While data protection and technological issues may often feel completely new, laws like Bermuda's PIPA - the Personal Information Protection Act - didn't invent privacy.
In fact, last week we received a reminder of just how enduring and well-established privacy is, when the European Convention on Human Rights (ECHR) turned 70 years old.
Signed in Rome on 4 November 1950, the ECHR "gave binding effect" to human rights, including a right to respect for private and family life, that had previously been discussed in less legally-enforceable tones.
Shortly thereafter, when the ECHR came into effect in the United Kingdom in 1953, the UK further extended its protections to include other territories, such as Bermuda. Since that time, Bermudians have benefited from the legal protections of the ECHR and the European Court of Human Rights that interprets it.
ARTICLE 8: Right to respect for private and family life
1. Everyone has the right to respect for his private and family life, his home and his correspondence.
2. There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.
The text of the ECHR is available in most European languages, including English and Portuguese.
While the language of Article 8 seems simple, it delves into many aspects of society, including privacy and data protection; physical, psychological, or moral integrity; identity and autonomy; families; home affairs; and correspondence. The European Court of Human Rights (ECtHR) has developed a body of case law that details how privacy rights are expressed in daily life.
The decisions of this court also play a role in protecting the rights of Bermudians. As recently as 2018, in the case of Roderick v Attorney General [2018] SC (Bda) 46 Civ (6 June 2018), Chief Justice of the Supreme Court Ian Kawaley wrote: "[85.] ECHR cases are only relevant and highly persuasive in terms of construing fundamental rights and freedoms under the Bermuda Constitution when the relevant ECHR provisions have been incorporated into Bermuda’s Constitution."
Indeed, Bermuda's 1968 Constitution explicitly protects Bermudians' privacy, stating in Chapter 1, Section 1, "Fundamental rights and freedoms of the individual":
1. Whereas every person in Bermuda is entitled to the fundamental rights and freedoms of the individual, that is to say, has the right, whatever his race, place of origin, political opinions, colour, creed or sex, but subject to respect for the rights and freedoms of others and for the public interest, to each and all of the following, namely:
"(a) life, liberty, security of the person and the protection of the law;
"(b) freedom of conscience, of expression and of assembly and association; and
"(c) protection for the privacy of his home and other property and from deprivation of property without compensation..."
These rights are further described in subsequent sections of the Constitution's Chapter 1.
New technologies can often give the impression that privacy is a new issue, but in fact it is an old right, with an existing legal history dating back decades.
Nothing we do is in a vacuum. Laws and lawmakers have often been influenced by factors from around the world, even if only in a persuasive way by virtue of the force of logic. When we find ourselves in need of assistance in understanding these complex issues, Bermudians can turn to a lifetime of laws, decisions, and interpretations relating to the European Convention on Human Rights.
Alexander McD White
Privacy Commissioner
To reach out to the Office of the Privacy Commissioner, please visit our Contact Us page.
Press Background:
Rights and responsibilities relating to data privacy are set out in the Personal Information Protection Act 2016 (PIPA). Bermuda's PIPA received Royal Assent on 27 July 2016. Sections relating to the appointment of the Privacy Commissioner were enacted on 2 December 2016, including the creation of the Office as well as those duties and powers relevant to its operation in the period leading up to the implementation of the whole Act. The Commissioner works to facilitate the advancement of consequential amendments to other Acts in order to harmonise them with PIPA.
The Office of the Privacy Commissioner for Bermuda (PrivCom) is an independent supervisory authority established in accordance with the Personal Information Protection Act 2016 (PIPA).
The mandate of the Privacy Commissioner is to regulate the use of personal information by organisations in a manner which recognizes both the need to protect the rights of individuals in relation to their personal information and the need for organisations to use personal information for legitimate purposes, among other duties.
The Privacy Commissioner's powers and responsibilities include monitoring the processing of personal information by both private- and public-sector organisations, investigating compliance with PIPA, issue guidance and recommendations, liaise with other enforcement agencies, and advise on policies and legislation that affect privacy. PrivCom also works to raise awareness and educate the public about privacy risks, and to protect people’s rights and freedoms when their personal data is used. The general powers of the Privacy Commissioner are outlined in Article 29 of PIPA.
Alexander White (Privacy Commissioner) was appointed by His Excellency the Governor, after consultation with the Premier and Opposition Leader, to take office on 20 January 2020.
Privacy is the right of an individual to be left alone and in control of information about oneself. In addition to the protections in PIPA, the right to privacy or private life is enshrined in the United Nations' Universal Declaration of Human Rights (Article 12) and the European Convention of Human Rights (Article 8).
"Personal information" or data is a defined term in PIPA that means any information about an an identified or identifiable individual. Examples include names, dates of birth, photographs, video footage, email addresses and telephone numbers. "Sensitive personal information" is a defined term in PIPA that includes information relating to such aspects as place of origin, race, colour, sex, sexual life, health, disabilities, religious beliefs, and biometric and genetic information. (Note: This is not a complete list.)
"Use" of personal information is a defined term in PIPA that means "carrying out any operation on personal information, including collecting, obtaining, recording, holding, storing, organising, adapting, altering, retrieving, transferring, consulting, disclosing, disseminating or otherwise making available, combining, blocking, erasing or destroying it."
About the European Convention on Human Rights: The European Court of Human Rights and the Council of Europe developed an introduction and fact sheet for the convention titled, "The European Convention on Human Rights: A Living Instrument".