The proliferation of computers has made personal information a commodity, able to be bought and sold like any other good or service. Now that the information genie is out of the bottle, however, governments and private citizens have begun to address how best to regulate the use of such information.

In Bermuda, that issue has been considered recently by the Data Protection Working Group, which has consulted widely with the island?s business community as well as private citizens in an effort to provide the basis for the introduction of data protection legislation. Similar legislation in Europe provides comprehensive rights to individuals, enabling them to control the use of data relating to them.

Should the Bermuda legislation be similar to that already in place in Europe, it would impact every individual and business in Bermuda, granting rights to individuals and imposing duties on businesses. This will have a tremendous impact for an island that has a significant interest in international business. Those organisations, and local businesses, will wish to pass data overseas, but the new law will likely include provisions preventing such transfers unless the receiving country has similar protection ? or unless sender and receive enter into a private agreement incorporating those protective measures.

That may pose huge problems for Bermuda-based businesses, since most outfits here have relationships with businesses in the United States. The US regulates the use of data related to areas such as finance and credit, but in general information relating to private individuals is unregulated and may be used for commercial and other purposes.

This tension between the US and countries in the European Union (E.U.) leaves Bermuda in a difficult position. If Bermuda implements the data protection legislation currently envisaged, it would be able to register under the European Union?s ?White List? as a jurisdiction that has a similar level of protection. This would allow organisations within the EU and Bermuda to freely transfer personal data.

However, with no such protection in place in the US, companies in Bermuda wishing to deal with companies in the US would have to ensure that the US companies have entered into a contract that reflects the provisions of our data protection legislation. The exception to that rule is if the individual provides consent for the information to be exchanged.

In the United Kingdom, any individual or organisation that processes personal data or controls the processing of personal data within a relevant filing system who is not exempt from the requirements of the legislation must register with the Data Protection Commissioner and comply with the data protection principles.

The legislation does not cover personal data that is used by individuals as part of a domestic function i.e. a domestic contact list in a personal organiser.

The list of ?Principles? provides the foundations of the data protection regime. They are:

Personal data is processed fairly and lawfully;

personal data is only collected for specific explicitly stated and legitimate purposes and is not processed for anything incompatible with those purposes;

personal data is adequate and relevant in relation to the purposes of processing and is not excessive;

personal data shall be accurate and kept up-to-date;

personal data shall not be kept for longer than is necessary for the purpose for which it was obtained;

personal data should be processed in accordance with the rights of the data subject under the Act;

appropriate measures are taken against unauthorised or unlawful processing; accidental loss; destruction; damage to personal data;

personal data shall not be transferred to a country or territory outside the area covered by such data protection legislation or other territories that have similar protection.

These principles seem reasonable, but that is not the issue when considering the implementation of a data protection regime in Bermuda.

The issue is what impact such legislation might have on the economy of Bermuda by making the country unattractive to international business. Consequently, it is vital that all interested parties provide their comments to the Government (Nigel Hickson nhicksonbdagov.bm or telephone 297 7944).Attorney Graham Wood is a member of the Telecommunications and Technology team at Appleby Spurling & Kempe. Copies of Mr. Wood?s columns can be obtained on the Appleby Spurling & Kempe web site at www.ask.bm.