Guide to PIPA: Privacy notices

Summary

This is PrivCom Bermuda's guidance explaining the privacy notice requirements under Section 9 of the Personal Information Protection Act (PIPA). It sets out what organisations must tell individuals about their handling of personal information, when that notice must be given, and the limited circumstances where a notice is not required.

• Content required: A privacy notice must state that personal information is being used, the purposes of use, the identity and types of recipients it may be disclosed to, the organisation's identity and contact details, the privacy officer's contact details, and the choices/means available to individuals to limit, access, correct, block, erase or destroy their personal information.
• Timing: Organisations must take all reasonably practicable steps to provide the privacy notice before or at the time personal information is collected, or as soon as reasonably practicable afterwards if that is not possible.
• Exemptions: A privacy notice is not required if all personal information held is publicly available, or if the organisation can reasonably determine that all actual and intended uses fall within the individual's reasonable expectations.
• Good practice content: Guidance recommends notices also address who is collecting information and by what method, what is collected, how it will be used, how consent can be given or withdrawn, with whom it will be shared, and how long it will be retained; details of destruction are not generally included.
• Self-check tools: A checklist is provided for organisations to confirm they have a clear, accessible privacy notice covering purposes, and that the notice is reviewed regularly.

This document is explanatory guidance interpreting Section 9 of PIPA and does not itself create new legal obligations beyond the statute, but it clarifies what compliance with the statutory privacy notice requirement entails.

Key obligations

• Organisations must provide individuals with a clear and easily accessible privacy notice covering the required elements listed in Section 9 of PIPA
• Organisations must take all reasonably practicable steps to provide the privacy notice before or at the time of collection of personal information, or as soon as reasonably practicable thereafter if that is not possible
• Organisations should regularly review their privacy notice for individuals

Applies to

organisations handling personal information under PIPA