Guide to PIPA: National security exemption

Summary

This guidance from the Bermuda Privacy Commissioner explains the national security exemption under section 22 of the Personal Information Protection Act (PIPA). It describes when an organisation may be partially exempt from the general processing requirements of PIPA in order to safeguard national security, and the process for obtaining an exemption certificate.

• Scope of exemption: Parts 2 and 3 of PIPA (other than the minimum requirements) do not apply to personal information used for the purpose of safeguarding national security, but only where a valid exemption certificate is in place.
• Exemption certificate: An organisation must first obtain a certificate signed by the Minister, in consultation with the Minister responsible for national security, certifying that an exemption is required for safeguarding national security.
• Minister's test: The Minister may not sign a certificate unless satisfied the exemption is necessary and proportionate for safeguarding national security.
• Certificate content and effect: A certificate may describe covered personal information generally and must be expressed to have prospective effect only.
• Right of appeal: An individual or organisation directly affected by the Minister's decision on an exemption certificate may appeal to the Supreme Court.
• Not a blanket exemption: Organisations must still process personal information lawfully and fairly under section 8, comply with general responsibility and compliance obligations, and be able to justify that the specific exemption sought is required for safeguarding national security.

The guidance notes that further detail on applying this exemption is still to be issued by the Commissioner.

Key obligations

• An organisation relying on the national security exemption must first obtain a signed exemption certificate from the Minister (in consultation with the Minister responsible for national security) before disapplying Parts 2 and 3 of PIPA.
• Organisations must continue to process personal information lawfully and fairly under section 8 of PIPA even when relying on the exemption.
• Organisations must be able to demonstrate that the exemption from specified standards is necessary and proportionate for the purpose of safeguarding national security.
• Organisations must continue to comply with their general responsibility and compliance obligations under PIPA notwithstanding the exemption.

Applies to

organisations processing personal information under PIPA