The Office of the Privacy Commissioner of Bermuda

In a seashell:

 

Under section 17 of PIPA, Access to personal information, you have the right to access the personal information that an organisation holds about you. However, there are situations where an organisation may refuse your request to access your personal information.

People ask:

1. What is the right of access?

Under PIPA, you have the right to ask an organisation whether it is using or storing your personal information. You can also ask the organisation for copies of your personal information.

 

In order to request an organisation to provide you with copies of your personal information, you must do so in writing, using the contact details provided in the organisation’s privacy notice.

This is called the right of access and is also commonly known as making an access request.

2. Why do individuals make an access request?

You can make an access request to find out:

•  what personal information an organisation holds about you;
•  how the organisation is using it;
•  who the organisation is sharing it with; and
•  where the organisation got your information from.

The information obtained through an access request can also help you effectively exercise your 
other privacy rights: the right to have your information corrected, blocked, erased or destroyed.

If or when you make a request to an organisation in relation to any of these rights, they are 
generally referred to as a PIPA rights request, or an individual rights request.

It is important to be aware that none of these rights are absolute. This means there are conditions under PIPA, under which organisations may lawfully refuse your PIPA rights request. This may include situations when an organisation:

•   is not required to provide access;

 

or

•   is restricted from providing access.

This guidance will help you understand the circumstances when organisations may refuse your PIPA rights request.