may be extended by up to 30 days in certain circumstances, including where a large amount of personal information has been requested. The organisation is entitled to charge a reasonable fee for processing the request which may be payable before providing any such access.

pipa exceptions

Organisations should note that PIPA does not require individual consent for the processing of personal information in connection numerous situations, which include (among others):

• safeguarding national security;
• the protection of members of the public against financial loss due to dishonesty, malpractice or other seriously improper conduct by, or the unfitness, impropriety or professional incompetence of, individuals concerned in the provision of banking, insurance, investment, trust or other financial services, or in the management and ownership of an organisation; and
• the protection of charities against misconduct or mismanagement in their administration and from loss or misapplication of their property.

What Harm Is Caused If Personal Information Is Lost, Misused or Accessed Without Authorisation?

Section 13 requires organisations to use “appropriate safeguards” to protect the personal information it holds against the risks of loss, unauthorised access, destruction, use, modification or disclosure, and any other misuse. Those safeguards must be proportional to numerous factors, including the likelihood and severity of the harm threatened by the loss, unauthorised access or any misuse.

PIPA further stipulates such safeguards “… shall be proportional to … the sensitivity of the personal information … and the context in which it is held …”. In September 2021, the Privacy Commission published its guidance on the non-exhaustive types and severity of harm that may be caused, and hence the possible types of liabilities an organisation may suffer if section 13’s safeguarding prescriptions are not adhered to as follows:

• Physical harm
• Reputational harm
• Relationship harm
• Economic harm
• Emotional harm
• Chilling effect
• Discrimination harm
• Thwarted expectation
• Loss of control harm
• Data quality harm
• Lack of informed choice harm
• Disturbance harm
• Loss of autonomy harm

Of particular importance for PIPA compliance, under some other business regulation genres in Bermuda, is that PIPA arguably creates onerous statutory duties, standards of care and conduct prescriptions that, if not complied with, may create direct liability for organisations to compensate and remediate individuals who have been harmed by such failure.

Organisations should note that, data processing and other third-party service providers, including other organisations acting as an intermediary for personal information transmitted by a third party, are not liable under PIPA for any breach committed while acting in that capacity. The liability distinction under PIPA entirely remains with the organisation who contracted for such services. Therefore, the organisation must secure its rights of action and compensation against the third-party service provider pursuant to the terms and conditions of the relevant service contract.

Personal information can also be disclosed as part of a business transaction consisting of:

• the purchase, sale, lease, merger or amalgamation, or any other type of acquisition or disposal of, or the taking of a security interest in respect of, an organisation or a portion of an organisation; or
• any business, activity or business asset of an organisation, and includes a prospective transaction of such a nature.

Except for the minimum requirements, the general principles and rules of PIPA Part 2, and the rights of individuals’ provisions of PIPA Part 3, do not apply to several situation, including (among others):

• the prevention or detection of crime and compliance with international obligations regarding the detection, investigation and prevention of crime; and
• the economic or financial interests of Bermuda, including monetary, budgetary and taxation matters, compliance with international tax treaties, and any monitoring inspection or regulatory function exercised by official authorities for monetary, budgetary and taxation purposes in Bermuda;

to the extent that the application of those parts of PIPA would likely prejudice the conduct of any of the matters mentioned above.

International transfers of personal information (e.g. outsourcing)

Where an organisation provides any personal information to an overseas third party for use by that third party, whether on behalf of the organisation or for the third party’s own business purposes, “the organisation remains responsible for compliance with this Act”. Therefore, as a fundamental matter of PIPA compliance governance, organisations are strongly advised to ensure all of its “upstream” PIPA statutory obligations are contractually flowed “downstream” to all such overseas third-party service providers as fundamental and material obligations, duties, covenants, representations and warranties in the relevant service contract.

In addition, before personal information transfers are made to an overseas third party, the organisation must also assess:

• the level of protection actually provided by the overseas third party; and
• the level of protection afforded by the law applicable to such overseas third party.

As noted above, as a practical matter of PIPA compliance, organisations are always strongly advised to contractually ensure all of its PIPA compliance obligations are flowed down to its data processing service providers. Therefore, in all cases where it is reasonable to believe a third-party service provider may not safeguard and protect personal information in accordance with PIPA’s requirements, section 15(5) of PIPA requires the organisation to “employ contractual mechanisms, corporate codes of conduct including corporate rules, or other means, to ensure that the overseas third party provides a comparable level of protection”.

However, even though such compulsory contractual compliance management obligations will assist organisations to both comply with PIPA and allocate PIPA compliance risk to a service provider, that contractual transfer of risk will not diminish the organisation’s most fundamental statutory responsibility to remain fully and completely liable for the organisation’s unmitigated compliance with PIPA.

Where an organisation engages (by contract or otherwise) the services of a third party in connection with the use of personal information (whether domestic or overseas), the organisation remains responsible for ensuring compliance with PIPA at all times.

pipa’s implications for it service contracts

Increasingly, Bermuda businesses rely on the IT and data processing services of both domestic and overseas providers. The collection and use of personal information is a ubiquitous aspect of those services. Whether delivered as cloud services, back-office outsourcing, software (or data) “as a Service” transactions, or simply as affiliated company shared-service arrangements, the IT service contracts used for those transactions will soon become the subject of onerous legal compliance and regulatory scrutiny.

PIPA will trigger an array of regulatory restrictions and requirements, including: security safeguard requirements; proportional standards of protection; and the direct and non-transferable responsibility and liability of Bermuda organisations to comply with PIPA, regardless of what third-party IT service providers may perform, or in what jurisdiction they are performed. As a matter of both governance and risk management, and PIPA compliance, Bermuda organisations will be forced to re-evaluate and assess all of their existing and prospective IT service contracts from that new and onerous regulatory perspective.

PIPA is clear in its assertion that although Bermuda organisations can delegate the processing of data containing personal information to third-party IT service providers, they cannot delegate to others their unmitigated and direct responsibility to fully comply with PIPA’s personal information use, security, and protection duties and obligations. Obviously, the situation that IT executives, in-house counsel and compliance managers want to avoid is having their organisation caught in the middle between its upstream PIPA regulatory requirements and any downstream IT service arrangements that will not satisfy PIPA’s obligations.

In the event an IT service provider does not perform such contractually required PIPA obligations, only the Bermuda organisation will be: (1) held responsible and liable to compensate injured individuals and to respond to the Privacy Commission; and (2) exposed to reputational harm (which could be especially damaging if a PIPA breach concerns “sensitive personal information”, as defined in PIPA).

Therefore, the most efficient risk management, commercial and legal way for a Bermuda organisation to manage such IT service provider risk and potential liability is by integrating its PIPA obligations into all of its IT service arrangements. By ensuring all of its material PIPA compliance obligations are flowed down to its IT service providers in a well-drafted and robust IT service contract, IT service providers are thereby required to become partners in assisting their Bermuda customers to comply with legal and regulatory obligations.

Only well-drafted contractual privacy protection provisions containing detailed service specifications, service performance inspection rights, requirements for Privacy Commission cooperation, clear PIPA compliance covenants, representations, warranties and indemnities can, as a practical and legal matter, allocate the risk and liability that the Bermuda organisation may suffer for the service failures of their IT service providers (whether as an arms-length or affiliated IT service provider).

How is direct marketing regulated?

Bermuda has not enacted Anti-SPAM laws or regulations. However, the collection and use of personal information for direct marketing is subject to the right of an individual to request an organisation to not use, or to cease using, their personal information for advertising, marketing or public relations purposes. An individual may also request the deletion of their personal information by the organisation.

enforcement

PIPA establishes the Office of the Privacy Commissioner as an independent body to supervise and oversee the implementation of, and compliance with, PIPA. The exercise of the Privacy Commissioner’s functions “shall not be subject to the direction or control of any other person or authority”. The Privacy Commissioner’s appointment for a statutorily prescribed term of five years is intended to insulate that office from governmental direction or control.

The Privacy Commissioner has a very broad range of authority to monitor and, investigate and enforce how PIPA is administered and complied with, including (in part):

• conduct investigations concerning compliance with any provision of PIPA;
• educate the public about PIPA;
• engage in, or commission, research into anything affecting the achievement of the purposes of PIPA;
• issue formal warnings, admonish an organisation and bring to its attention any failure by the organisation to comply with PIPA or agree a course of action with an organisation; and
• liaise and co-operate with domestic and foreign law enforcement agencies, and regulators to the extent necessary to ensure the purposes of PIPA are achieved provided that there is no contravention of PIPA.

The Commissioner will also be responsible for liaising with domestic and foreign law enforcement agencies, and regulators in connection with PIPA.

What are the penalties for non-compliance with pipa?

Despite the generally remedial approach of PIPA and the compliance direction authority of the Privacy Commissioner, PIPA also creates the following offences:

(a) subject to certain exceptions, a person commits an offence if that person:

• wilfully or negligently uses or authorises the use of personal information in a manner inconsistent with Part 2, and is likely to cause harm to an individual or individuals;
• wilfully attempts to gain or gains access to personal information in a manner inconsistent with PIPA, and is likely to cause harm to an individual or individuals;
• disposes of or alters, falsifies, conceals or destroys personal information, or directs another person to do so, in order to evade a request for access to the personal information;
• obstructs the Privacy Commissioner or an authorised delegate of the Privacy Commissioner in the performance of the Privacy Commissioner’s duties, powers or functions under PIPA;
• knowingly makes a false statement to the Privacy Commissioner or knowingly misleads or attempts to mislead the Privacy Commissioner in the course of the Privacy Commissioner’s performance of the Privacy Commissioner’s duties, powers or functions under PIPA;
• knowingly or recklessly fails to comply with section 34(1) (restrictions on disclosure by Privacy Commissioner or staff);

(b) subject to certain circumstances, a person commits an offence if that person:

• fails to comply with an order made by the Privacy Commissioner under PIPA;
• fails to comply with a notice served by the Privacy Commissioner under PIPA;
• contravenes section 7 (sensitive personal information);
• disposes of, alters, falsifies, conceals or destroys evidence during an investigation or inquiry by the Privacy Commissioner; or
• fails to notify a breach of security to the Privacy Commissioner in accordance with section 14 (breach of security) of PIPA;

(c) a person who commits an offence under subsection (1) or (2) is liable:

• on summary conviction, in the case of an individual, to a fine not exceeding $25,000 or to imprisonment not exceeding two years or to both; and
• on conviction on indictment, in the case of a person other than an individual, to a fine not exceeding $250,000.

pipa & cybersecurity

PIPA addresses cybersecurity in the broader context of information technology regulation and other data security protocols. By requiring organisations to implement appropriate and proportional “safeguards”, PIPA arguably stipulates that a broad range of factors concerning personal information security must be considered which may involve information technology, cybersecurity, data management, personnel access restrictions and training, physical (premises) security and dedicated governance oversight related to such safeguards. As noted, those security measures are also required by PIPA in the context of personal information transfers to overseas third parties because organisations must assess “the level of protection” for personal information that such overseas third parties will provide. Sections 13 (Safeguards) and 15 (Overseas Transfer) are in Part 2 of PIPA, and section 47(1)(a) stipulates that a person commits an offence if that person “wilfully or negligently … authorises the use of personal information in a manner that is inconsistent with Part 2 and is likely to cause harm to an individual or individuals “(emphasis added).

Therefore, simple management decisions to authorise the use of personal information by overseas third parties without contractually requiring all of PIPA’s Part 2 security protection prescriptions may constitute an offence under PIPA.

Security breaches leading to the loss, unlawful destruction, unauthorised disclosure of, or access to, personal information which is likely to adversely affect an individual, must be reported by the organisation to the Privacy Commissioner and the affected individual without undue delay. PIPA also prescribes what such notices must disclose.

Failure to notify the Privacy Commissioner or the affected individual without undue delay of a breach is an offence for which the penalties set out above are applicable. Therefore, it is strongly recommended that organisations ensure their existing and future third-party service contracts include provisions requiring the service provider to notify the organisation of any such security breaches in full compliance with PIPA.