
The ability of political parties and campaigners to effectively communicate with their voters is of vital importance in any democratic society at any given time, especially ahead of local and general elections. It is also important for the integrity of elections and democracy that all organisations involved in political campaigning handle and use personal information in a way that is compliant with the Personal Information Protection Act 2016 (PIPA) that came into effect on 1 January 2025.
The latest digital technologies and communication tools, such as social media and commercial marketing techniques, have changed political campaigning. Political campaigning has become increasingly sophisticated, with campaigners trying to understand their potential voters in order to convey their political messaging to them effectively. Transparency about these tools helps voters make informed choices.
Understanding how political parties and campaigners use voters’ personal information when deploying digital technologies is essential not only to the electorate’s trust and confidence, but also to the whole democratic process and the rule of law.
Personal Information Protection Act 2016 (PIPA)
The mandate of the Office of the Privacy Commissioner for Bermuda (PrivCom) is to regulate the use of personal information by organisations in a manner which recognises both the need to protect the rights of individuals in relation to their personal information and the need for organisations to use personal information for legitimate purposes, among other duties.
In accordance with PIPA, “organisation” refers to “any individual, entity or public authority that uses personal information”. This includes political parties.
Privacy and Elections
With the announcement of the general election having been called for 18 February 2025, it is political season in Bermuda. Here are some key privacy-related takeaways:
Under section 7 of PIPA, political opinions are considered sensitive personal information. This means:
Such information may not be used in order to discriminate contrary to any provision of Part II of the Human Rights Act 1981 [section 7(2)];
Organisations cannot rely upon the reasonable use condition [section 6(1)(b)]; and
Organisations should protect the information with appropriately heightened security safeguards [section 13(2)(b)].
Use of personal information for elections
One of the conditions under which PIPA allows organisations to use personal information is when the use of the personal information is pursuant to a provision of law that authorises or requires such use.
The Parliamentary Election Act 1978 allows the Parliamentary Registrar to use personal information (including name, address, and postcode) to publish the parliamentary register. The purpose of the registrar is to confirm whether individuals are electors by permitting the public to review the identity and details of electors and make an objection or challenge.
Sending Political Emails
Instances of mishandling personal information, including sensitive personal information, through email are frequent but can be prevented. Simple steps such as using the blind carbon copy (BCC) line will reduce risk that information is misused. To learn more about maintaining privacy in email communication, read our guidance note.
Canvassing
Canvassing entails going door-to-door in a neighbourhood, as well as in public locations, and having conversations about important topics that matter to voters. While canvassing in local neighbourhoods is seen as the most effective way of engaging in a dialogue with community members, it does present a number of privacy-related challenges.
Individuals may choose to release their personal information with people doing door-to-door canvassing, but there is no obligation on individuals to do so. Personal information does not necessarily include all information that individuals share during a face-to-face chat, but it does cover any information relating to them which is, for example, recorded electronically, written down and kept on file, or added to a database or structured filing system.
Public representatives, electoral candidates, their representatives, and any political parties engaged in door-to-door canvassing and collecting personal information about individuals must put appropriate safeguards in place to accurately record and protect any personal information collected from the individuals, including political opinions.
Privacy Rights under PIPA
When personal information is collected and used for the purposes of political canvassing or electoral activities, individuals have the following PIPA rights and expectations:
To be given clear, concise, and transparent details (privacy notice) about the collection and use of personal information, including the identity of the person for whom it is collected, why it is being collected, how it will be used, who it will be shared with, how long it will be kept, and what other rights individuals have in relation to that personal information;
To request access to one’s own personal information held by any public representative, electoral candidate, or political party, unless an exemption applies;
To have one’s own personal information protected from being used for any purpose other than the valid and lawful purpose or purposes for which it was collected, or a further purpose which is compatible with the original purpose;
To have one’s own personal information kept accurate and up-to-date and to have any inaccurate and/or incomplete information corrected and/or completed;
To have one’s own personal information kept safe and secure in an appropriate manner;
To block the use of one’s own personal information in relation to marketing; and
To make a complaint or report a concern to the Office of the Privacy Commissioner for Bermuda at www.privacy.bm.
Importantly, an individual’s right to block the use of personal information in relation to marketing still applies in the context of online and electronic canvassing (such as texts, emails, phone calls, or faxes) carried out by public representatives, electoral candidates, or political parties.
Any information that is held when PIPA came into effect is deemed to have been obtained with the consent of the individuals. Individuals should only receive marketing communications if they have consented to receive them. Consent can be withdrawn. The sender of any such communications should inform the recipient of their identity and provide the recipient with an easy-to-use way of opting out of further communications. In practice, individuals should be able to withdraw consent as easily as they would give it.
Individual rights under PIPA are not absolute! This means that an individual’s privacy rights might not apply because of an exemption or exclusion. Organisations that use personal information should explain these circumstances to the individuals.
To learn more about individual rights under PIPA, please refer to the Individuals’ Guide to PIPA.
To learn more about how to comply with PIPA as an organisation, please refer to the Guide to PIPA.
You can reach out to PrivCom by visiting the Contact us page.