Guide to PIPA: Fairness

Summary

This is PrivCom guidance explaining the fairness principle under Section 8 of Bermuda's Personal Information Protection Act (PIPA). It sets out what organisations must do to ensure their use of personal information is both lawful and fair, and includes a self-assessment checklist.

• Lawful grounds: Organisations must identify valid, lawful grounds under PIPA for using personal information, including any additional conditions required for sensitive personal information or criminal offence information.
• No breach of other laws: Organisations must not use personal information in a way that breaches other laws, such as confidentiality duties, contractual obligations, copyright, industry-specific regulation, or the Human Rights Act 1981.
• Fair use: Personal information must be used in a manner that is not unduly detrimental, unexpected, or misleading to the individuals concerned, even where processing is otherwise lawful.
• Transparency: Organisations must inform individuals clearly, openly, and honestly from the outset about how their personal information will be used.
• Fair treatment of rights requests: Organisations must treat individuals fairly when they seek to exercise their rights over their personal information.

The guidance clarifies that lawfulness and fairness are separate but overlapping requirements: satisfying one does not excuse a breach of the other. It also notes that complaints primarily concerning breaches of copyright or other non-privacy laws generally fall outside PrivCom's remit and should be pursued through other regulatory channels.

Key obligations

• Identify valid, lawful grounds under PIPA before using personal information, including specific conditions for sensitive personal information or criminal offence information.
• Ensure that use of personal information does not breach other applicable statute or common law obligations (e.g. confidentiality, contract, copyright, industry regulation, Human Rights Act 1981).
• Use personal information only in ways that are fair, i.e. not unduly detrimental, unexpected, or misleading to individuals, and be able to justify any adverse impact.
• Inform individuals clearly, openly, and honestly from the start about how their personal information will be used.
• Do not deceive or mislead individuals when collecting their personal information.
• Treat individuals fairly when they seek to exercise their rights over their personal information.

Applies to

organisations