Bermuda: Data Protection Update

2023 MAJOR PRIVACY DEVELOPMENTS

Activity of the Government of Bermuda and Bermuda's First Privacy Commissioner

A Long-Awaited Announcement

On June 15, 2023, the Government of Bermuda ("the Government") and the Office of the Privacy Commissioner for Bermuda ("PrivCom") jointly announced the official date for the remaining provisions of the Personal Information Protection Act 2016 ("PIPA") to come into effect as January 1, 2025.

The Passage of Supporting Legislation

The Bermuda Parliament ("the Parliament") passed the Personal Information Protection Amendment Act 2023 ('Amendment Act') on June 16, 2023.

The Amendment Act will amend PIPA and the island's access to information framework (the Public Access toInformation Act 2010 ('PATI') and its corresponding regulations) in order to prepare for the new data protection framework to come into force. Amongst other changes, the Amendment Act will insert a new Section 12A into PATI. Section 12A will confirm that, following the commencement of PIPA, PATI will no longer apply to records relating to the personal information of a requester. Any requester making a request under Section 12 to a public authority to access or amend their personal information must be notified in writing that they should proceed under PIPA.

The Assent of the Governor of Bermuda

More recently, the Governor of Bermuda provided their Assent to the Amendment Act on July 18, 2023.

As of the date of this publication (17 August 2023), no date has been announced for the Amendment Act to come into force within the jurisdiction.

Global Privacy Assembly

On October 15-20, 2023, the 45th Annual Global Privacy and Data Protection Summit of the Global Privacy Assembly ("GPA") is due to take place in Bermuda. Bringing together more than 130 data protection and privacy watch dogs worldwide, the GPA is a global forum that seeks to provide leadership in data protection and privacy. By way of background, PrivCom joined the GPA in 2020 and, in 2021, Bermuda was selected as the site for the 45th Summit. Subsequently, in January 2022, the Privacy Commissioner for Bermuda was appointed to the Executive Committee of the GPA to plan and co-ordinate the gathering on island.

It is expected that organisations in Bermuda that use personal information will generally have 18 months to prepare for the full implementation of Bermuda's data privacy law

The October 2023 Summit is comprised of the following:

• Welcome Reception (15 October 2023);
• Open Session, which is open to the local and international business community for registration and will highlight panel discussions on some of the most relevant global 'privacy' topics (October 16 and 17, 2023); and
• Closed Session, which is open to accredited GPA Membership and Observers only (October 18-20, 2023).

Supplementary events, which are open to all attendees to attend, will take place on the afternoons of the Closed Session.

Looking Ahead

It is expected that organisations in Bermuda that use personal information will generally have 18 months to prepare for the full implementation of Bermuda's data privacy law. The Amendment Act, however, will empower the Government to appoint different days for the commencement of PIPA for different purposes or in respect of different classes of organization. With this in mind, it is possible that certain sophisticated companies (for example, those companies which have business activities in environments and jurisdictions where data privacy frameworks are already in place) may be expected to comply with PIPA at an earlier date.

2023 POSITIONING OF THE REGULATOR

PrivCom's advancement of its regulatory capacity & community engagement

Meet the 2023 PrivCom Team

Since the appointment of Commissioner Alexander White (effective 20 January 2020), the regulatory focus of PrivCom has been centered on community engagement and capacity building to educate stakeholders and support the independent office's future regulatory activity.

This year, PrivCom continued to deepen its commitment to the up-coming jurisdictional privacy framework. Notably, on 5 June 2023, PrivCom announced the appointment of Ms. Angie Farquharson as the new Deputy Privacy Commissioner. Deputy Commissioner. Farquharson is touted as bringing a wealth of experience and expertise in public service and data rights, having previously advised PrivCom as the Non-Ministry Comptroller and also served on secondment as the Deputy Information Commissioner.

As of the date of this publication (17 August 2023), the Senior Management of PrivCom is comprise of the following posts:

• Privacy Commissioner for Bermuda;
• Deputy Commissioner;
• Assistant Commissioner, Operations;
• Assistant Commissioner, Innovation; and
• Assistant Commissioner,

The Office also has a Policy & Communications Unit which is responsible for effective, impactful presentation and communication concerning PrivCom's mandate. The Unit is intended to generate guidance and advice for all stakeholders in Bermuda and is comprised of the following posts:

• Marketing & Engagement Officer;
• Innovation Policy & Training Officer; and
• Inclusion & Engagement

Enhanced Community Support

A new series of PrivCom services are now available to the public. For example, an individual or a representative of a personal information owner can now request a regulatory advisory opinion from PrivCom when they have a concern about a privacy violation, personal data breach matters related to personal data protection, any other violation of PIPA, and other PIPA issuances that do not affect them personally or involve their personal data. General PrivCom support may also be requested. Lastly, the PrivCom website has been updated to include a Guide to PIPA designed for privacy officers and others responsible for data protection on a day-to-day basis.

Global Enforcement Cooperation

In February 2023, PrivCom entered into two prominent international enforcement cooperation agreements in order to better liaise with global privacy commissioners and share resources in joint investigations that could affect individuals in Bermuda and elsewhere. Specifically, PrivCom entered into:

• Global Privacy Enforcement Network ("GPEN"): The Statement of Mission for GPEN provides that it seeks to promote the operation of privacy enforcement authorities by, among other matters, exchanging information, encouraging training opportunities, sharing enforcement know-how, expertise and good practice as well as creating, maintaining and supporting processes or mechanisms useful to bilateral or multilateral cooperation.
  
  
• Global Cross Border Enforcement CooperationArrangement of the GPA: Notably, the Executive Committee of the Arrangement issued a series of Joint Statements during the height of the COVID-19 pandemic in 2020 and 2021 on:
  
  
  • Coronavirus (COVID-19) pandemic. (17 March 2020);
    
    
  • The use of health data for domestic orinternational travel purposes; (31 March 2021);
    
    
  • Achieving privacy by design in contact tracingmeasures (21 May 2020); and

Pandemic-focused guidance issued by PrivCom during the same 2020-21 period largely reflects the approach taken by the Arrangement. The local regulator's entry into the same would therefore appear to be a logical progression, demonstrating the maturing of its regulatory positioning both in Bermuda and amongst its international counterparts.

TIMELINE: 2015-2023

Historical Establishment of The Office of the Privacy Commissioner for Bermuda

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.