Personal Information Protection Amendment Act 2023 (2023:23)

Summary

This Act amends Bermuda's Personal Information Protection Act 2016 (PIPA) and makes consequential amendments to the Public Access to Information Act 2010 (PATI) and its Regulations, to align the two access-to-information and data protection regimes now that PIPA is in force. It makes a series of technical and substantive changes rather than introducing a wholly new regime.

• PIPA changes: Updates definitions (Minister), removes a Human Rights Act 1981 override in section 4, replaces terminology (name to contact details, rectifying to correcting), sets out grounds for the Commissioner's office becoming vacant, gives the Commissioner power to charge reasonable fees for services, extends a time period in section 37 from three months to six months, and allows the Minister to appoint different commencement days for different classes of organisation.
• PATI changes: Provides that PATI no longer applies to records containing a requester's own personal information once PIPA applies; requires public authorities to notify such requesters in writing to proceed under PIPA instead; repeals the PATI amendment-of-record provision (section 19); narrows and redefines personal information and related exemptions; adds the Office of the Privacy Commissioner to the list of public authorities under the PATI Schedule; and revokes several PATI Regulations no longer needed.
• Ministerial powers: Gives the Minister power to make further consequential and related amendments, and transitional and saving provisions, by negative resolution regulations.

The Act received assent on 17 July 2023, with an operative date of 1 January 2025, on which the amendments took effect.

Key obligations

• Public authorities must notify a requester in writing, within five working days of receiving a PATI request relating wholly or partly to their personal information, that they should proceed instead under the Personal Information Protection Act 2016.
• Public authorities can no longer process PATI requests for amendment/correction of personal information records once PIPA applies to those records; such requests must be redirected to PIPA.
• The Office of the Privacy Commissioner is now itself listed as a public authority under the PATI Schedule and is therefore subject to PATI's access obligations.

Applies to

organisations subject to PIPA, public authorities under PATI, Office of the Privacy Commissioner

Deadlines

• within five working days after receipt of the request: Public authority must give written notification to a requester that they should proceed under PIPA instead of PATI for personal information requests.
• 01 January 2025: Operative date on which the Act's amendments came into force.

Related documents

• This document amends Personal Information Protection Act 2016