Bermuda

Section 182F makes it an offence to knowingly make, print or publish child abusive material or child pornography, liable on conviction on indictment to ten years' imprisonment or on summary conviction to five years, and a separate offence to knowingly distribute, transmit, make available, sell, import or export such material, carrying the same penalties.

Child pornography is defined as a photograph, film, video or other visual representation, whether or not made by electronic or mechanical means, that shows a child who is, or is depicted as being, engaged in explicit sexual activity, or whose dominant characteristic is the depiction, for a sexual purpose, of a sexual organ or the anal region; the definition does not require the depicted child to be a real, identifiable individual, so a computer-generated or AI-synthesised depiction meeting it can fall within the ban. For sections 182C to 182H, "child" means a person under the age of sixteen.

Where a breach of security leads to the loss, unlawful destruction, or unauthorised disclosure of or access to personal information that is likely to adversely affect an individual, the responsible organisation must, without undue delay, notify the Privacy Commissioner of the breach and then notify any individual affected.

The notification to the Commissioner must describe the nature of the breach, its likely consequences for the individual, and the measures taken and to be taken to address it, so the Commissioner can decide whether to order further steps and can maintain a record of the breach.

The Act binds every organisation that uses personal information in Bermuda wholly or partly by automated means, excluding personal or domestic use, artistic, literary or journalistic use in the public interest, and business-contact information used to reach an individual in their capacity as an employee or official.

An organisation must adopt suitable measures and policies to give effect to its obligations, use personal information fairly and only for specified purposes, and provide privacy notices.

Where an information society service is targeted at children, or the organisation has actual knowledge it is using a child's personal information, the organisation must obtain verifiable consent from a parent or guardian before relying on consent as the basis for using it, and may not seek information about the child's parents or guardians beyond what is needed to obtain that consent.

The administrative provisions of the Act, including the Commissioner's office, came into operation on 2 December 2016; the remaining provisions commence on a day the Minister appoints by notice in the Gazette, which is not reproduced in the text read, and the Personal Information Protection Amendment Act 2023 brought amendments to most of the Act's substantive sections into effect on 1 January 2025.

An organisation that transfers personal information to an overseas third party, whether for use on the organisation's behalf or for the third party's own business purposes, remains responsible for that transfer's compliance with the Act. An organisation may avoid full accountability for the transfer where it reasonably assesses the circumstances and concludes the transfer is small-scale, occasional, and unlikely to prejudice the rights of an individual, among other exceptions.

The Privacy Commissioner may recommend that the Minister designate a jurisdiction as providing a comparable level of protection for section 15 purposes. The Commissioner may separately order, at the Commissioner's discretion, that an organisation be permitted to transfer personal information to an overseas third party where the organisation has reasonably demonstrated it cannot comply with the general accountability rule.

An individual may request access to personal information an organisation holds about them, subject to exemptions including for information that would prejudice medical treatment. An individual may request correction, blocking, erasure or destruction of personal information containing an error or omission.

An individual who suffers financial loss or emotional distress from an organisation's failure to comply with the Act is entitled to compensation, determined by the court, unless the organisation proves it took such care as was reasonably necessary to comply.

The Privacy Commissioner for Bermuda, a public office appointed by the Governor, investigates complaints, mediates disputes, and on completing an inquiry may make an order requiring an organisation to give access, rectify or destroy personal information, or take other steps to remedy a breach of the Act.

The Commissioner's office and general powers came into operation on 2 December 2016; the offences and penalties provisions are not among the sections the Act's endnote names as having commenced on that date, and their own commencement day is not reproduced in the text read.

A person who fails to comply with a Commissioner's order or notice, contravenes the sensitive-personal-information restriction, destroys evidence during an investigation, or fails to notify a breach of security, commits an offence liable on summary conviction, for an individual, to a fine not exceeding $25,000 or imprisonment not exceeding two years or both, and on conviction on indictment, for a person other than an individual, to a fine not exceeding $250,000.

Section 3 makes it an offence for a person, knowing the access is unauthorised, to cause a computer to perform any function with intent to secure access to a program or data held in any computer, whether or not the intent is directed at a particular program, data or computer. Access is unauthorised only if the person is not entitled to control access of that kind and lacks the consent of someone who is, so authorisation rather than a technical measure is what the Act tests.

Section 4 aggravates the offence where the unauthorised access is committed with intent to commit or facilitate a further indictable offence. Section 5 separately criminalises unauthorised modification of computer material, and section 6A unauthorised conduct causing a computer to cease to function permanently or temporarily. The Act's text does not carry a separate commencement clause beyond the date of assent.

A property right, database right, subsists in a database where there has been a substantial investment in obtaining, verifying or presenting its contents, regardless of whether the database or its contents is also a copyright work.

The right is infringed by extracting or re-utilising all or a substantial part of a database's contents without the owner's authority, subject to exceptions for parliamentary and judicial proceedings, material open to public inspection under a statutory requirement, and material communicated to the Crown in the course of public business. The Copyright Tribunal has jurisdiction over disputed licensing schemes and licences for database right, on the same terms as for copyright licensing.

Section 3(1)(d) makes it an offence to publish an obscene article to, or in the presence of, a person under the age of sixteen years. "Publishes" is defined to include distributing, circulating, selling, letting on hire, giving or lending a thing, or showing, playing or projecting a thing containing matter to be looked at or a record.

The same section separately bars importing an obscene article, publicly publishing one, or having one for publication for gain, and section 2(3) deems a thing obscene if it is child abusive material or child pornography within the meaning of Part X of the Criminal Code. A defendant is not convicted if they prove they had not examined the article and had no reasonable cause to suspect it was obscene.

Fair dealing with a work for the purpose of criticism or review, of that or another work or of a performance of a work, does not infringe copyright provided it is accompanied by sufficient acknowledgement.

Fair dealing with a work, other than a photograph, for the purpose of reporting current events likewise does not infringe copyright provided it is accompanied by sufficient acknowledgement, except that no acknowledgement is required when current events are reported by sound recording, film, broadcast or cable programme. The Act carries no broader exception permitting wholesale reproduction of a newspaper or periodical article on a current topic.