Bermuda appoints privacy commissioner to oversee PIPA implementation

Bermuda has appointed Alexander White as privacy commissioner, a new position established under the Personal Information Protection Act 2016 (PIPA).

White, a US lawyer by training, is responsible for fully implementing PIPA legislation when he takes up his position officially on January 20. That includes setting up the privacy commissioner’s office, hiring and training staff, undertaking investigations, providing reports and developing public awareness of individuals’ and organisations’ rights under PIPA.

Conyers, the law firm, said: “PIPA sets out how organisations, businesses and the Bermuda Government may use personal information. It applies to every individual, entity or public authority that uses personal information in Bermuda, including non-profits. The legislation reflects a set of internationally accepted privacy principles and good business practices for the use of personal information in the digital age.”

Like the EU’s General Data Protection Regulation (GDPR), PIPA requires every organisation provide individuals with a clear and easily accessible statement about their practices and policies with respect to personal information. Measures and policies must be designed to take into account the nature, scope, context and purposes of the use of personal information and the risk to individuals of the use of the personal information.

Every organisation must designate a privacy officer to ensure PIPA compliance, and companies remain liable for PIPA compliance even when they outsource functions to third parties.

Certain sections of PIPA came into force in 2016, and this appointment is an important step in bringing the remaining operative provisions into force, said Conyers. “Organisations that have not yet reviewed their obligations under PIPA would be well advised to do so now,” it said.