Guide to PIPA: Purpose limitation

Summary

This is PrivCom guidance explaining the purpose limitation principle under Bermuda's Personal Information Protection Act (PIPA), specifically section 10. It sets out when organisations may use personal information only for the purposes originally specified, and when a new or different use is permitted.

• Core rule: An organisation may use personal information only for the specific purposes stated under section 9(1)(b) of PIPA, or for purposes related to those specific purposes.
• Exceptions to the rule: The limitation does not apply where the individual consents, the use is necessary to provide a requested service or product, use is required by law or court order, use is for detecting or monitoring fraud, or use is for scientific, statistical or historical research subject to appropriate safeguards.
• New purposes: To use personal information for a new purpose not originally specified, an organisation must obtain the individual's specific consent or rely on a clear legal provision, and must assess whether the new purpose aligns with the original purpose (considering context, sensitivity, consequences, and safeguards).
• Practical steps recommended: Clearly identify and document purposes, include purpose details in the privacy notice, regularly review use of personal information and update documentation and notices, and only use personal information consistent with the original or a permitted purpose.

The guidance is explanatory in nature, illustrating the principle with a checklist, frequently asked questions, and a worked scenario (a lawyer disclosing a client list for an unrelated commercial purpose, which is described as incompatible with the original purpose). It does not itself introduce new legal obligations beyond those already in PIPA sections 9 and 10.

Key obligations

• Organisations must use personal information only for the specific purposes identified under section 9(1)(b) of PIPA or for purposes related to those specific purposes, unless a section 10(2) exception applies.
• Organisations must document their purposes for using personal information as part of the suitable measures and policies required under section 5(1) of PIPA.
• Organisations must specify their purposes for using personal information in their privacy notice to individuals.
• Organisations must regularly review their use of personal information and update their documentation and privacy notice where purposes have evolved.
• Before using personal information for a new purpose, organisations must obtain the individual's specific consent, identify a clear legal basis, or confirm the new purpose aligns with the original purpose via an assessment.
• If personal information was originally collected on the basis of consent, organisations generally must obtain fresh consent before using it for a new purpose.

Applies to

organisations subject to PIPA (data controllers/organisations using personal information in Bermuda)