Activity of the Government of Bermuda and Bermuda's First Privacy Commissioner

A Long-Awaited Announcement

On June 15, 2023, the Government of Bermuda ("the Government") and the Office of the Privacy Commissioner for Bermuda ("PrivCom") jointly announced the official date for the remaining provisions of the Personal Information Protection Act 2016 ("PIPA") to come into effect as January 1, 2025.

The Passage of Supporting Legislation

The Bermuda Parliament ("the Parliament") passed the Personal Information Protection Amendment Act 2023 ('Amendment Act') on June 16, 2023.

The Amendment Act will amend PIPA and the island's access to information framework (the Public Access toInformation Act 2010 ('PATI') and its corresponding regulations) in order to prepare for the new data protection framework to come into force. Amongst other changes, the Amendment Act will insert a new Section 12A into PATI. Section 12A will confirm that, following the commencement of PIPA, PATI will no longer apply to records relating to the personal information of a requester. Any requester making a request under Section 12 to a public authority to access or amend their personal information must be notified in writing that they should proceed under PIPA.

The Assent of the Governor of Bermuda

More recently, the Governor of Bermuda provided their Assent to the Amendment Act on July 18, 2023.

As of the date of this publication (17 August 2023), no date has been announced for the Amendment Act to come into force within the jurisdiction.

Global Privacy Assembly

On October 15-20, 2023, the 45th Annual Global Privacy and Data Protection Summit of the Global Privacy Assembly ("GPA") is due to take place in Bermuda. Bringing together more than 130 data protection and privacy watch dogs worldwide, the GPA is a global forum that seeks to provide leadership in data protection and privacy. By way of background, PrivCom joined the GPA in 2020 and, in 2021, Bermuda was selected as the site for the 45th Summit. Subsequently, in January 2022, the Privacy Commissioner for Bermuda was appointed to the Executive Committee of the GPA to plan and co-ordinate the gathering on island.

It is expected that organisations in Bermuda that use personal information will generally have 18 months to prepare for the full implementation of Bermuda's data privacy law

The October 2023 Summit is comprised of the following:

  • Welcome Reception (15 October 2023);
  • Open Session, which is open to the local and international business community for registration and will highlight panel discussions on some of the most relevant global 'privacy' topics (October 16 and 17, 2023); and
  • Closed Session, which is open to accredited GPA Membership and Observers only (October 18-20, 2023).

Supplementary events, which are open to all attendees to attend, will take place on the afternoons of the Closed Session.

Looking Ahead

It is expected that organisations in Bermuda that use personal information will generally have 18 months to prepare for the full implementation of Bermuda's data privacy law. The Amendment Act, however, will empower the Government to appoint different days for the commencement of PIPA for different purposes or in respect of different classes of organization. With this in mind, it is possible that certain sophisticated companies (for example, those companies which have business activities in environments and jurisdictions where data privacy frameworks are already in place) may be expected to comply with PIPA at an earlier date.


PrivCom's advancement of its regulatory capacity & community engagement

Meet the 2023 PrivCom Team

Since the appointment of Commissioner Alexander White (effective 20 January 2020), the regulatory focus of PrivCom has been centered on community engagement and capacity building to educate stakeholders and support the independent office's future regulatory activity.

This year, PrivCom continued to deepen its commitment to the up-coming jurisdictional privacy framework. Notably, on 5 June 2023, PrivCom announced the appointment of Ms. Angie Farquharson as the new Deputy Privacy Commissioner. Deputy Commissioner. Farquharson is touted as bringing a wealth of experience and expertise in public service and data rights, having previously advised PrivCom as the Non-Ministry Comptroller and also served on secondment as the Deputy Information Commissioner.

As of the date of this publication (17 August 2023), the Senior Management of PrivCom is comprise of the following posts:

  • Privacy Commissioner for Bermuda;
  • Deputy Commissioner;
  • Assistant Commissioner, Operations;
  • Assistant Commissioner, Innovation; and
  • Assistant Commissioner,

The Office also has a Policy & Communications Unit which is responsible for effective, impactful presentation and communication concerning PrivCom's mandate. The Unit is intended to generate guidance and advice for all stakeholders in Bermuda and is comprised of the following posts:

  • Marketing & Engagement Officer;
  • Innovation Policy & Training Officer; and
  • Inclusion & Engagement

Enhanced Community Support

A new series of PrivCom services are now available to the public. For example, an individual or a representative of a personal information owner can now request a regulatory advisory opinion from PrivCom when they have a concern about a privacy violation, personal data breach matters related to personal data protection, any other violation of PIPA, and other PIPA issuances that do not affect them personally or involve their personal data. General PrivCom support may also be requested. Lastly, the PrivCom website has been updated to include a Guide to PIPA designed for privacy officers and others responsible for data protection on a day-to-day basis.

Global Enforcement Cooperation

In February 2023, PrivCom entered into two prominent international enforcement cooperation agreements in order to better liaise with global privacy commissioners and share resources in joint investigations that could affect individuals in Bermuda and elsewhere. Specifically, PrivCom entered into:

Pandemic-focused guidance issued by PrivCom during the same 2020-21 period largely reflects the approach taken by the Arrangement. The local regulator's entry into the same would therefore appear to be a logical progression, demonstrating the maturing of its regulatory positioning both in Bermuda and amongst its international counterparts.

TIMELINE: 2015-2023

Historical Establishment of The Office of the Privacy Commissioner for Bermuda

10 Jul 2015

The Draft Model of PIPA is published by The Department of E-Commerce, Ministry of Economic Development.

01 Jul 2016

The Draft PIPA Bill is tabled in the Bermuda Parliament.

01 Jul 2016

Issuance of a Ministerial Statement by the Minister ofEconomic Development on the Draft PIPA Bill.

21 Jul 2016

Legislative Brief on the Draft PIPA Bill delivered by the Minister of Economic Development .

27 Jul 2016

PIPA receives the Royal Assent. As Bermuda is a British Overseas Territory, all parliamentary bills must be given Royal Assent on behalf of the British Monarch, as represented by the Governor of Bermuda, in order to become law.

02 Dec 2016

Discreet administrative provisions of PIPA come into force to enable the recruitment of the Privacy Commissioner and the creation of the Office of the Privacy Commissioner for Bermuda, the new independent supervisory authority for the enforcement of PIPA.

03 Feb 2017

Issuance of a Ministerial Statement by the Minister ofEconomic Development on the Implementation of PIPA'sAdministrative Provisions.

13 Dec 2019

The Governor of Bermuda announces the appointment of the island's first Privacy Commissioner, Mr. Alexander McD White.

20 Jan 2020

The appointment of the Privacy Commissioner becomes effective.

11 Aug 2020

The Information Statement of the Office of the Privacy Commissioner for Bermuda is issued under the Public Access to Information Act 2010 confirming the staffing and financial budget of the office

15 Jun 2023

The Government of Bermuda and PrivCom jointlyannounce 1 January 2025 as the official date when PIPA will be implemented.

16 Jun 2023

The Bermuda Parliament passes the Personal Information Protection Amendment Act 2023 ('Amendment Act').

18 Jul 2023

The Governor of Bermuda provided their Assent to the Amendment Act.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.