The Office of the Privacy Commissioner of Bermuda

How should I make my complaint about how an organisation has handled my information?

​

             In a seashell

​

If you’re concerned about how an organisation is using your personal information, you can tell them.

You also have the right to complain to an organisation if you think it has not handled personal information responsibly, ethically, fairly, lawfully, and in line with good practice.

​

 

            Scenario

After collecting your health insurance card from your employer, you notice the insurance company has misspelt your surname.

You should contact your insurance company with a request to get your personal information corrected.

 

​

             People ask

​

When can I make a complaint to an organisation?

You can complain to an organisation about how it is handling yours or other people's information; if it:

• has not properly responded to your request for your personal information;

• is not keeping information secure;

• holds inaccurate information about you;

• has disclosed information about you;

• is keeping information about you for longer than is necessary;

• has collected information for one reason and is using it for something else; or

• has not upheld any of your data protection rights.

 

How do I complain to an organisation?

​

                           

                   First, address your complaint directly to the organisation that you’re upset with.

Before bringing your complaint to PrivCom, you should give the organisation an opportunity to address the issue at hand and sort it out. Many privacy complaints can be resolved quickly and easily with the organisation. Make sure to double check the organisation’s address is correct.

​

You can use the template below to email or send a letter to the organisation. Include full details of your concern at the beginning of your email/letter. If the organisation responds to your complaint but it looks like they have misunderstood you or not responded fully, let them know.

​

Include all relevant details in your email/letter, such as an account/patient/customer reference number to help the organisation identify you. To evidence your complaint, enclose copies of all main documents that you have. Don’t send the originals: you might need them later. Don’t include unnecessary documentation.

                                                                                                                                                

 

                                                                                                                                                            [Your full address]
                                                                                                                                                      [Your phone number]
                                                                                                                                                                         [The date]
                                                                                                                       [Name and address of the organisation]
                                                                                       [Reference number (if provided within the initial response)]

Dear [Sir or Madam / name of the person you have been in contact with]

Individual complaint under PIPA

[Your full name and address and any other details such as account number to help identify you]

I am concerned that you have not handled my personal information properly.

[Give details of your complaint, explaining clearly and simply what has happened and, where appropriate, the effect it has had on you.]

​

I understand that before reporting my complaint to the Office of the Privacy Commissioner for Bermuda (PrivCom), I should give you the chance to address it.

If, after receiving your response, I would still like to report my complaint to PrivCom, I will give PrivCom a copy of it to consider.

​

You can find guidance on your obligations under information rights legislation on the PrivCom’s website (privacy.bm) as well as information on their regulatory powers and the action they can take.

Please send a full response within 45 days. If you cannot respond within that timescale, please let me know when you will be able to respond and why.

If there is anything you would like to discuss with me in relation to my complaint, please contact me on the following number [telephone number].

Yours faithfully
[Signature]

​

             

                   Second, give the organisation 45 days to respond to your complaint or request. It may take the organisation time to consider your complaint. Follow up with them politely if nothing has been happening. The organisation should always acknowledge receipt of your complaint promptly.

​

           

                   Third, if you don’t understand or you’re unhappy with the response you receive from the organisation, ask them for clarification.

​

Organisations are obliged to explain to you why they use your information in the manner they do and/or why they have refused your request.

​

If the organisation gives you a response you do not understand, you should write to them asking for clarification. You may want to use the template below.

 

 

 

 

[Your full address]
[Your phone number]
[The date]

[Name and address of the organisation]
[Reference number (if provided within the initial response)]

​

Dear [Sir or Madam / name of the person you have been in contact with]

Individual complaint under PIPA

[Your full name and address and any other details such as account number to help identify you]

I am concerned that you have not handled my personal information properly.

​

[Give details of your complaint, explaining clearly and simply what has happened and, where appropriate, the effect it has had on you.]

​

I understand that before reporting my complaint to the Office of the Privacy Commissioner for Bermuda (PrivCom), I should give you an opportunity to address it.

​

If, after receiving your response, I would still like to report my complaint to PrivCom, I will give PrivCom a copy of your response to consider.

​

You can find guidance on your obligations under privacy rights legislation on PrivCom’s website (privacy.bm) as well as information on their regulatory powers and the action they can take.

​

Please send a full response within 45 days. If you cannot respond within that timescale, please let me know when you will be able to respond and why.

​

If there is anything you would like to discuss with me in relation to my complaint, please contact me on the following number [telephone number].

​

Yours faithfully

[Signature]

 

 

                       

                    Fourth, complain to PrivCom.

​

 

              People ask

​

What do I need to do before I can complain to PrivCom?

You can complain to PrivCom about the way an organisation has handled personal information.

 

Before you complain to us, you need to have:

​

• complained directly to the organisation;

• asked for clarification from the organisation if you have had a response you don’t understand;

• followed up with the organisation if you have not received a response after 45 days.

 

If you have taken these steps and the organisation is still refusing to respond to you, you can submit a complaint to PrivCom.

​

​

​