The Personal Information Protection Act 2016 has been in effect for more than a year now, and employers in Bermuda are now fielding requests from their employees to access and review their employment records — all of them.
Of course, employees are entitled under Pipa to submit such written requests. However, the employer’s requirement to comply with those requests is subject to a few caveats.
Generally, Pipa allows all individuals to request any organisation to provide that individual with access to, and to examine and to receive a copy of, the personal information about them that is in the custody or control of that organisation.
The exercise by individuals, including employees, of such access, review, correction and control rights are at the core of Pipa privacy protection rights and they are intended to be invoked for the purposes Pipa intends.
However, those rights are limited by a few circumstances where employers are not required to comply with such requests.
First, the access rights section of Pipa is qualified by only allowing individuals to make such requests “having regard to what is reasonable”. Arguably, submitting such an access request that is either unreasonable in nature or in scope may relieve an employer of Pipa’s disclosure obligations.
Second, the relevant information may be withheld if the disclosure could: be reasonably expected to threaten the life or security of an individual; reveal personal information about another individual; or reveal the identity of an individual who has in confidence provided an opinion about another individual (and no disclosure consent is provided).
Keep in mind that the ability to redact any such protected information may then permit the disclosure of those records under Pipa.
Third, Pipa directs employers to not provide access if: any of the personal information in question is protected by legal privilege; the disclosure would reveal commercially confidential information that should reasonably be withheld; it is being used for a current disciplinary or criminal investigation or legal proceeding (if the non-disclosure would not prejudice the individual’s fair hearing rights); the personal information was used or created by a mediator or arbitrator to resolve a dispute (with some provisos); or the personal information would prejudice any existing negotiations between the employer and the employee.
There are some additional grounds of access refusal under Pipa that other jurisdictions have experienced and that may arise in Bermuda.
Unfortunately, circumstances do exist where the relationship between an employee and an employer may become extremely adversarial and may even break down into animosity and potential litigation.
In those situations, employees might be tempted to submit extremely broad, and sometimes numerous or repetitive, access requests that are vindictively designed to harass and administratively disrupt the employer.
Sadly, the abusive and vexatious exercise of an employee’s privacy rights for such reprisal motives have all too commonly arisen and been cited in the relevant case law in Britain and Canada since privacy and access to information rights were first introduced.
Some of the case judgments and commentaries refer to such abuses as the “weaponisation” of privacy law, including Scott Stapleton’s 2025 article entitled, Employment Disputes: Weaponisation of Data Protection Legislation by Claimants.
In that article, he explains: “ … we have seen a year-on-year increase in the use of [such requests] by employees … to obtain information … upon which to base workplace grievances and/or litigation. These days, it is very rare for [an employee litigant] to have not already made a [privacy access request] to their employer prior to issuing their claim ….
“For such an employee, a [privacy access request] can be a very effective weapon — compliance will cost the business significant management time and expense, … inconvenience, and there are tight timescales …
“However, businesses can legitimately limit or refuse to comply with requests which are manifestly unfounded and/or manifestly excessive”.
The weaponisation of privacy access requests by employees is nothing new.
That is why it is important to know that Pipa, which was drafted well after other privacy laws, takes such potential weaponisation into account and offers additional protection to employers.
As noted above, the access request itself must be submitted with “regard to that which is reasonable”. Certainly, excessively broad and unfocused access requests that have no defining topic or subject matter may be considered unreasonable.
Furthermore, Pipa allows employers to refuse to comply with an access request that is “manifestly unreasonable”. Arguably, the more a particular interest or subject matter of an access request is provided to help reduce the administrative burden of responding to the request, the more reasonable and co-operative it is likely to appear.
Conversely, the less co-operatively focused the access request is, the more it may appear to be an abusive fishing expedition or a vexatious and bad faith attempt to administratively harass the employer.
As a final warning to employees who might be tempted to weaponise their access rights under Pipa, Section 30 allows employers to request, in writing, the Privacy Commissioner to authorise it to disregard an access request that unreasonably interferes with the operations of the employer, amounts to an abuse of such access rights, or is otherwise “frivolous or vexatious”.
There is no question that the privacy rights of individuals are now a sacred and paramount part of Bermuda law, which is all the more reason to ensure that the privacy rights of employees are not allowed to be misused, abused or weaponised by individuals against organisations that must use personal information for legitimate purposes in Bermuda.
First Published in The Royal Gazette, Legally Speaking column, February 2026
For further information, please contact:
Duncan Card, Partner, Appleby
dcard@applebyglobal.com
