BermudaPersonal Information Protection Act 2016, Commissioner, enforcement and offences
In force since .
An enforcement supervision rule binding public and private bodies.
- Enforcement body
- Privacy Commissioner for Bermuda
- Obligation class
- Governance, Reporting
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Comply with an order or notice served by the Privacy Commissioner under this Act.NIST Privacy FrameworkGV.PO-P5
- Do not contravene the sensitive personal information restriction, and do not dispose of, alter, falsify, conceal or destroy evidence during a Commissioner investigation or inquiry.NIST Privacy FrameworkCT.PO-P1NIST Privacy FrameworkGV.PO-P5
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Criminal exposure note
Failing to comply with a Commissioner order or notice, contravening section 7 (sensitive personal information), destroying evidence during an investigation, or failing to notify a breach of security under section 14, is an offence liable on summary conviction, for an individual, to a fine not exceeding $25,000 or imprisonment not exceeding two years or both, and on conviction on indictment, for a person other than an individual, to a fine not exceeding $250,000.
Penalty structure
Section 48(3) caps an individual's summary-conviction fine at $25,000 (or two years' imprisonment, or both); a person other than an individual faces a fine on conviction on indictment not exceeding $250,000. The Act states amounts in Bermuda dollars, at par with the US dollar.
- Rule
- Fixed only
- As of
- Currency
- BMD
- Fixed cap
- 250,000
What it makes you log
Logging duty
Part 5 lets the Commissioner serve a notice requiring information (section 29(4)), order any information relevant to an investigation or inquiry to be produced and examined (section 31(2)) and obtain a warrant to examine information on premises, and section 31(3) requires the organisation to produce it within ten days. These are powers to demand information held, not a duty to create or keep a log or record, and the offences in section 47 punish false statements to the Commissioner, not a failure to keep a record. Section 14 gives the Commissioner a record of notified breaches, which is the Commissioner's own record. No territorial hook is stated in these sections.
- Kind
- None
- As of
What this law does
The Privacy Commissioner for Bermuda, a public office appointed by the Governor, investigates complaints, mediates disputes, and on completing an inquiry may make an order requiring an organisation to give access, rectify or destroy personal information, or take other steps to remedy a breach of the Act. The Commissioner's office and general powers came into operation on .
The Government of Bermuda and the Privacy Commissioner for Bermuda jointly announced that the review, complaint, order, judicial review and offences provisions in this range would come into operation, together with the rest of the Act's remaining provisions, on .
A person who fails to comply with a Commissioner's order or notice, contravenes the sensitive-personal-information restriction, destroys evidence during an investigation, or fails to notify a breach of security, commits an offence liable on summary conviction, for an individual, to a fine not exceeding $25,000 or imprisonment not exceeding two years or both, and on conviction on indictment, for a person other than an individual, to a fine not exceeding $250,000.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .