It is all about the data

Whether improving hospital patient outcomes, transforming government services, improving retail customer experiences, or better assessing insurance risk and pricing models, there is one common factor — they all require tremendous amounts of data, much of it comprised of personal information.

Although data used to be like air — free and unencumbered for all to access and consume — those days are long gone. Feeding the analytics beast, whether with raw or configured data, requires significant legal consideration.

For decades before the advent of privacy law, the creation, collection, ownership and the rights to use another person’s business information, including personal information, was legally protected in many different ways.

Business data may be proprietary to the person who provided or created it, or it may constitute commercial or personal information that is protected by the common law principles of confidentiality that originally took shape in Britain in the late 1960s.

Other information might be rigorously protected because of its connection to intellectual property, such as trade secrets, data analytic methodologies that are not otherwise patentable, knowhow, and even residual knowledge in the minds of employees.

The use of data might also be restricted because it was disclosed in the context of a fiduciary relationship, such as with trustees, corporate directors, partners or agents.

Certain other information may be expressly protected from restricted or unauthorised use by statute in various jurisdictions, such as hospital patient records or information that is used by industry regulators or tax authorities.

In addition to those data use restrictions, Bermuda’s new privacy law, the Personal Information Protection Act 2016, will add a new and powerful dimension to the legal considerations that are needed when accessing or using personal information in either a commercial or public sector context when it comes into force on January 1, 2025.

Traditionally, those rights have been managed by contractual terms and conditions that are implemented at the very source of data creation or disclosure, including agreements, consents, waivers and permissive use licences.

Today, the upstream users of data generally seek the representations, warranties and indemnities from the original collectors or creators of the data to ensure that their subsequent use of that data will not breach the rights of any third parties.

However, for data that is subject to Pipa, contractual solutions alone will not cure all aspects of data collection and use because the privacy rights of an individual concerning their personal information under Pipa will apply regardless of any agreement to the contrary, and any attempted waiver or release of an individual’s rights, benefits or protections under Pipa will be void.

Obviously, any existing contractual strategies to manage the legal risks of data collection and use may have to be reconsidered in the light of Pipa. Data collection agreements, licence use rights, representations, warranties, consents and waivers may now require a few revisions before that data is subsequently fed along any chain of third-party use.

Where personal information is initially provided for one reason and in a specific originating context, but will ultimately be required for other upstream purposes, all users of that personal information — some of whom may be many steps removed from the granting individuals — will need to tread carefully.

They must ensure that such upstream uses of that personal information will comply with all related law, including Pipa and all downstream contractual rights and consents, as well as ensuring that such use will not offend any other rights that individuals may have to protect their information privacy, property or confidentiality.

The initial collectors of data, especially where it includes personal information, would be wise to ensure that they have secured the rights that will legally permit all of the intended upstream uses of that data so that it complies with all data protection laws, including Pipa.

First Published in The Royal Gazette, Legally Speaking column, May 2024