Guide to PIPA: Correction & blocking

Summary

This is PrivCom's guidance on the right to correction under section 19 of Bermuda's Personal Information Protection Act (PIPA), covering how organisations should handle requests from individuals to correct or complete inaccurate or incomplete personal information, and related good practice on blocking information while accuracy is verified.

• Recognising requests: A valid correction request must be in writing but need not cite PIPA or use specific wording; staff who interact with individuals should be trained to spot such requests.
• Response timeline: Organisations must respond without undue delay and within 45 days of receipt, extendable by a further 30 days if the request is complex or multiple requests have been received, and possibly a further 30 days where section 20(6) applies.
• Assessing accuracy: Organisations must take reasonable steps proportionate to the significance of the information to verify accuracy, considering the individual's arguments and evidence.
• Blocking pending review: As good practice, the personal information in question should be blocked from use while its accuracy is being verified.
• Refusal grounds: Requests may be refused only if manifestly unreasonable, assessed case by case rather than by blanket policy, and organisations must be able to justify the refusal to the individual and to the Commissioner if asked.
• Notifying third parties: If the information has been disclosed to other organisations, those organisations must be notified of any correction (unless unreasonable to do so), and the individual must be told which organisations received their data.
• Identity verification: Organisations may request ID to confirm the applicant's identity, but the response clock does not start until identifying information is received; ID requests should be made promptly.

The guidance also addresses edge cases, such as records of resolved mistakes or disputed opinions, and requires organisations to inform individuals of the outcome of a request, including reasons for refusal and the right to complain to PrivCom.

Key obligations

• Respond to a written request for correction without undue delay and within 45 days of receipt.
• Take reasonable steps to verify the accuracy of the challenged information and correct or complete it, or provide a supplementary statement, if necessary.
• Notify the individual and explain the decision if satisfied the information is accurate and no correction will be made, including informing them of their right to complain to PrivCom.
• Assess any refusal on a case-by-case basis (not via blanket policy) and be able to justify to the individual and, if asked, to the Commissioner why a request is manifestly unreasonable.
• If refusing a request, inform the individual within 45 days of receipt of the reasons for refusal and their right to complain to PrivCom.
• Notify any other organisations to which the personal information was disclosed of the correction, unless unreasonable to do so, and inform the individual which organisations received the disclosure.
• If extending the response time by up to 30 days, notify the individual, explain the reason for the extension and when a response can be expected.
• As good practice, block use of the personal information while verifying its accuracy and log/record correction requests received.

Applies to

organisations (data controllers under PIPA)

Deadlines

• 45 days: Deadline to respond to a request for correction, without undue delay and at the latest within 45 days of receipt.
• additional 30 days: Extension available if the request is complex or multiple requests have been received from the individual.
• additional 30 days (if section 20(6) applies): Further extension period referenced for cases where section 20(6) of PIPA applies.