BermudaPersonal Information Protection Act 2016, rights of individuals
Personal Information Protection Act 2016 (Bermuda), 2016:43, ss. 17-20 (rights of individuals)
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights
- Audit expectation
- none
What it requires
- Give an individual access to personal information held about them on written request, subject to the Act's exemptions.NIST Privacy FrameworkCT.DM-P1
- Correct, block, erase or destroy personal information on written request where it contains an error or omission.NIST Privacy FrameworkCT.PO-P3
- Pay compensation, as the court determines, to an individual who suffers financial loss or emotional distress from a failure to comply with this Act, unless reasonable care to comply is proven.
These lines are LexLint's reading of the law's text. Also read by: Office of the Privacy Commissioner for Bermuda (PrivCom) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Section 47(1)(c) makes it an offence to dispose of, alter, falsify, conceal or destroy personal information, or direct another person to do so, in order to evade a request for access to it, and section 47(2) makes it an offence to fail to comply with an order or a notice served by the Commissioner. An individual is liable on summary conviction to a fine not exceeding $25,000 or imprisonment not exceeding two years, or both; a person other than an individual, on conviction on indictment, to a fine not exceeding $250,000.
Penalty structure
Section 47(3): a person other than an individual convicted on indictment of an offence under section 47(1) or (2) is liable to a fine not exceeding $250,000; an individual convicted summarily is liable to a fine not exceeding $25,000 or imprisonment not exceeding two years, or both. The offences that reach this row's rights provisions are disposing of, altering or concealing personal information to evade an access request, and failing to comply with an order or notice of the Commissioner. The Act sets no administrative fine.
- Rule
- Fixed only
- As of
- Currency
- BMD
- Fixed cap
- 250,000
Who enforces it
Enforcement body
The Privacy Commissioner for Bermuda, who investigates complaints and may serve notices and make orders under Part 5, with offences under section 47 prosecuted in the courts
Settledness
- As of
- Guidance link
- https://www.privacy.bm/access-to-personal-information
- Guidance body
- Office of the Privacy Commissioner for Bermuda (PrivCom)
- Open questions
- How does a court fix the amount of compensation "for each contravention" under section 21(3) of the Personal Information Protection Act 2016, when the Act states no sum, scale or method for financial loss or emotional distress?
What it makes you log
Who may demand the log
Data subject
Logging duty
An organisation that must tell an individual, on request, the purposes for which personal information has been and is being used and to whom and in what circumstances it has been disclosed cannot do so without keeping a history of the use and disclosure. Section 19(5) separately requires the organisation to note the individual's written request to change an opinion in a manner that links the request with the opinion when the writer of the opinion does not consent. Neither clause lists record fields from the closed vocabulary, sets a retention period or names an audit. The individual is the one entitled to the information. Section 20(3) asks the organisation to acknowledge each request in writing with the date of the request.
- Kind
- Implicit
- As of
- Provision
- Section 17(1) (on request, the individual is given the purposes for which personal information has been and is being used and the persons or types of persons to whom, and circumstances in which, it has been and is being disclosed); section 19(5) (a refused change to an opinion is noted so that it is linked with the opinion)
- Trigger
- personal_data_processing
What this law does
An individual may request access to personal information an organisation holds about them, subject to exemptions including for information that would prejudice medical treatment. An individual may request correction, blocking, erasure or destruction of personal information containing an error or omission.
An individual who suffers financial loss or emotional distress from an organisation's failure to comply with the Act is entitled to compensation, determined by the court, unless the organisation proves it took such care as was reasonably necessary to comply. Sections 17 to 20 came into operation on , the date the Government of Bermuda and the Privacy Commissioner for Bermuda jointly announced for the Act's remaining provisions.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .