PIPA is the first specific data protection law introduced in Bermuda.  Based on a set of internationally recognised privacy principles, the legislation regulates the processing of all personal data in Bermuda.  The law provides a framework of rights and duties designed to give individuals greater control over their personal information.  ‘Personal information’ is defined as any information about an identified or identifiable individual.

Whilst parts of PIPA have already come into force, the substantive provisions have been in limbo pending the appointment of a Data Privacy Commissioner.  In December 2019, the Governor announced that a Commissioner had been appointed and will take office on 20 January 2020.  We are now expecting a date to be set when PIPA will become fully operational.  Based on previous information from the Government, this date may be up to 12 months after the Commissioner takes office, to give businesses plenty of time to prepare.  We are also expecting the Commissioner to publish guidance in the coming months, aimed at helping organisations that use personal data understand and comply with their obligations.

Key features of the legislation include:

  • Data Protection Officer (DPO). PIPA requires organisations that use personal information to appoint a designated “privacy officer” who will have primary responsibility for communicating with the Commissioner.
  • Data Security. Organisations must put in place “appropriate” technical and organisational measures to prevent unauthorised access or unlawful processing of personal data, and against accidental loss, destruction or damage to personal data.
  • Proportionality and purpose limitation. Organisations shall ensure that the personal information it uses is not excessive and that it is only used for the specific purpose for which it was collected.
  • Transparency. Organisations are required to provide a significant amount of information to individuals at the time their data is collected, in the form of a “privacy notice”, including the purpose(s) for which the data is used, the identity of any third parties to whom the data may be disclosed and the name of the organisations DPO.
  • Data Breach Notification. In the event of a personal data breach, the organisation must notify the Commissioner and any affected data subjects of the breach without undue delay.
  • Data Access Rights. PIPA gives data subjects the right to obtain confirmation from an organisation that their personal information is being processed and to access that personal information.

Although it may be some time before the obligation to comply with PIPA becomes law, employers should in any event start to prepare for compliance.  A good first step is to undertake an internal data audit, to help understand exactly what personal information the organisation uses, where that data is held, the purpose(s) for which that data is used and where that data is transferred to and from.  It is also advisable to consider updating template employment contracts and internal policies in good time before the new law comes into force.

PIPA shares many similar features with the EU General Data Protection Regulation (GDPR).  This means that achieving compliance with one regime puts an organisation well on the way to achieving compliance with the other.  Some organisations in Bermuda may already be required to comply with the GDPR, or could be part of a group that does, so may be able to take advantage of work which has already been done.  Those organisations starting from scratch should not underestimate the burden of compliance and would be well-advised to start their preparations as soon as possible.

As much personal information used by an organisation is likely to relate to its employees, it would be prudent for HR practitioners to ensure they are involved in their organisation’s efforts to implement PIPA.  It is also advisable to keep an eye out for the further information and guidance which we expect the Commissioner to issue throughout the year.

Type

Insight

Locations

Bermuda

Share
Twitter LinkedIn Email Save as PDF
More Publications
5 Dec 2022

Business Crime and Investigations in Bermuda: Overview

A Q&A guide to business crime and investigations in Bermuda.

24 Nov 2022

Information Technology, Outsourcing, Privacy & Data Protection

All aspects of Bermuda's economy rely on information technology and data processing - an essential i...

Contributors: Duncan Card
22 Nov 2022

A Look Back on 2022 and What to Expect for 2023

As we approach the end of 2022, we are able to look back and say with certainty that the arena of la...

14 Nov 2022

When will the court enforce a promise?

As we all know, promises are made and broken all the time. What, if anything, can the law do to assi...

4 Nov 2022

Legally speaking: what not to do when outsourcing operations

In the course of my career, I have drafted, negotiated or otherwise provided commercial and legal ad...

1 Nov 2022

The Insolvency Review – Edition 10

The Insolvency Review offers an in-depth review of the most consequential features of the insolvenc...

25 Oct 2022

Bermuda: Mergers & Acquisitions Comparative Guide 2022

This country-specific Q&A provides an overview to Mergers & Acquisitions laws and regulati...

Contributors: Katie Blundy
24 Oct 2022

Directors’ duties on the eve of insolvency

It is common knowledge that directors of companies owe a duty to the company to act in its best inte...

Contributors: James Batten
13 Oct 2022

Employee probation periods: an update

The Employment Act 2000 is the island’s key piece of employment legislation, applicable to employe...

Contributors: Kiara Wilkinson
6 Oct 2022

Centre Stage: Bermuda’s Role In An Insurtech Revolution

Bermuda is rapidly becoming a focus for insurtechs seeking the island’s expertise, the accessibili...