Privacy Notice

The RA collects personal data that it needs to perform its statutory functions, operate as an organisation, and comply with its legal obligations.

The RA’s statutory functions include (but are not limited to) its duties and powers under the Regulatory Authority Act 2011, the Electronic Communications Act 2011, the Electricity Act 2016, and the Submarine Cables Act 2020.

As an organisation, the RA needs to employ staff and contract with third-party service providers. The RA’s legal obligations include its obligations under the Human Rights Act 1981, for example, and its duties as an employer under applicable employment and tax legislation.

Depending on the purpose and context, the personal datathe RA collects may include:

• Your name and job title.
• Your contact information (which may include your IP address).
• Your occupation and employer’s details.
• Your bank details and national insurance number.
• Other information relevant to:
• Improving the RA’s services (including, but not limited to, recording or monitoring communications between you and the RA for the purposes of quality control and staff training)
• Carrying out our statutory functions as a communications and electricity regulator (which include protecting and furthering the interests of consumers and promoting competition)
• Other information relevant to our duties as an employer.

In carrying out its functions, the RA may from time to time collect personal data which users of online media platforms (for example,Twitter, Facebook, Instagram, YouTube, news websites and other public blogs/forums) have chosen to make publicly available.

The RA may use your personal data for the purpose of carrying out its statutory functions, including its law enforcement functions, and complying with its legal obligations. The RA may also use your personal data where there are reasons of substantial public interest to do so, or where it has otherwise obtained your consent.

In particular, the RA may use your personal data for one or more of the following reasons:

• To carry out its statutory functions, for example:
• Granting licences and authorizations under our sectoral legislation.
• Logging and handling complaints, including consumer complaints and fairness and privacy complaints.
• Undertaking regulatory investigations or investigations under the Regulatory Authority Act 2011.
• Carrying out law enforcement activities, including investigating and prosecuting criminal offences.
• Gathering and publishing evidence and opinions, including through consultations and carrying out research.
• Ensuring transparency and accountability in how the RA carries out its regulatory activities.
• To improve its services;
• To send information to you which the RA thinks may be of interest to you;
• To undertake its duties as an employer;
• To pass your details to accountants, consultants and other professionals for the purpose of obtaining professional advice and complying with the RA's contractual obligations;
• To comply with its legal and regulatory obligations;
• To establish, exercise or defend legal claims;

The RA may also, from time to time, need to share your personal data with other third parties, including:

• Where appropriate, sectoral providers, for the purposes of resolving complaints;
• Organisations falling within the scope of the RA’s powers, third party complainants, and any representatives and expert witnesses engaged by those parties or the RA for the purposes of exercising its regulatory functions, including undertaking investigations and subsequent appeals. This includes, for example, allowing the subjects of an investigation (and where relevant, the complainant) access to the file, which allows those parties to understand the evidence that the RA is relying on in its provisional and final decisions;
• The police, or other law-enforcement bodies, for the purposes of undertaking investigations or where the RA is legally obliged to do so;
• Government departments and other regulatory bodies for the purposes of enabling the RA and them to carry out its respective legal and statutory functions;
• Third parties who the RA may employ to process personal data on our behalf (in compliance with the requirements of data protection legislation). Such third parties may include those providing e-discovery services.

The RA may use machine learning programmes to help analyse large datasets but will not use automated means to make decisions about individuals.

The RA will determine the period for which it needs to keep your personal data with regard to the reasons and purposes for which it was collected. To determine the period for retention of your personal data the RA will also have regard to:

• its statutory duties and other legal obligations; and
• the exercise and defence of any legal claims, including the period within which any current or potential future legal claims may be brought.

The RA has put in place appropriate technical and organisational measures to:

• protect your personal data; and
• prevent any unauthorised or unlawful processing and any accidental loss, destruction or damage to it.

From time to time, the RA may need to transfer personal data to other countries, for example, where it is stored securely in the cloud and the relevant servers are located overseas. In these circumstances, the RA will first ensure that the relevant country has the appropriate safeguards in place to protect your personal data.

As your employer or prospective employer, the RA is required to keep and process information about you for employment purposes. The RA keeps information about you even if you are:

• on secondment to the RA;
• working as a freelance contractor; or
• where you perform a role for the RA as a non-executive member of a Committee, Board or Panel (whether you are directly employed by the RA) or as a Presiding Officer).

The information the RA holds and processes will be used:

• only for its management and administrative use;
• to carry out its employment or related tasks; or
• to comply with its legal obligations.

The RA will hold and use information to enable it to run the business and manage its relationship with you effectively, lawfully and appropriately in connection with the recruitment process whilst you are an employee (or whilst you are appointed as a non-executive member of a Committee, Board or Panel, or as a Presiding Officer). Once your employment or appointment ends or you cease to be a non-executive member of a Committee, Board Panel, or Presiding Officer, the RA usually retains your information for a period of 6 years. This includes using information to enable the RA to:

• comply with the terms of the employment or service contract it has with you;
• perform its statutory functions;
• comply with its legal obligations (for example, with respect to tax legislation) and to protect its legal position in the event of legal proceedings;
• monitor and improve its performance as an employer (including with respect to diversity).

Much of the information the RA holds will have been provided by you. However, some information may come from other sources, such as your line manager, referees, or current employer, where this is not the RA.

The sort of information the RA may collect and hold includes:

• Your application form which includes your name, address, telephone number
• Your curriculum vitae with details of your work experience to date
• Your references
• Copies of your passport and qualification certificates
• Your contract of employment and any amendments to it
• Correspondence with, or about, you, for example letters to you about a pay rise
• Information needed for payroll, benefits and expenses purposes such as bank details
• Contact and emergency contact details (including next of kin)
• Records of holiday
• Details of your age and gender
• Records relating to your career history such as training records, appraisals and other performance measures
• Any disciplinary and grievance records

In some circumstances, the RA may also collect information that, under PIPA, is deemed sensitive personal data. This includes:

• Records and any details of sickness and information relating to your health, including Occupational Health reports, which could include reasons for absence and GP reports and notes. This information will be used to comply with health and safety occupational health obligations, including assessing how your health affects your ability to do your job and whether any adjustments to your job might be appropriate. The RA will also require this information to administer and manage sick pay.
• Nationality – this will be used to monitor equality and diversity within our organisation.
• Race/Ethnic origin – this will be used to monitor equality and diversity within our organisation.
• Religious belief – this will be used to monitor equality and diversity within our organisation.
• Sex/sexual orientation – this will be used to monitor equality and diversity within our organisation.
• Details of any criminal convictions – this will be used to monitor equality and diversity within our organisation.

The RA may also monitor computer use, as detailed in its Acceptable Use Policy. The RA may also maintain records of the hours that employees work through timesheets, which include sickness absence recording.

Where the RA have collected your personal data for its employment functions, the RA will retain it for a period of 6 years after you have left the RA. The RA will retain interview notes and/or any supporting recruitment information for all applicants for a period of 2 years.

If, in the future, the RA intends to process your personal data for a purpose other than that for which it was collected, the RA will provide you with information on that purpose and any other relevant information.

Under PIPA, you have several rights:

• to access yourpersonal information;
• to correct an error or omission in your personal information;
• to cease, or not to begin, using personal information for the purposes of advertising, marketing or public relations;
• to cease, or not to begin, using personal information where the use of that personal information is causing or is likely to cause substantial damage to you or to another individual; and
• to erase or destroy personal information about you where that information is no longer relevant for the purposes of its use.

Where the RA is relying on your consent to use your personal data you may withdraw that consent at any time (however this will not affect the lawfulness of the data processing before your consent was withdrawn).

Should you wish to confirm if the RA holds personal data about you, request copies of that data, or make any other request in relation to your personal data, you should send your request to the RA’s Information Requests team at: info@ra.bm.

If it would be helpful, you can use the form below to make your request:

Information Request Form (pdf)

Information Request Form (doc)

The RA’s handing of personal data is overseen by its Senior Legal Advisor, who is the RA’s Privacy Officer. Should you wish to query the way the RA is handling your personal data or submit a complaint about this, you should address this to our Privacy Officer at:

Senior Legal Advisor – Privacy Officer
Regulatory Authority
1st Floor Craig Appin House
8 Wesley Street
Hamilton HM11
Bermuda

Email: info@ra.bm
Phone: (441) 405-6000
Fax: (441) 474-6048

If you are unhappy with the way that the RA is dealing with your personal information and have already raised your complaint with the RA, you can make a complaint to the Privacy Commissioner’s Office at:

Privacy Commissioner's Office
Maxwell Roberts Building, 4th Floor
1 Church Street
Hamilton, HM11
Bermuda

Tel: 441-543-PRIV [7748]
Email: PrivCom@privacy.bm
Website: privacy.bm