On 15 June 2023, the Minister of Tourism and the Cabinet Office, Vance Campbell, announced the tabling of the Bill, which is scheduled to be debated in the House of Assembly today, 16 June 2023. Once passed, the remaining provisions of the Personal Information Protection Act 2016 ("PIPA") will be operative with a suggested effective date of 1 January 2025. The Bill seeks to harmonize PIPA and the Public Access to Information Act 2021, as well as make changes to the Public Access to Information Regulations 2014.
Bermuda has recognized the growing importance of data protection and privacy in the modern digital landscape. PIPA was initially enacted in 2016 to establish a framework for the responsible collection, use and disclosure of personal information by organizations in Bermuda. When PIPA received royal assent in 2016 only the provisions of PIPA that permitted the appointment of the Privacy Commissioner (the "Commissioner") and the establishment of his office became operative. The Bill will now bring into effect the substantive provisions of PIPA that place certain obligations on organisations using personal information in Bermuda. The 1 January 2025 operative date, will allow businesses sufficient time to prepare for compliance. This news now provides a definitive 18-month window for businesses to execute their action plans
The Bill will also make minor amendments to PIPA, including:
- Privacy Notices: Contact details in addition
to the name of the relevant privacy officer must now be included in
privacy notices.
- Terminology: The term "rectifying"
or "rectification" in relation to an individual's
rights under PIPA has been changed to "correcting" and
"correction" respectively.
- Health Professionals' Expertise: When
requesting access to medical records, the relevant health
professional no longer requires to have expertise "in the
subject matter of the record" being requested.
- Reports by the Commissioner: Reports will now be issued within 6 months after the end of each calendar year, which has been extended from the initial 3-month provision.
Additional provisions were also added in relation to the vacancy of the Office of the Commissioner, as well as the Commissioner's power to charge fees for any services provided under PIPA.
The forthcoming implementation of PIPA in Bermuda reinforces the jurisdiction's commitment to data protection and privacy rights. Organizations must proactively adapt their data protection practices to ensure compliance with the legislation. Seeking legal advice and engaging in comprehensive compliance efforts will be crucial to mitigating risks and demonstrating commitment to data privacy.
Our experienced Regulatory team at Walkers is available to assist you in navigating the complexities of PIPA and safeguard your business's reputation and customer trust. From updating privacy policies to developing comprehensive compliance strategies, we can work with you to ensure a seamless transition for your organisation.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
