Guide to PIPA: Sensitive personal information

Summary

This guidance from the Bermuda Privacy Commissioner explains the concept of sensitive personal information under section 7 of the Personal Information Protection Act (PIPA). It sets out what counts as sensitive personal information and the limited circumstances in which organisations may use it.

• Definition: Sensitive personal information includes data relating to place of origin, race, colour, national or ethnic origin, sex, sexual orientation, sexual life, marital status, physical or mental disability, physical or mental health, family status, religious beliefs, political opinions, trade union membership, biometric information, and genetic information.
• Core prohibition: Organisations may not use sensitive personal information without lawful authority if doing so would discriminate contrary to Part II of the Human Rights Act 1981.
• Lawful authority: Use is lawful only if it is based on the individual's consent, an order of the court or the Commissioner, is for criminal or civil proceedings, or occurs in recruitment or employment where the role justifies it.
• Future changes: The Minister may, by order subject to the negative resolution procedure, amend the definition of sensitive personal information.

The guidance is explanatory and restates statutory text from PIPA section 7; it does not itself create new requirements beyond those already in the Act.

Key obligations

• Organisations must not use sensitive personal information without lawful authority where such use would discriminate contrary to Part II of the Human Rights Act 1981.
• Organisations relying on use of sensitive personal information must ensure it falls within one of the lawful authority grounds: individual consent, a court or Commissioner order, criminal or civil proceedings, or a justified recruitment/employment context.

Applies to

organisations (data controllers) processing personal information in Bermuda