The Office of the Privacy Commissioner of Bermuda

In a seashell:

Under section 19 (Correction, blocking, erasure and destruction) of PIPA, you have the right to make a written request to an organisation to correct an error or omission in any of your personal information which the organisation holds about you. This is known as the right to correction. If your information is inaccurate or incomplete, you can ask the organisation to correct the personal information or complete it by adding more details.

If there is an error or omission in the personal information that an organisation holds on you, you can ask the organisation to correct it. Upon receiving your written request for a correction, the organisation must make the requested changes to your personal information as soon as reasonably practicable. The organisation may ask you for additional information as supporting evidence to honour your right to correction.

Additionally, where the organisation has shared the incorrect information with other organisations, the organisation is required to send a notification containing the corrected information to each organisation with which the incorrect information has been shared, if it is reasonable to do so.

Scenario

 

After collecting your health insurance card from your employer, you notice the insurance company has misspelt your surname. You should contact your insurance company with a request to get your personal information corrected.

People ask:

1. How do I get my information corrected?

In order to request an organisation to correct the incorrect or inaccurate information, you must contact the organisation in writing, using the contact details provided in the organisation’s privacy notice and let them know what personal information you want them to correct.

You must inform the organisation in writing that your personal information is inaccurate and that you want it corrected. You should:

• state clearly what personal information you believe is inaccurate or incomplete;
• explain how the organisation should correct it; and
• where available, provide evidence of the inaccuracies.

The added value of having everything in writing is that it will allow you to explain your concern, give evidence and state your desired solution. It will also provide clear proof of your actions if you decide to challenge the organisation’s initial response.

​

2. What if the information refers to an error?

If there is an error in the personal information that has been corrected, the organisation will likely maintain a record of the error alongside the correct information to ensure the organisation can take into account the period of time before correction.

Scenario

 

An optician finds that a patient has a specific eye condition and notes it in their medical records. Sometime later, this diagnosis is found to be wrong. The medical records should likely include both the initial diagnosis and the final findings as this gives an accurate record of the patient’s treatment. As long as the medical record contains the up-to-date findings, and this is made clear in the patient’s record, it would be difficult to argue that the record is inaccurate and should be corrected. Recording the error may be necessary to explain why certain medicine was prescribed at the time.

3. How should I raise my concern with an organisation about how they have mishandled my information?

Please refer to p. 26 of this guide. When submitting your written request, you can use the master template on pp. 18-19 to help you raise your concern. The use of the master template is intended to serve as guidance when formally communicating with the organisation. Any other written format that you deem appropriate may also be used to raise your concern.

4. What should organisations do?

When an organisation is asked to correct information, it should take reasonable steps to investigate and confirm whether the information is accurate. To do this, the organisation should consider the evidence you provide. The organisation should be able to demonstrate what measures it has taken in response to your request.

The organisation should then contact you to:

• confirm it has acted on your instruction; or
• inform you that the organisation will not correct the information and provide an explanation as to why it believes the information is accurate.

As a matter of good practice, if the organisation refuses to correct the information, the organisation should record that you have challenged the information’s accuracy, along with the reasons why you did so.

5. When can an organisation say no?

The organisation can refuse to comply with a request for correction if it believes that the request is “manifestly unreasonable”. The organisation should explain why it believes that it does not have to comply with your request and let you know about your right to complain about this decision to PrivCom or through courts. For more information, see pp. 27-29 (Making a complaint).