Guide to PIPA: Exemptions

Summary

This guidance from the Bermuda Office of the Privacy Commissioner explains the exemptions and exclusions available under Part 4 of the Personal Information Protection Act (PIPA). It sets out when organisations may be relieved of some or all PIPA obligations, and stresses that exemptions must be assessed case-by-case rather than applied routinely.

• Exclusions (section 4): Certain uses of personal information fall entirely outside PIPA's scope, including purely domestic or household activity, artistic/literary/journalistic use for publication in the public interest, use of business contact information to reach an individual as an employee or official, information transferred to an archival institution under a pre-existing access agreement, court file information used by judges or law enforcement, personal notes of individuals acting in a judicial or quasi-judicial capacity, and use by a Member of the House of Assembly or Senate covered by parliamentary privilege.
• Exemptions (Part 4): National security exemption, communication provider exemption, regulatory activity and honours exemption, and general exemption may relieve an organisation of some PIPA rights and obligations (e.g. right to be informed, right of access, breach reporting, certain principles) but only to the extent PIPA compliance would prejudice, prevent, or seriously impair the organisation's purpose.
• Three compliance levels: Full compliance applies where no exemption or exclusion applies; partial exemption applies under sections 22, 24 and 25 where minimum requirements still apply; no compliance is required for uses excluded under section 4.

Organisations are expected to justify and document, on a case-by-case basis, their reliance on any exemption, and to revert to full PIPA compliance once an exemption ceases to apply.

Key obligations

• Organisations must assess reliance on any PIPA exemption on a case-by-case basis rather than applying it routinely or in blanket fashion.
• Where relying on an exemption, organisations must consider the extent to which PIPA requirements would prevent, seriously impair, or prejudice their processing purposes.
• Organisations must justify and document their reasons for relying on an exemption.
• When an exemption does not apply or no longer applies, organisations must comply with PIPA requirements as normal.

Applies to

organisations processing personal information in or from Bermuda