After eight years of percolation, the Personal Information Protection Act 2016 comes into effect on January 1, carrying fines of up to $250,000 for violators.

The Privacy Commission says stay calm.

“If you are only just hearing about the legislation, on say December 23, do not panic,” Angie Farquharson, the Deputy Privacy Commissioner said.

Alex White, the Privacy Commissioner, had no information on just how prepared local businesses and organisations are for Pipa, but imagined some people would not be completely ready on New Year’s Day.

“Some jurisdictions have had privacy laws in place for 20 or 30 years and there are still organisations or individuals who say wait, what is this again?” Mr White said.

Ms Farquharson said the Privacy Commission’s web archives included detailed information on how to enact organisational privacy policies, and even had customisable templates for those looking to fast track.

The Privacy Commission has held countless seminars and educational campaigns on the new privacy rights and obligations since the legislation passed.

Last week, Mr White and Ms Farquharson took to the streets to talk directly to people about Pipa.

“We asked people if they were aware of Pipa,” Ms Farquharson said. “Most of them had heard about it, even if they did not know what the acronym stood for.”

They found many people were unclear on their rights under the new law.

“We were able to help them to understand what Pipa means for them in January,” she said.

The Privacy Commission can employ 14 staff and are currently at 12. As they switch from an educational to investigative role, Mr White said they could go back to the Government to ask for more staff.

“We are at a very healthy number, but will have to look at our caseload to see if we need to hire more investigators or more policy officers to work with the public,” Mr White said.

He said the goal of Pipa had always been to empower.

“It is about giving individuals more control over their personal information,” Mr White said.

“So much of what we do involves working with third party organisations in different aspects of our lives. This is an opportunity for organisations to show respect for their customers and to build trust with them.”

Pipa rules include personal information that is absorbed into artificial intelligence programmes and apps.

“Over the past year or so, there has been an explosion in public awareness of AI,” Mr White said. “I think generative AI in particular has captured people’s imaginations, but AI has been around for a while.”

He said that if a company’s privacy practices come under scrutiny, they might be required to explain in detail how their AI systems work and what they are doing with personal data.

“There is an onus on the organisation to open up that black box, because they have to be transparent to individuals about how the information is being used,” he said.

“If someone cannot explain how their technology is working, then they are in violation of the act.”

Ms Farquharson started with the Privacy office in June 2023.

“My background is accounting,” she said. “It has been an exciting journey. I have been really learning all about privacy and about innovation and about how it's going to relate to us here in Bermuda.”

Mr White and Ms Farquharson said they were excited to see Pipa finally coming online.

“We have a timer on our website that has been counting down the days, all year,” Mr White said.