PrivCom’s New Supervision & Enforcement Unit

The Privacy Commissioner has established a “new Supervision and Enforcement Unit to assist the Commissioner’s delivery of effective regulation through proportionate supervision strategies and transparent decision-making to support the public trust in meaningful enforcement activity.”

A spokesperson said, “The Privacy Commissioner confirms the regulatory approach to be adopted by the Office of the Privacy Commissioner for Bermuda [PrivCom], their key regulatory priorities and the corresponding establishment of a new Supervision and Enforcement Unit to assist the Commissioner’s delivery of effective regulation through proportionate supervision strategies and transparent decision-making to support the public trust in meaningful enforcement activity.

Regulatory Approach & Key Priorities

“Commissioner Tucker’s regulatory approach will be built around three core pillars: Balance, Trust and Partnership. This approach recognises that the public office of the Privacy Commissioner must be accountable to the public and ensure that all resources of the public authority are properly and transparently deployed to make the greatest impact for the protection of informational privacy rights of individuals. Such a regulatory approach shall also ensure that the public authority continues to develop working relationships with other local and overseas regulators to support the harmonisation of regulatory supervision and enforcement approaches as needed to support the achievement of the objectives established in The Personal Information Protection Act 2016 [PIPA] and provide greater certainty for organisations using personal information in Bermuda.

“Key regulatory priorities identified by Commissioner Tucker include the establishment of a formalised and robust framework for the public authority’s engagement with organisations’ breach of security notifications, the development of educational initiatives for organisations as part of the Commissioner’s supervision activity to support the development and re-assessment of proportional security safeguards and corresponding measures that can reduce the risk of harm to individuals when breaches of security do occur. The delivery of the Commissioner’s regulatory approach will rely on the resolution of general intakes submitted to their office predominately via alternative dispute resolution to preserve resources for proactive and reactive engagement in regulatory supervision and intervention pertaining to breaches of security. This approach reflects that breaches of security can pose the greatest risk to the public-at-large.

“To support the delivery of their regulatory approach and priorities, Commissioner Tucker will shortly be establishing a new Supervision & Enforcement Unit at PrivCom. The establishment of the new Supervision & Enforcement Unit will result in an internal re-organisation to populate the unit. This re-organisation will clarify postholders’ responsibilities for the provision of effective assistance to the Privacy Commissioner in connection with the discharge of their functions and responsibilities for the administration of PIPA.

Engagement with Notifications on Breaches of Security

“Breaches of security often pose the most significant threat to individuals’ informational privacy rights and can fundamentally undermine trust in public institutions, charities and commercial bodies to the detriment of Bermuda society as a whole and the local economy. Section 14 of PIPA expressly requires organisations to, without undue delay, notify the Privacy Commissioner of a breach of security and to then notify any individual affected by the same. Section 29[1][a] establishes the proactive statutory powers of the Commissioner to conduct investigations concerning compliance with any provision of PIPA which can be utilised in connection with safeguarding the jurisdiction in cases of breaches of security. Within this context, the Privacy Commissioner also has the following relevant general powers:

• “to make an order on completion of an investigation whether or not an individual has requested a review of an organisation’s decision, action or failure to act [Section 29[1][b] of PIPA];

• “to comment on the implications for protection of personal information in relation to an organisation’s existing or proposed programmes [Section 29[1][f] of PIPA]; and

• “to issue formal warnings, admonish an organisation and bring to its attention any failure by the organisation to comply with PIPA or agree a course of action with an organisation [Section 29[1][h] of PIPA].

“Utilisation of these statutory powers by the Privacy Commissioner to prioritise timely regulatory intervention proactively, as well as in response to breach of security notifications can achieve the greatest impact for the protection of informational privacy rights of individuals at a jurisdiction-level. For organisations that have experienced a breach of security, such regulatory engagement should not be automatically assumed to be the commencement of an enforcement process – rather the supervisory engagement by the Commissioner to support an organisation’s compliance with the PIPA statutory framework.

“During such regulatory engagement, organisations will still remain fully responsible for their adoption of appropriate security safeguards, the re-assessment of the same and adopting a reasonable response to breaches of security. Regulatory intervention by the Privacy Commissioner may, however, inform organisations’ decision-making and support the mitigation or avoidance of harm to individuals materialising, following their identification of a breach of security and reporting to the independent regulator.

Realisation of Rights Through Alternative Dispute Resolution

“Section 38[1] of PIPA affords individuals the statutory right to request the Commissioner to review an organisation’s decision, action or failure to act following the submission of a request to an organisation with respect to that individual’s personal information. Section 38[2] of PIPA further affords individuals the statutory right to initiate a complaint with respect to a number of matters, as set out in Section 29[2] of PIPA.

“In alignment with the approach taken by international data protection authorities, intakes submitted pursuant to Sections 38 and Section 29[2] of PIPA may be used by the Privacy Commissioner to identify trends in risk allocation in various sectors in Bermuda to support education and sector-specific consultations and codes of conduct/codes of practice. At the Commissioner’s direction, the initial attempt at resolution of such intakes will predominately occur via alternative dispute resolution. Section 41 of PIPA expressly provides that the Commissioner may, at any time, attempt to have matter that is the subject of an application for review or complaint resolved by negotiation, conciliation, mediation or otherwise. The provision further provides that the Commissioner may authorise any person appointed to or engaged under Section 27 [Staff] to act as a mediator in this context. Participation is voluntary and any party may withdraw from the alternative dispute resolution process at any time.

“To read the entirety of Section 41 of PIPA, a copy of the legislation can be found here.

Strategy Meets Action: Phase A – The Development of Supervision and Enforcement Unit

“To date, the largest unit at PrivCom has been the Operations Unit in alignment with staff appointments largely corresponding to the delivery of PIPA pre-implementation preparedness activities and financial / operational matters. The current staff complement of PrivCom also reflects that the vast majority of the Privacy Commissioner’s statutory powers to conduct supervision and enforcement functions were not in force during the vast majority of the appointment of the first Privacy Commissioner.

“The Investigations Unit was established by the first Commissioner prior to their substantive supervision and enforcement powers coming into force on 1 January 2025. The establishment of this unit by the first Commissioner reflected that Section 29[1][a] of PIPA [which empowered the Privacy Commissioner to engage in pro-active investigations into non-compliance with the legislation] had been brought into effect within the jurisdiction before their appointment to office. When PIPA came fully into force on 1 January 2025, the Investigations Unit also became responsible for the case management of all intakes pertaining to complaints, breach of security notifications as well as requests submitted by individuals for the Privacy Commissioner to review an organisation’s decision, action or failure to act.

“The development of a Supervision and Enforcement Unit at the public authority will assist Bermuda’s second Privacy Commissioner in the exercise of their supervision and enforcement powers, as informed by their communicated regulatory approach and priorities. The establishment of this new unit will require investments to update existing digital infrastructure supporting the office’s relationship with stakeholders [such as updates to communication channels, its case management systems, website and forms used to engage with the public]. The Commissioner will further be engaging in recruitment activity to develop the staffing for the Supervision and Enforcement Unit.

Existing Case Management Processes and Educational Initiatives

“To date, the delayed appointment of the jurisdiction’s second Privacy Commissioner and time spent on their onboarding processes has challenged the ability of the public authority to process intakes submitted to the regulatory office and engage in educational initiatives. Coupled with the infrastructure challenges that PrivCom has experienced since August 2026, the Privacy Commissioner and public officers across all areas of the public authority have a reduced ability to engage with their work.

“Within this context, the Privacy Commissioner has determined that the mandate is best served at this time by focusing on the resolution of infrastructure issues and the prioritisation of the development of the Supervision and Enforcement Unit to safeguard the public-at-large in accordance with the regulatory approach and priorities discussed above.

“Priorisation of these matters will result in continued delays in connection with the public authority’s case management of intakes submitted by individuals. In this respect, PIPA does not establish a statutory timetable for the closure of any given intake, and the Privacy Commissioner has broad discretion as to how to deliver the statutory mandate established by the statute. PIPA also does not require the Commissioner to investigate any given intake submitted to the public authority by an individual. More generally, Section 39[5] of PIPA empowers the Commissioner to disregard an intake if they believe the request is without merit or where there is insufficient evidence to proceed. In such circumstances, the Privacy Commissioner may, in accordance with Section 38[3] of PIPA, direct an individual to first exhaust another grievance, complaint or review procedures which is available to them for the purposes of resolving matters before the Privacy Commissioner proceeds to hear or otherwise deal with their intake.

“The Privacy Commissioner will issue further press releases concerning their regulatory approach in due course. Once the first phase of the development of the new Supervision and Enforcement Unit has been completed, PrivCom’s organisational chart will be revised and included in the public authority’s PATI Information Statement for public transparency.

“To read the annual report tabled by Office of the Privacy Commissioner for Bermuda for the reporting period 1 April 2025 – 31 March 2026, click here.”

#PIPADraftModel

Category: All