Guide to PIPA: Conditions for personal information use

Summary

This guidance from the Bermuda Privacy Commissioner explains section 6 of the Personal Information Protection Act (PIPA), which sets out the legal conditions an organisation must satisfy before it may use an individual's personal information. It applies to any organisation that processes personal information in Bermuda and is intended to help such organisations identify a valid basis for use.

• Primary conditions (s.6(1)): An organisation may use personal information only if one of several conditions applies, including knowing consent; use that a reasonable person would not expect to be objectionable and does not prejudice the individual (non sensitive data); necessity for a contract; use required or authorised by law; use of publicly available information consistent with its public purpose; emergency response necessity; public interest or official authority tasks; or necessity in the employment relationship.
• Consent mechanics (s.6(2)): Where relying on consent, organisations must provide clear, prominent, easily understandable and accessible consent mechanisms, except where consent can reasonably be implied from conduct (not applicable to sensitive personal information); consent given to an intermediary can extend to a receiving organisation for the same specified purpose; and consent is deemed given for enrolment in insurance, trust or benefit plans where the individual benefits.
• Fallback conditions (s.6(3)): If none of the subsection (1) conditions can be met, use is permitted only for narrow purposes such as information exchanged with a public authority under statutory authority, compliance with a court or other order, contacting next of kin of an injured, ill or deceased person, debt collection or repayment, disclosure to a surviving spouse or relative of a deceased individual, or defending the organisation in legal proceedings.
• Overseas transfers (s.6(4)): Where personal information is transferred to an overseas third party, the organisation must meet the section 6 conditions in addition to the separate obligations under section 15 of PIPA.

The guidance is explanatory and restates statutory conditions rather than introducing new obligations beyond PIPA itself; it does not state an effective date or transitional period.

Key obligations

• An organisation may use an individual's personal information only if it can rely on one of the conditions listed in section 6(1) of PIPA (consent, contractual necessity, legal authorisation, public availability, emergency, public interest/official authority, or employment relationship).
• Where relying on consent, an organisation must provide clear, prominent, easily understandable and accessible mechanisms for individuals to give consent.
• If none of the section 6(1) conditions can be satisfied, an organisation may use personal information only for the limited purposes listed in section 6(3) (statutory public authority exchange, court order compliance, contacting next of kin, debt collection/repayment, disclosure to a deceased individual's spouse or relative, or legal defence).
• Where personal information is transferred to an overseas third party, the organisation must also comply with the obligations under section 15 of PIPA in addition to the section 6 conditions.

Applies to

organisations that use personal information subject to PIPA