Laws to protect personal information are expected to come into force this year, lawyers said.

The legislation – passed by Parliament in 2016 – was designed to uphold rights related to personal information held by all businesses, organisations, charities and government departments.

A Cabinet Office spokeswoman said yesterday that the Personal Information Protection Act was expected to be fully in effect “in the near future”.

The legislation received Royal Assent on July 27, 2016 and some sections became operative later that year.

Alexander White’s appointment as Bermuda’s first Privacy Commissioner was announced in December 2019 and he took up the post in January 2020.

He said last week that “substantial portions” of the law were not yet in operation.

Mr White explained: “Pipa Section 52(2) grants the authority to the minister to ‘appoint different days for different provisions of the Act’.

“Some provisions are already in effect, such as the provisions that deal with the creation and powers of the position of Privacy Commissioner.

“Other provisions relating to specific rights and responsibilities have not yet entered into effect.

“My office is working closely with Government personnel on a timeline and procedure for bringing the law into effect, but at the moment I am unable to cite specific dates of operation.

“My goal is to provide significant advance notice before provisions come into effect, and to provide information sessions and guidance on specific practices prior to the requirement for organisations to implement them.

“At the moment, I do not anticipate major changes to Pipa before further sections come into effect.”

He was speaking ahead of Data Privacy Day tomorrow, which is being marked by a series of events this week.

Julie McLean, a director at Conyers, said it was expected that more of the personal information protection legislation will become operative this year.

She explained that the island’s Pipa was less prescriptive than the European Union’s General Data Protection Regulation and closer to the more modern rules in Canada, Australia and New Zealand.

Ms McLean explained: “The approach is more about creating a culture of compliance – you understand why the needs and the rights of the individuals are there.

“It’s principle based.”

In an Opinion piece in The Royal Gazette this week, a team from Conyers said: “Generally, privacy legislation – Pipa included, when it comes into force – seeks to, on the one hand, respect an organisation’s legitimate purposes for the data, while setting parameters for how companies should store, use and protect it, and, on the other hand, empower individuals to know how their data is being processed and used, by whom and why, and to take certain actions in respect of it.”

Ms McLean said that the law will give people the right to know what information about them is collected by an organisation as well as to make sure that the details are accurate.

She added that Pipa was also designed to make sure that the extent of information collected is proportionate to the organisation’s needs.

Ms McLean said: “The potential misuse of personal information can be quite damaging and that’s why I think people need the right to have some control over their personal information – who’s using it and why.

“World wide it’s becoming a bigger and bigger issue. We are on a tiny little island but it still is relevant.

“We need to know who is using our personal information so that we’re not being manipulated, it’s not being misused.”

Riley O’Brien, an associate in Appleby’s corporate department, also expects Pipa to be “fully in force sometime this year”.

He highlighted: “While Pipa will provide protection and rights regarding individuals’ personal data when they engage with Bermuda businesses, it’s important to remember that businesses based outside of Bermuda may not be subject to Pipa.

“You should ensure that you manage your own personal information and make informed decisions regarding your data and how it is used.”

Gretchen Tucker, a senior governance and privacy lawyer at BeesMont Law, said that the Act has already started to impact the everyday lives of residents.

She explained: “A quick Google search for ‘privacy notice Bermuda’ demonstrates that many private businesses on island, such as banks, insurance providers, wedding planners and The Royal Gazette alike have introduced statements aimed at publicly disclosing how they use the personal information of individuals.

“This is important as such organisations regularly engage in direct communications with and/or provide direct services to individuals and store their personal information in their databases.

“In the case of health insurance providers, such data can include medical information about individuals, including children, so it is particularly good to see privacy statements being issued by the same.”

Ms Tucker added: “Hopefully, we will see educational institutions follow suit and issue public privacy statements, given their use of personal information belonging to children and young persons.

“Once the substantive sections of Pipa are in force, all organisations – inclusive of public authorities – will be required to provide privacy notices to individuals either before or at the time of collection of personal information or as soon as reasonably possible thereafter.”

A Cabinet Office spokeswoman said yesterday: “The Government advised that the implementation process for Pipa is well advanced with extensive work in this regard having already been completed.

“Given the work completed thus far, full implementation is anticipated in the near future.”

* For more information about Pipa visit thePrivacy Commissioner website at www.privacy.bm.