Processes personal data, in Bermuda

Personal Information Protection Act 2016 (Bermuda), 2016:43, Parts 1-2 (application, exclusions and general principles) · Read the law's page

• Use personal information only for the specific purposes it was collected for, in a fair and lawful manner, and adopt measures and policies giving effect to these obligations.
• Obtain verifiable consent from a parent or guardian before relying on consent to use a child's personal information in a service targeted at children or known to be used by a child.
• Do not use sensitive personal information, which includes biometric information and genetic information, to discriminate against any person contrary to Part II of the Human Rights Act 1981 unless there is lawful authority.

Personal Information Protection Act 2016 (Bermuda), 2016:43, s. 14 (breach of security) · Read the law's page

• Notify the Privacy Commissioner, then any affected individual, without undue delay of a breach of security that is likely to adversely affect an individual.
• Describe in the Commissioner notification the nature of the breach, its likely consequences, and the measures taken and to be taken to address it.

Personal Information Protection Act 2016 (Bermuda), 2016:43, s. 15 (transfer of personal information to an overseas third party) · Read the law's page

• Remain responsible for a transfer of personal information to an overseas third party complying with this Act, unless a specific exception (such as a small-scale, occasional transfer unlikely to prejudice an individual's rights) applies.

Personal Information Protection Act 2016 (Bermuda), 2016:43, s. 7 (sensitive personal information) · Read the law's page

• Do not use sensitive personal information, meaning personal information relating to an individual's place of origin, race, colour, national or ethnic origin, sex, sexual orientation, sexual life, marital status, physical or mental disability, physical or mental health, family status, religious beliefs, political opinions, trade union membership, biometric information or genetic information, to discriminate against any person contrary to Part II of the Human Rights Act 1981 without lawful authority.
• Use sensitive personal information for such a purpose only with the individual's consent, under an order of the court or the Commissioner, for criminal or civil proceedings, in recruitment or employment where the nature of the role justifies it, or for the purposes of the Beneficial Ownership Act 2025.
• Do not rely on the section 6(1)(b) condition, which turns on what a reasonable person would consider, to use sensitive personal information.

Personal Information Protection Act 2016 (Bermuda), 2016:43, ss. 17-20 (rights of individuals) · Read the law's page

• Give an individual access to personal information held about them on written request, subject to the Act's exemptions.
• Correct, block, erase or destroy personal information on written request where it contains an error or omission.
• Pay compensation, as the court determines, to an individual who suffers financial loss or emotional distress from a failure to comply with this Act, unless reasonable care to comply is proven.

Personal Information Protection Act 2016 (Bermuda), 2016:43, ss. 26-46, 48 (the Privacy Commissioner, orders, offences and penalties) · Read the law's page

• Comply with an order or notice served by the Privacy Commissioner under this Act.
• Do not contravene the sensitive personal information restriction, and do not dispose of, alter, falsify, conceal or destroy evidence during a Commissioner investigation or inquiry.

Debt Collection Act 2018 (Bermuda), 2018:61, s. 22 (credit reporting agencies) · Read the law's page

• If you are a credit reporting agency, or its officer or employee, do not furnish any information from the agency's files except in a report given under the written instructions of the person to whom the information relates, in response to the order of a court, or to such persons and under such conditions and restrictions as the Minister prescribes in regulations.
• Do not give or obtain any information from the files of a credit reporting agency about another person except for the purposes the section refers to in its subsection (2).