Guide to PIPA: General exemption

Summary

This guidance explains the general exemption under section 25 of Bermuda's Personal Information Protection Act (PIPA). It sets out the specific purposes for which organisations processing personal information may be excused from certain PIPA obligations, and clarifies that the exemption only applies where complying with those obligations would likely prejudice the relevant purpose.

• Qualifying purposes: Processing for crime prevention/detection and related international obligations, apprehension or prosecution of offenders, assessment or collection of tax or duty, investigation of breaches of ethics by regulated professionals, or Bermuda's economic and financial interests (including tax treaty compliance and related regulatory monitoring).
• Provisions that may be exempted: The right to be informed, other individual rights, the duty to notify individuals of personal information breaches, the lawfulness and fairness principle (except the requirement to use information lawfully), the purpose limitation principle, and other principles insofar as they relate to the right to be informed and individual rights.
• Prejudice test: The exemption applies only to the extent that complying with the relevant provision would likely prejudice the organisation's purpose of use; otherwise normal PIPA compliance is required.
• Illustrative scenario: A bank investigating suspected fraud may withhold notice to affected customers before sharing an investigation file with the Financial Intelligence Agency, where informing them would risk them absconding or destroying evidence.

Organisations relying on this exemption must be able to justify, on a case by case basis, that compliance with the specific PIPA provision would likely prejudice their stated purpose; where that prejudice test is not met, full compliance with PIPA remains required.

Key obligations

• Before relying on the general exemption, an organisation must assess whether complying with the specific PIPA provision (e.g. right to be informed, breach notification) would likely prejudice its qualifying purpose (such as crime prevention, tax assessment, or ethics investigations).
• Where compliance would not likely cause such prejudice, the organisation must comply with PIPA as normal, including honouring individual rights and breach notification duties.
• Organisations must continue to use personal information in a lawful manner even when relying on the exemption from the lawfulness and fairness principle.

Applies to

organisations processing personal information under PIPA, data controllers, banks and financial institutions, regulated professionals