On 16 June 2023, the Government of Bermuda introduced the amending legislation in the House of Assembly required to bring Bermuda’s 2016 privacy laws into effect on 1 January 2025. The Personal Information Protection Amendment Act 2023 was introduced to harmonise the Personal Information Protection Act 2016, the Public Access to Information Act 2010 and the PATI Regulations 2014. Bermuda’s Personal Information Protection Act 2016 (PIPA) sets out a comprehensive regime to protect a broad range of personal information, including information – among all other details about an identified or identifiable individual – that may disclose an individual’s address and contact information, family status, financial circumstances, and their physical and mental health.
As important as it is for many organisations and businesses to use and rely upon personal information to carry on business, it is also vital to ensure that such information is protected and not wrongfully exploited.
In order for international business in Bermuda to use personal information from foreign jurisdictions, PIPA will, in part, create a “safe harbour” for the cross-border flow and use of such data in Bermuda.
Therefore, organisations that use any form of personal information in Bermuda must use the time between now and 1 January 2025 to:
- Understand both the privacy rights of individuals and the obligations and requirements of their organisations under PIPA
- Develop a critical path to adopt and implement the compliance measures and policies that will be required
- Train their personnel in the systems, activities and procedures that must soon be adopted and implemented to ensure their compliant use of personal information
Many Bermuda organisations have diligently begun that compliance development process and will benefit from their head start. Others, some of whom have complex operations that are highly dependent on personal information, now have a fixed date for compliance that will likely be motivational.
Friday’s introduction of PIPA’s amending legislation was just the beginning of PIPA’s implementation. Although those amendments are designed to harmonise PIPA with the laws that allow the public to access government information, the Electronic Transactions Act 1999 also contains various privacy provisions that I suspect may also require some harmonisation in the months ahead.
Perhaps one of the greatest benefits that the 18-month lead-time will provide is the time that it will afford the Privacy Commissioner to publish his much anticipated Guide to PIPA that was announced last week, and that is promised to contain “dozens of pages of tips, checklists and other pieces of advice” that will provide welcomed compliance guidance to encourage and facilitate PIPA preparedness.
To ensure you are ready and fully compliance for PIPA, please reach out to Partner Duncan Card who specialises in IT and outsourcing contracts, privacy law and cybersecurity compliance in Bermuda.
To learn more about PIPA, listen to our recent Bermuda Shorts ‘Tech Talks’ podcast on Bermuda’s privacy law.
For further information, please contact:
Duncan Card, Partner, Appleby
dcard@applebyglobal.com
