Guidance for Organisations on Fees for PIPA Rights Requests

Summary

This is guidance from Bermuda's Office of the Privacy Commissioner (PrivCom) clarifying whether and how organisations may charge fees when individuals make PIPA Rights Requests (requests to access personal information or medical records under sections 17 and 18 of PIPA). It confirms that no fee schedule has been prescribed by the Minister as of 1 January 2025, when PIPA takes effect, so any fees charged are governed by PIPA's general reasonableness and fairness requirements rather than a fixed tariff.

• Statutory limits on fees: Fees are subject to a Minister-prescribed maximum (not yet set), cannot be charged where the request leads to correction of an error or omission, and cannot be charged if the organisation's professional body prohibits it.
• Acknowledgement obligations: Organisations must promptly acknowledge written requests, note any insufficient detail, and if a fee will be charged, quote it and state any advance payment requirement; the request is not complete until the individual confirms acceptance of the fee in writing.
• Reasonableness test: PrivCom will assess complaints about fees based on whether the organisation acted reasonably in the circumstances, including sensitivity/urgency of the information, whether the organisation is profiting, and whether costs reflect minimum-wage-level administrative time.
• Waiver for corrections: If a request results in correction of an error or omission (discovered by the organisation or reported by the individual), any fee must be waived or refunded.
• Format expectations: Digital files in standard formats should generally be provided free or for a nominal fee; fees for physical media or non-standard delivery may be reasonable to cover incurred expenses.

The guidance is interpretive only, does not constitute legal advice or binding precedent, and does not prevent PrivCom or other regulators from taking future action; PrivCom's position may change as the Government finalises a fee schedule.

Key obligations

• Organisations must promptly acknowledge a written PIPA Rights Request and state whether the request lacks sufficient detail.
• If charging a fee, the organisation must include a fee quote and payment terms in the acknowledgement and treat the request as incomplete until the individual confirms written acceptance of the fee.
• Organisations must not charge a fee where the request results in correction of an error or omission, and must waive or refund any fee already charged in such cases.
• Organisations must be able to demonstrate that any fee charged is reasonable, fair, and not profit-generating.
• Organisations must not charge a fee if doing so is prohibited by their professional or industry regulatory body.
• Organisations should reduce or waive fees where personal information is especially sensitive, impactful, risky, or urgently needed by the individual.
• Organisations should provide digital files in standard formats for free or a nominal fee, reserving fees for physical media or non-standard delivery.

Applies to

organisations subject to PIPA

Deadlines

• 1st January 2025: PIPA enters into effect; PrivCom confirms no fee schedule will be prescribed by the Minister as of this date, so general reasonableness/fairness rules govern fees in the interim.