Guide to PIPA: Proportionality

Summary

This is guidance from the Bermuda Privacy Commissioner explaining the proportionality principle under Section 11 of PIPA. It sets out what organisations must do to ensure personal information they collect and hold is adequate, relevant, and not excessive for their stated purposes, and provides checklists and worked scenarios to illustrate compliance.

• Adequate: Organisations must hold sufficient personal information to properly fulfil their stated purposes, and must supplement incomplete information if requested under an individual's right to correction.
• Relevant: Information collected must have a rational, justifiable link to the purpose for which it is used; irrelevant details (e.g. unrelated health questions) should not be collected.
• Not excessive: Organisations must not hold more personal information than needed, must not collect information merely because it might be useful in future (unless justified by a foreseeable event), and must delete data no longer needed.
• Retention: Organisations must justify how long they keep personal information, adopt a policy with standard retention periods where possible, and periodically review and erase or anonymise data no longer needed, subject to any legal retention requirements or public interest archiving, research, or statistical exceptions.
• Erasure and correction rights: Individuals have the right to request erasure of unnecessary personal information and correction of incomplete information, and organisations must have processes to handle such requests.

The guide is illustrative and non-binding in itself, but reflects the Commissioner's interpretation of a statutory obligation under Section 11 of PIPA that organisations must be able to demonstrate compliance with through their data handling processes.

Key obligations

• Ensure personal information collected and held is adequate, relevant, and not excessive in relation to the stated purposes (PIPA Section 11)
• Collect only the minimum personal information necessary to fulfil the purpose, particularly for sensitive personal information
• Periodically review personal information held and securely dispose of or delete anything no longer needed
• Complete or supplement incomplete personal information when required under an individual's right to correction
• Delete personal information that is not necessary for the purpose when requested under an individual's right to erasure
• Adopt a policy setting standard retention periods for personal information wherever possible
• Be able to justify how long personal information is retained and consider any challenges to retention
• Maintain appropriate processes to demonstrate compliance with collection, holding, and disposal of personal information

Applies to

organisations processing personal information under PIPA