Individuals' Guide to PIPA (December 2024)

Summary

This is a plain-English guidance document produced by the Office of the Privacy Commissioner for Bermuda (PrivCom) explaining to individuals what rights they have under the Personal Information Protection Act 2016 (PIPA) and how to exercise them. It is written for the public rather than regulated entities, but it sets out, in detail, the corresponding duties that organisations holding personal information must meet when individuals exercise those rights.

• Notice and transparency: Organisations must give individuals a clear privacy notice, before or at the time personal information is collected, covering what is collected, why, retention, overseas transfers, rights, and Privacy Officer contact details.
• Right of access (s.17): Individuals can request confirmation of use and copies of their personal information; organisations may refuse in limited circumstances.
• Right to access medical records (s.18): Individuals can request access to medical or psychiatric personal information, subject to a health-prejudice exception and referral to a health professional.
• Right to correction (s.19(1)): Organisations must correct inaccurate or incomplete information as soon as reasonably practicable and notify other organisations they shared it with, where reasonable.
• Right to block (s.19(6)): Organisations must stop or not begin using personal information for direct marketing on request, or otherwise stop use or justify continued use in writing where use causes or is likely to cause substantial damage or distress.
• Right to erasure/destruction (s.19(10)): Individuals can request erasure or destruction of their personal information, subject to exemptions.
• Refusal grounds: Organisations may refuse a PIPA rights request if it is 'manifestly unreasonable', but must explain the refusal and inform the individual of their right to complain to PrivCom or the courts.
• Complaints and compensation: Individuals dissatisfied with an organisation's response can complain to PrivCom or seek court-ordered compensation under section 21 for financial loss or distress caused by non-compliance.

The guide is explicitly informational and states it does not constitute legal advice; it does not itself create new legal rules but summarises existing PIPA obligations for organisations that process personal information in or from Bermuda.

Key obligations

• Organisations must provide individuals with a clear, easily accessible privacy notice before or at the time personal information is collected, describing collection, use, retention, transfers, rights, and Privacy Officer contact details.
• Organisations must respond to written correction requests and make corrections as soon as reasonably practicable, notifying other organisations to whom the incorrect information was disclosed where reasonable.
• Organisations must stop using personal information for direct marketing purposes upon a valid written blocking request, and cannot refuse such requests.
• Organisations must, upon a blocking request based on substantial damage or distress, either cease/not begin the use or provide written reasons justifying continued use.
• Organisations must respond to access requests (including medical records) in writing and provide reasons where access is refused or restricted.
• Organisations that consider a PIPA rights request 'manifestly unreasonable' must explain their reasoning to the individual and inform them of their right to complain to PrivCom or pursue court action.
• Organisations must be able to demonstrate what measures they took in response to a rights request and record accuracy challenges as a matter of good practice.

Applies to

organisations (data controllers) subject to PIPA