by Juliana Snelling and Olga Rankin

Protecting private records from exposure has always been important, but the advancement of digital technology has exacerbated the need to guard against the misuse of personal information, or data.

Perils include identity theft, phishing scams, cybercriminal activities, fraudulent credit card and banking charges, and any number of other threats. In response, Bermuda has adopted data protection legislation, the Personal Information Protection Act 2016. The majority of PIPA has not yet come into force, but employers are advised to prepare to comply in anticipation of its expected commencement in the near future.

PIPA is particularly important for employers because everyday business operations necessitate the processing of personal information relating to employees, clients and professional contacts for purposes that include recruitment, administration, AML/ATF compliance, background checks, government surveys, health insurance, sick leave monitoring, billing and payroll, etc.

PIPA is designed to control the way businesses collect, store and process personal information. “Personal information” relates to any detail identifying a person by reference to certain attributes, such as name and address, date of birth and other identifiers. PIPA offers stronger protections for “sensitive personal information” covering, for example, origin, race, gender, sexual orientation, family status, physical or mental disability, religious beliefs, political opinions, trade union membership, biometrics or genetics, etc.

Such information may only be obtained if the nature of the employment justifies it but may never be used without the person’s consent or to discriminate in any way.

Employers must use personal data in a lawful and fair manner and put in place security safeguards to protect it against loss, unauthorised access, disclosure or destruction. They must ensure that it is accurate and current and not kept for longer than is necessary. They must also appoint their own Privacy Officer to ensure compliance. PIPA itself will be overseen by the new office of the Privacy Commissioner who will have power, inter alia, to conduct investigations and issue warnings.

Employers must also publish a “privacy notice” containing the organisation’s data practices and policies, including the purpose for which the data was collected and the name of the Privacy Officer. The criminal penalty for non-compliance is severe – a fine of up to $25,000 or two years’ imprisonment, or both, while the penalty for an organisation is a fine of up to $250,000.

Where a Bermuda entity transfers personal data overseas for a third party’s use, the Bermuda entity will remain responsible for compliance with PIPA. This is of vital importance for multinational employers who routinely exchange personal data about their staff across national borders.

The implementation of PIPA will allow Bermuda to apply for EU “adequacy” status, which allows data to flow freely to and from a non-EU country without the latter having to implement costly safeguards. Offshore jurisdictions already enjoying this status include Jersey and the Isle of Man.

More fundamentally, the commencement of PIPA will help bring Bermuda closer into line with international data protection standards, thereby enhancing our island’s reputation as a place that will not tolerate the abuse or misuse of data concerning its people.

Juliana Snelling is director of Canterbury Law Ltd and her colleague Olga Rankin is an associate attorney.

This article was originally featured in the TOP TEN 2019 edition of the RG Business Magazine.

The post Follow the PIPA appeared first on RG Magazines.

By Ronald H Myers

 The Act

The Sanctions and Anti-Money Laundering Act 2018(“the Sanctions Act”), enacted by the UK Parliament on May 23, 2018, would appear to put the Government of Bermuda on a direct collision course with the United Kingdom over the powers of the latter to legislate for the former.

The Sanctions Act broadly makes provision to enable the United Kingdom to continue to implement United Nations sanctions regimes and to ensure that anti-money laundering and counter-terrorist financing measures are kept up to date.  More controversially, Part 2 sets out the duty of the Secretary of State to provide all reasonable assistance to enable the governments of British Overseas Territories to establish publicly accessible registers of beneficial owners of companies, for the purpose of detecting, investigating or preventing money laundering. The relevant provisions go on to state that the Secretary of State must, no later than December 31, 2020, prepare a draft Order in Council requiringthe government of any British Overseas Territory that has notintroduced such a register within its jurisdiction to do so.

Bermuda is of course a British Overseas Territory. These provisions therefore apply to it. They would appear to have the effect that Bermuda has until December 31, 2020 to establish such registers or an Order in Council will be made forcing Bermuda to do so.  Such registers must be registers which provide information broadly equivalent to that available in accordance with the provisions of the UK Companies Act 2006.  That in essence requires that companies keep and maintain registers “of people with significant control over the company”.  The provisions are broad and include a person who holds more than 25 percent of the shares or voting rights in the company; a person who holds the right to appoint or remove a majority of the board of directors of the company; a person who has the right to exercise, significant influence or control over the company; and even a person who has the right to exercise significant influence over a trust or firm which fits any of the preceding descriptions.

Reaction to the Sanctions Act

Unsurprisingly, the Act is not without controversy.  From the moment the provisions concerning the Overseas Territories became known, they engendered various public statements from or on behalf of the Overseas Territories affected.  The relevant section’s primary goal is to combat financial crime in the territories: opening the registers to public scrutiny makes it harder to conceal corruption, money laundering, tax evasion and similar activities, and so makes the territories less attractive to criminals.  That is, in any event, the theory espoused by its supporters.  Financial services stakeholders argue, however, that such a requirement would violate their clients’ privacy rights, which in turn could cripple the industry. They also point out that other jurisdictions around the world engaged in the same industry are not required to meet this standard and that its imposition will therefore lead unfairly to the flow of business to those other jurisdictions.  The result, it is said, will be that the provision will be self-defeating, in that it will then become more difficult to obtain the relevant information.

In a Ministerial Statement dated May 4, 2018 and headed “The British Government vs The Bermuda Constitution”, Premier David Burt referred to the action taken by the UK Parliament as one “imposed in the absence of any applicable international standard [which] can only be viewed as a direct assault on the conduct of legal business in the Overseas Territories.”  He went on to refer to “the wider issue of the UK Parliament’s wanton disregard for the unique constitutional position of Bermuda”, which he described as being “of greater concern to the Government and people of Bermuda”.  He called the action taken “an egregious breach of well-established constitutional coventions”.  He continued, “the constitutional position is founded in entrenched conventions that any legislative power sought to be exercised by the UK Parliament over Bermuda can only be done with the consent of the Bermuda Legislature.”  His defiant conclusion was:

“There will be no public register of Beneficial Ownership in Bermuda until this Honourable House, elected by the people of Bermuda votes to implement one! The Government rejects the regressive colonial mindset that some in London hold, that a Parliament 3000 miles away can impose anything on Bermuda that does not fall under the areas of Defence, Internal Security, the Judiciary, and External Affairs.”

In an interview with Bloomberg[1]Premier Burt is reported as having also said:

“The era of colonialism ended quite a while ago; Bermuda sets its own laws and the only time that we’ll have a public register of beneficial ownership is when the Bermuda Parliament decides to do so.”

Deputy Premier Walter Roban added[2]:

“We don’t recognise the authority of the UK Parliament to legislate over Bermuda outside of the prerogative powers that already exist in our constitutional order section 62 — that is understood by the elected minister and agreed with.”

“Bermuda will only do what is passed in the Bermuda Parliament.”

The Premier and Deputy Premier are not alone in their condemnation of the UK Parliament’s action.  Leaders and commentators of other Overseas Territories essentially echo their sentiments.

It would appear that the view being taken is that Bermuda sets its own laws; that the UK Parliament cannot legislate for Bermuda otherwise than with the consent of the Bermuda legislature and that Bermuda is in a position to reject the UK Government’s intention to legislate for Bermuda.

The law

The law in this area has been crisply stated as follows[3]:

“The competence of the Parliament of the United Kingdom to legislate for the British overseas territories and other dependencies of the Crown has not been in serious doubt since the seventeenth century. From the middle of the nineteenth century, however, there was a convention against Parliament legislating for the self-governing colonies and colonies with responsible government without their consent. However this convention does not restrict the legal powers of Parliament, and may in any event be inoperative in some circumstances.”

Another text explains[4]:

“The Westminster Parliament is the supreme legislative authority of the United Kingdom and of all territories under UK sovereignty.  Accordingly, Parliament has unlimited power to enact laws for all British overseas territories.

Acts of Parliament confer power to make subordinate legislation for the overseas territories. Such a power is usually conferred on Her Majesty to legislate by Order in Council.

There is no rule of law that requires the consent of a territory, or even prior consultation with a territory, before Parliament legislates for it.  In modern practice consultation is normally undertaken where practicable.

The power of Parliament to legislate for a British overseas territory is a principal mark, if not the principal mark, of the dependence of the territory on the United Kingdom.  Acts of Parliament granting independence routinely provided for the removal of that power.”

The Premier and Deputy Premier’s propositions in light of the law

It is apparent that the propositions put forward by the Premier and Deputy Premier are (legally at least) misconceived.  In this area, Bermuda holds a constitutional position in common with the other overseas territories, one which is therefore not unique. There may be a convention as to consent, but this does not restrict the UK Parliament’s legal powers, indeed, there is no rule of law requiring even consultation.  No entrenched or inviolable constitutional convention therefore prevents the UK Parliament legislating for Bermuda.  The subject matter of imposed legislation is unlimited and in particular, is not limited to the topics referred to.  Given that the power of the UK Parliament to legislate for Bermuda is the principal mark of Bermuda’s dependent constitutional status, the idea that Bermuda is in a position to reject this power must be entirely without foundation.  Bermuda does set its own laws, but only in so far as the United Kingdom does not set laws for it, which it is perfectly entitled to do.  Morever, it should also be noted at this point, Bermuda’s legislature does not have the power to override inconsistent UK legislation extending to Bermuda, because of the Colonial Laws Validity Act 1865, which continues to apply.  Such Bermuda legislation would be “absolutely void and inoperative” to the extent of the inconsistency, to use the language of that Act.  So any attempt by the Bermuda legislature to pass a law inconsistent with an Order in Council under the Sanctions Act would be entirely ineffective.  It follows that Bermuda is in no position to not recognise UK legislation designed to enforce public registers, nor is Bermuda in a position to not recognise the authority of the UK Parliament to legislate for Bermuda on any topic.

A possible means of attack

However, the decision to make an Order in Council under the Sanctions Act could be attacked in UK courts on the basis that, in the particular circumstances of the case, to proceed with it would be in breach of the usual public law principles of irrationality, illegality or procedural propriety.  In relation to irrationality, for example, an argument could perhaps be made to the effect that to make such an Order in Council, given the concerns about the disproportionate impact of the measure, its self-defeating nature and so on, would be irrational in the public law sense.  In relation to procedural propriety, it could conceivably be argued that Bermuda has a legitimate expectation of consultation, given the accepted constitutional convention.  It is respectfully suggested that to test the matter in this way is an approach which ought to commend itself to the Bermuda Government, as its chances of success are far higher than to seek to assert that Bermuda may simply ignore the UK Parliament while still retaining its overseas territory status.

Implications

Bermuda derives advantage from its connection with the United Kingdom, to the extent that it is able to advertise that it offers the security and stability traditionally associated with the British flag. Decisions made by Bermuda’s overseas clients typically give weight to this important factor.  It is that very residual or ultimate control by the United Kingdom that offers the security and stability, at least perceptually, that Bermuda is able to promote.  That control is the primary marker of the relationship of dependence.  It is therefore an inherent part of the perceived advantage associated with such status.  Bermuda must decide whether it continues to carry its weight, whether economically, socially, culturally or socio-economically.  If it does not, then logic suggests that the way forward is to terminate the relationship of dependence which confers such control. Nothing else will eliminate the legal fetters which, it seems, the Premier and Deputy Premier at least, given their statements, would seem desirous of shaking off.

Ronald H Myers is the Director of Marshall Diel & Myers Ltd.

[1]           Reported in Bernews (http://bernews.com/2018/05/overseas-territories-accuse-uk-colonialism/).

[2]           During a meeting with the UK’s Minister of State for the Commonwealth and the United Nations reported in The Royal Gazette(http://www.royalgazette.com/news/article/20180615/roban-attends-conference-for-ots-in-london&source=RSS).

[3]          Halsbury’s Laws of England, Title: “Commonwealth”, Volume 13 (2017), paragraph 709.

[4]          British Overseas Territories Law(Second Edition), Hendry & Dickson, pages 57 to 59.

This article was originally published in the September 2018 edition of the RG Business Magazine.

The post The Sanctions and Anti-Money Laundering Act 2018 appeared first on RG Magazines.

Introduction

A corporation cannot enter into a contract if it does not have the legal capacity to do so.  The doctrine of “ultra vires”, with its Latin rubric, might perhaps be regarded as antiquated, and as mere “legalese”, but in Bermuda at least (and in many other parts of the Commonwealth) it can have wide ranging and severe commercial consequences, in particular in relation to persons dealing with statutory corporations. Such corporations include, in Bermuda, the Bermuda Gaming Commission, the Bermuda Monetary Authority, the Bermuda Tourism Authority, WEDCO, BDLC, BHC, the Hospitals Board and the Corporation of Hamilton.  The decisions of the Supreme Court and the Court of Appeal in the MIF litigation (Corporation of Hamilton v Mexico Infrastructure Finance LLC [2016] Bda LR 110 and Mexico Infrastructure Finance LLC v Corporation of Hamilton [2017] CA (BDA) 11 Civ, (2017) 90 WIR 232) serve as a poignant reminder of the fact that innocent third parties must take special care when dealing with statutory bodies.

The doctrine

The literal translation of “ultra vires” is “beyond the powers”.  In the context of a corporation whose powers are conferred by statute, it means that the corporation only has the powers expressed in the statute, as well as any other powers which may necessarily be implied from the terms of the statute, or which may be expressed or necessarily implied from other statutes.  The question is therefore one of interpretation, a process which can be complex.

Having determined that the statutory corporation has the requisite power, it is then necessary to determine whether the power has been exercised in a proper manner and for proper purposes, as a power not so exercised is equally ultra vires.

Broadly speaking, acts and omissions of statutory corporations which involve illegality, irrationality or procedural impropriety are treated as ultra vires.  Thus, if the corporation takes some action or decision for a purpose which is not one authorised by the statute in question; or takes a decision involving an error of reasoning depriving it of its logical integrity; or is guilty of unfairness, bias or the appearance of impropriety, the action or decision taken will be ultra vires. It is also ultra viresstatutory powers to act in bad faith, to ignore something legally relevant, to take into account something legally irrelevant, or to act in accordance with some rigid policy rule, or under the dictation of some other person or authority.  The range of potential errors which could render an action or decision ultra viresis considerable.

The consequences

If a statutory corporation purports to exercise a power which it does not have, or exercises a power which it does have unlawfully, the exercise of the power is ultra vires, with the result that it is void and of no legal effect whatsoever.  A contractual transaction which is ultra viresis therefore of no legal effect; and neither contracting party can enforce it or sue for damages for breach.  Further, the corporation can escape contractual liability entirely by raising its own ultra viresas a defence to an action based on the contract.  This is so even despite the passage of time, or the corporation acquiescing in the performance of the contract by the other side, or encouraging the other side to perform, or making representations that it had the power to enter into or perform the contract, or attempting to later ratify the contract, or delaying in raising the defence.  It is even so if the corporation accedes to a consent order of the court consenting to a judgment given against it on the contract and even if the corporation seeks to take the point some considerable time afterwards.

These principles, create an obvious risk, both legal and commercial, for those doing business with such corporations.  An innocent third party who has entered into a contract with a statutory corporation in good faith may find itself unable to sue to enforce the bargain if the transaction entered into with the corporation was outside the corporation’s powers.  This is even the case where the risk may not have been discoverable easily or at all.  Further, to make things more difficult, the innocent third party cannot rely on its own ignorance of the limitations of the corporation’s powers.  Nor would a warranty in the contract to the effect that the corporation had the relevant power assist, as that too would be equally ultra vires.

The doctrine (as interpreted by the Courts) renders the due diligence exercise, in short, something of a minefield. Finding, reading and correctly interpreting the governing statute (as well as any other applicable statutes), as difficult as that may be, is not be sufficient.  The innocent third party also need to be in a position to assess the rationality and procedural propriety of the decision to make the contract.  That involves making a judgment on such matters as: whether all relevant factors had been taken into account and all irrelevant ones excluded from consideration; or whether or not the corporation may be acting in bad faith, for example, in order to make some sort of unauthorized profit rather than to further its statutory purposes.

From the perspective of legal policy, this seems an odd position for the law to adopt.  The notion that the enforceability of statutory corporations’ contracts should be subject to the ultra viresdoctrine with these results has been described as “harmful and irrational”. Commentators have further pointed to the potential impact of the ultra viresrisk on commercial decisions in relation to entering into contracts with public corporations and the possible consequence that, in order to compensate for this risk, businesses contracting with public corporations may increase prices, thus leading to the undesirable consequence of increasing the cost of public contracting.

On the other hand, it has been argued that the ultra viresdoctrine, despite its apparently troublesome consequences, is justifiable on the basis that it upholds, supports and promotes the rule of law, which is possibly the most important of constitutional and political values.  The rule of law in this context means that the corporation must act in accordance with the law as enacted or framed by the legislature and with the constitution.  This is a fundamental constitutional principle, the purpose of which is to protect individual citizens from illegal action by the government.  In relation to municipalities, this rationale (it has been said) is further buttressed by the related doctrine that municipalities owe their ratepayers a duty in the nature of a fiduciary duty in relation to the use to which they put their rates.  To permit a municipality to use rates otherwise than for statutorily authorised purposes would be a breach of this duty; and for the council of a municipality not to raise the ultra viresdefence to an action for monetary recovery on a contract in order to protect ratepayers’ funds would likely similarly be a breach of duty.

Thus, although applying the consequence of absolute invalidity or voidness may be a particularly strict approach, it has the advantage of being an unambiguous declaration by the courts of their concern to protect the rule of law, constitutional principle and ultimately, individual citizens from illegal action by the government. Accordingly, it is said, this strict approach is justifiable.  Public accountability, it is asserted, ought to outweigh commercial convenience, especially given that the ultra viresrisk is a known one and can be addressed by careful legal advice, which then passes the risk on; as does transaction insurance, which is also an available option.

The MIF litigation

Facts

The facts of the MIF litigation and the legal arguments made perfectly illustrate the various policy issues arising from these competing approaches.  Successive Councils of the Corporation of Hamilton thought that it would be a good idea to promote the development of a St. Regis hotel in the city of Hamilton.  The Corporation therefore took the view that it should assist a private company, Par-la-Ville Hotel and Residences Estates Limited (“PLV”), to do so.  The eventual mechanism for such assistance was the provision of a secured guarantee by the Corporation of a bridging loan of $18 million to PLV from Mexico Infrastructure Finance LLC (“MIF”).  The security for the guarantee was a mortgage on the retained freehold interest of the development land leased to PLV pursuant to a development and lease agreement between the Corporation and PLV.  The purpose of the loan was not to fund the development project itself, but to put PLV in funds to discharge certain debts by way of anticipated expenses to be incurred in securing the equity and senior lending that would fund the development project.

The Government of the day supported the development project, proposing and ensuring the passage of motions in both Houses of the Legislature approving the issuance of the guarantee and the guarantee and mortgage documents themselves, and granting the requisite Ministerial permissions under the companies and immigration legislation, as well as under the Municipalities Act 1923.  In addition, as there had been some disquiet as to the Corporation’s capacity to issue the guarantee, the Government sought to dispel it by procuring the enactment of the Municipalities Amendment Act 2013, which contained provisions thought to address that issue.

PLV defaulted on the loan and, having issued a demand for the entire balance in December 2014, MIF accordingly sought to enforce the Corporation’s guarantee.  MIF applied for summary judgment and acting on advice that there was no defence, the Corporation acceded to a consent order, which was granted in May 2015.  Having obtained fresh legal advice, the Corporation commenced proceedings in late June 2016, over a year later, seeking to set aside the consent order, on the ground that it had no power to provide the guarantee, which it accordingly asserted to be null, void and of no effect, and the further ground that it therefore had no power to consent to its enforcement.

Law

Both the Supreme Court and the Court of Appeal agreed that the Corporation had to exercise its power to enter into a contract of guarantee in a manner that was consistent with the statutory purposes, and that the Municipalities Act 1923 properly construed in relation to the facts of the case meant that the Corporation had to act for municipal purposes.  The Court went on to say that this involved provision of services to ratepayers as part of the Corporation’s function of the local government of the City of Hamilton.  The purpose of the guarantee was to facilitate a hotel development by a commercial developer and this purpose was held not to involve the provision of services to ratepayers and therefore not to be a municipal purpose.  Accordingly, the Court found, in giving or purporting to give the guarantee, the Corporation had acted ultra viresits powers.

This was so despite the fact that successive Councils of the Corporation, as well as the Government of the day, supported the development project because it was thought it would benefit the City and Bermuda as a whole; despite the Corporation consenting to a judgment against it, having not at the time raised the ultra viresdefence; and despite the passage of time since the consent judgment had been entered.

On this point, it was argued that, given the ultra viresdefence was available at the time of the consent judgment, it ought to have been raised, and for that reason to subsequently attempt to raise it as a ground for setting aside the order was an abuse of process of the Court.  The Court of Appeal, however, held that the abuse of process rule was displaced by the ultra viresdoctrine.  The Court of Appeal followed the logic of the ultra viresdoctrine to its ultimate conclusion, holding that the consequence was that the consent judgment (being ultra vires) could not be effective or binding in any way and accepting that in any event, in principle, such a consent judgment could not in law be an adjudication to which the abuse of process rule could attach.

Although the Court of Appeal did not need to apply the test for abuse to the facts, it agreed with the Supreme Court that there was no abuse.  The Court of Appeal emphasized that MIF had been made aware of the risk at an earlier stage of the transaction by the Corporation’s lawyers at the time, that the risks of transactions with entities such as the Corporation were well known in the marketplace, that MIF seemed to have relied on the advice of the Corporation’s attorneys rather than taking their own advice, that MIF’s attitude towards effecting recovery did not appear urgent, and that MIF were sophisticated lenders who had entered into the transaction voluntarily and with a view to profit.

There is an appeal to the Privy Council pending in relation to the question whether the guarantee was ultra viresthe Corporation’s powers, but there is no appeal in relation to the abuse issue, hence the decision of the Court of Appeal stands in relation to that issue.

The position now

The case re-affirms the relevance of the ultra viresdoctrine in the modern commercial context (on the particular facts, commercial lending to a municipality or public authority).  It demonstrates that the Bermuda court will apply not merely the simple version of the doctrine, involving an analysis of the relevant statutes in order to determine whether there is power to make a particular contract, but also the more far reaching principles, requiring that the third party ask and answer a wide range of additional questions, such as whether the particular corporation:

• has acted in good faith,
• reasonably and rationally,
• taking everything relevant into account and excluding from consideration everything irrelevant,
• for proper purposes,
• in accordance with relevant procedures, and
• has not permitted itself to slavishly follow a rigid a priori policy without proper consideration of the individual merits of the particular decision.

It also demonstrates the court’s commitment to fundamental constitutional principle and the rule of law, even in the face of competing commercial considerations.  The consequences of this approach will no doubt unfold as time goes by.  But what is clear is that, even if the impact on commercial dealings with public corporations turns out to be deleterious, given the court’s demonstrable commitment to the concept, legislative intervention will likely be necessary to deal with any perceived difficulties.  Bermuda may have to follow the UK in this regard.  In the meantime, those contracting with public corporations ought to take particular care that a proper and comprehensive process of due diligence is undertaken.  Time will tell whether the Privy Council agrees.

The post New wine in old bottles: commercial reality and the doctrine of ultra vires appeared first on RG Magazines.

For any organisation, personal information about customers, clients, employees and suppliers is a valuable asset. But it is also a responsibility. Protecting the privacy of personal information is not just a hot topic on the internet, it is now every Bermuda organisation’s legal duty.

The Personal Information Privacy Act 2016 (PIPA), which will come into force in the latter part of 2018, affects every individual and organisation that uses personal information in Bermuda, including companies, charities and Government. It imposes a number of requirements for the safeguarding and use of personal information – and significant penalties for non-compliance – so businesses need to be prepared.

Why was PIPA introduced?

Across the world, there is a move towards increasingly stringent regulation putting the onus on organisations to protect individual privacy by safeguarding any personal information that they hold. PIPA is intended to ensure that Bermuda is part of the international ‘network of trust’ between countries with similar levels of privacy protection. For example, the European Union’s General Data Protection Regulation (GDPR) came into force this month. PIPA should ensure that Bermuda meets the GDPR’s standard of ‘adequacy’ that will allow the free flow of personal data from the EU to Bermuda without additional conditions being imposed.

What counts as Personal Information?

‘Personal information’ is any information about an identified or identifiable individual. PIPA encompasses information in both digital and non-digital (paper) forms and defines its ‘use’ very broadly to include collection, storage, disclosure, transfer and destruction.

‘Sensitive personal information’ which includes information about an individual’s race, health, family status or religious beliefs, is a separate class of personal information and is subject to enhanced protection. Employee data inevitably includes much of this information. Businesses should pay particular attention to the appropriate collection, handling and secure storage of this data.

What are the key requirements?

Safeguarding privacy means managing risks. Every organisation is required to have suitable policies and practices with regards to the protection and use of personal information and should make sure their employees are aware of them. They must:

• Ensure personal information is held securely with ‘appropriate safeguards’ against risks such as loss and unauthorised access, and misuse such as unauthorised disclosure or destruction.
• Use personal information in a ‘lawful and fair manner’, for specific purposes only and in accordance with the rights of individuals. Information held should not be excessive for the purpose, should be accurate and up-to-date and not held for longer than necessary.
• Notify the Government-appointed Privacy Commissioner promptly in the event of a security breach leading to the loss, destruction or unauthorised disclosure of personal information which is likely to adversely affect individuals.
• Assess the protection provided by any third parties engaged to use or handle the information. The primary organisation remains responsible for compliance. Personal information should not be transferred outside Bermuda without adequate checks and safeguards.

 What are the penalties for non-compliance?

PIPA establishes a number of offences and penalties for failure to comply with the Act, including fines of up to $250,000 for organisations, and up to $25,000 or imprisonment up to two years for individuals.

 How to prepare

It is a good idea to seek legal advice to ensure you are ready to meet your data protection obligations. Assistance can range from advice on legal duties and risks to privacy policy implementation.

Kathleen Moniz is an Associate in the Corporate Practice of Conyers Dill & Pearman.

This article was featured in the May 2018, RG Business Magazine.

The post Bermuda’s new privacy legislation: Are you prepared? appeared first on RG Magazines.