Guide to PIPA: Integrity of personal information

Summary

This is guidance from Bermuda's Privacy Commissioner explaining Section 12 of PIPA, the integrity principle for personal information. It applies to any organisation that collects, uses, or holds personal information under PIPA, and sets out what accuracy and retention duties mean in practice, with a self-assessment checklist and worked scenarios.

• Accuracy: Organisations must ensure personal information used is accurate and not incorrect or misleading as to any matter of fact, taking reasonable steps proportionate to the risk and consequences of inaccuracy.
• Currency: Information must be kept up to date only to the extent necessary for the purpose it is used for; there is no blanket duty to keep all records current.
• Retention limit: Personal information must not be kept for longer than necessary for the use in question.
• Correction and challenges: Organisations must carefully consider any challenge to accuracy and, where information is found inaccurate, correct or erase it as soon as possible.
• Security for integrity: Appropriate security measures must be in place to protect personal information from unintentional modification, and modification only by properly authorised persons.
• Source recording: When compiling information, organisations should accurately record both the information and its source, and assess the reliability of that source.

The guidance also links integrity obligations to individuals' right to correction and to the separate security principle, and provides a checklist organisations can use to test compliance with Section 12.

Key obligations

• Organisations must ensure personal information used is accurate and kept up to date to the extent necessary for the purposes of use (Section 12(1))
• Organisations must not keep personal information for any use for longer than is necessary for that use (Section 12(2))
• Organisations must take reasonable steps to correct or erase personal information found to be incorrect or misleading as soon as possible
• Organisations must carefully consider any challenges made to the accuracy of personal information they hold
• Organisations must have appropriate security measures in place to protect personal information from unintentional or unauthorised modification
• When compiling personal information from their own resources, organisations must accurately record the information and its source, and take reasonable steps to verify accuracy, especially where decisions could significantly affect the individual

Applies to

organisations subject to PIPA