GDPR extends to data controllers and data processors located outside the EU, where data is processed in connection with the offer of goods and services to individuals in the EU or who monitor their behaviour. Of particular note, insurance and reinsur­ance companies located outside of the EU (and, therefore, operating outside of scope of the existing EU data protection regime) may find themselves to be subject to GDPR if they insure/reinsure EU customers.

While the ever-increasing scope of inter­national regulation may be lamented in some quarters, it is welcomed by those who wish to live and work in a modern, sophis­ticated and protected environment. But, in the case of laws that have an extraterritorial impact, it is sometimes difficult for compa­nies to gauge whether or not their activities fall within the accepted parameters of such laws. The good news for Bermuda entities is that the Personal Information Protection Act 2016 (PIPA) is due to come into full effect by December 2018.

PIPA will apply to every organisation that uses personal information by automated means and personal information used other than by automated means that forms part of a structured filing system. It will also regulate the use of personal information by organisations in a manner which recognises the need to protect the rights of individuals In relation to their personal information and the need for organisations to use personal information for legitimate purposes.

PIPA was prepared with the specific aim of achieving adequacy in the EU, thereby enabling the free flow of personal data between EU member states and Bermuda. As a result, there are similar themes underpinning GDPR and PIPA, such as:

organisations are to provide a significant amount of information to individuals at the time of collection of their data

data subjects have the right to obtain confirmation that their data is being pro­cessed and to access that personal data to respond to a subject access request (one month with GDPR and 45 days with PIPA)

personal data should not be kept for longer than is necessary to fulfil the purpose for which it was collected (pre­scribed data retention periods are not set out in either law but an analysis will need to be undertaken to determine how long different types of data should be retained)

if data subjects wish to have their data removed, and the data is no longer required for the reasons for which it was collected, then it must be erased

international transfer of data is permit­ted, provided certain criteria have been satisfied.

As a result, by complying with one regime, Bermuda companies will ensure they are well placed to comply with the other.

Compliance with these new regimes will become an important part of the day-to-day operations of most companies, and Ber­muda companies would do well to ensure they satisfy their obligations under PIPA and GDPR because the consequences for breach are considerable and include:

GDPR: a maximum fine of €20m or 4% of annual worldwide turnover

PIPA: corporations may be fined up to BM$250,000, while individuals may be fined up to BM$25,000 and/or impris­oned for a term of two years.

GDPR will extend to the operations of Bermuda companies in the EU, and PIPA will apply to all Bermuda companies. Bermuda insurers, in particular, will be affected by these regulatory regimes due to the nature of their business. With GDPR now in effect, and PIPA following close behind, the importance of compliance can­not be underestimated.

Share
Twitter LinkedIn Email Save as PDF
More Publications
8 Aug 2019 |

Summary of Economic Substance Requirements in Bermuda, the British Virgin Islands and the Cayman Islands

Economic Substance Requirements in Bermuda, the British Virgin Islands and the Cayman Islands

Contributors: Shana Simmonds
5 Aug 2019 |

Probationary Periods – Importance of Dates when Considering Extensions

New employment is not always a smooth process. The employer and employee both need to adjust to new ...

24 Jul 2019 |

Legal Frontiers in Bermuda

The Asia-Pacific region has seen a surge of fintech start-ups, service providers, suppliers, investo...

Contributors: Fiona Chan
19 Jul 2019 |

Landscape of Bermuda financial sanctions

In the ever-changing world of politics and their related global financial sanctions, it is imperativ...

18 Jul 2019 |

Bermuda ILS overhaul welcomed but will new vehicles take off?

The ILS market has broadly welcomed moves by the Bermuda Monetary Authority (BMA) to create a new co...

8 Jul 2019 |

Bermuda to introduce new classes of insurers

Bermuda’s commitment to providing innovative solutions in the ever-evolving insurance marketplace ...

3 Jul 2019 |

Directors Unexpected Payroll Tax Liability

Payroll tax is levied against every employer, employee, self-employed person and deemed employee. Wh...

1 Jul 2019 |

Latest Developments in Bermuda’s Economic Substance Regime

The Economic Substance Amendment Act 2019 (Amendment Act) became operative on 28 June 2019. Bermuda ...

Contributors: Sally Penrose
26 Jun 2019 |

Regulatory Headwinds

Faced with increased scrutiny from regulators on both global and jurisdictional levels, businesses m...

Contributors: David Dorgan
24 Jun 2019 |

Appleby’s Adderley: Bermuda Eases Path to Collateralised ReInsurance

Partner Brad Adderley speaks to A.M. Best at the recent Bermuda Captive Conference. Brad says “Ber...