Whether improving hospital patient outcomes, transforming government services, improving retail customer experiences, or better assessing insurance risk and pricing models, there is one common factor — they all require tremendous amounts of data, much of it comprised of personal information.

Although data used to be like air — free and unencumbered for all to access and consume — those days are long gone. Feeding the analytics beast, whether with raw or configured data, requires significant legal consideration.

For decades before the advent of privacy law, the creation, collection, ownership and the rights to use another person’s business information, including personal information, was legally protected in many different ways.

Business data may be proprietary to the person who provided or created it, or it may constitute commercial or personal information that is protected by the common law principles of confidentiality that originally took shape in Britain in the late 1960s.

Other information might be rigorously protected because of its connection to intellectual property, such as trade secrets, data analytic methodologies that are not otherwise patentable, knowhow, and even residual knowledge in the minds of employees.

The use of data might also be restricted because it was disclosed in the context of a fiduciary relationship, such as with trustees, corporate directors, partners or agents.

Certain other information may be expressly protected from restricted or unauthorised use by statute in various jurisdictions, such as hospital patient records or information that is used by industry regulators or tax authorities.

In addition to those data use restrictions, Bermuda’s new privacy law, the Personal Information Protection Act 2016, will add a new and powerful dimension to the legal considerations that are needed when accessing or using personal information in either a commercial or public sector context when it comes into force on January 1, 2025.

Traditionally, those rights have been managed by contractual terms and conditions that are implemented at the very source of data creation or disclosure, including agreements, consents, waivers and permissive use licences.

Today, the upstream users of data generally seek the representations, warranties and indemnities from the original collectors or creators of the data to ensure that their subsequent use of that data will not breach the rights of any third parties.

However, for data that is subject to Pipa, contractual solutions alone will not cure all aspects of data collection and use because the privacy rights of an individual concerning their personal information under Pipa will apply regardless of any agreement to the contrary, and any attempted waiver or release of an individual’s rights, benefits or protections under Pipa will be void.

Obviously, any existing contractual strategies to manage the legal risks of data collection and use may have to be reconsidered in the light of Pipa. Data collection agreements, licence use rights, representations, warranties, consents and waivers may now require a few revisions before that data is subsequently fed along any chain of third-party use.

Where personal information is initially provided for one reason and in a specific originating context, but will ultimately be required for other upstream purposes, all users of that personal information — some of whom may be many steps removed from the granting individuals — will need to tread carefully.

They must ensure that such upstream uses of that personal information will comply with all related law, including Pipa and all downstream contractual rights and consents, as well as ensuring that such use will not offend any other rights that individuals may have to protect their information privacy, property or confidentiality.

The initial collectors of data, especially where it includes personal information, would be wise to ensure that they have secured the rights that will legally permit all of the intended upstream uses of that data so that it complies with all data protection laws, including Pipa.

First Published in The Royal Gazette, Legally Speaking column, May 2024

Twitter LinkedIn Email Save as PDF
More Publications
23 May 2024

Regulatory oversight is key for Bermuda’s insurance sector

Bermuda’s thriving insurance and reinsurance sector requires effective regulatory oversight if it ...

3 May 2024

Best Practices for Conducting Investigations into Employee Grievances

Grievance procedures are very important, but often overlooked, procedures that all employers should ...

25 Apr 2024

Trusts, and how they came to be

What traces its history through Ancient Rome and the Crusades, can have many de facto owners, none a...

8 Apr 2024

Electronic dissemination of corporate communications by Hong Kong listed issuers from an offshore perspective

In June 2023, The Stock Exchange of Hong Kong Limited published consultation conclusions to its cons...

3 Apr 2024

Bermuda: Lack of New Players Is Supporting Strong Interest in ILS

All signs point to another very strong year for the catastrophe bond and related insurance-linked se...

2 Apr 2024

Choosing the right structure for your business in Bermuda

Anyone seeking to set up a business in Bermuda has a variety of options, depending on the nature of ...

25 Mar 2024

PIPA Compliance is Not Just a Domestic Affair

As organizations in Bermuda prepare for the full application of the Personal Information Protection ...

25 Mar 2024

How Bermuda trusts can help with worldwide estate planning

Trusts still have an important role to play in onshore tax planning, as acknowledged by the British ...

14 Mar 2024

Privacy Rights Extend Outside Bermuda

As Bermuda prepares for the full application of the Personal Information Protection Act 2016 on Janu...

14 Mar 2024

Bermuda trusts can offer substantial inheritance tax advantages to non-doms following UK budget announcement

The UK government has recently announced radical changes to the way in which non-domiciled individua...