June

Bermuda's Personal Information Protection Act (PIPA), passed July 27, 2016, shares many of the more stringent requirements and protections with Europe 's impending General Data Protection Regulation (GDPR).
 
There are, however, important differences between the two. Personal Information (PI) is defined as "any information about an identified or identifiable individual." For the GDPR, personal data is "any information relating to an identified or identifiable natural person" and the definition of personal information varies by jurisdiction in the United States.
 
PIPA applies certain key restrictions on the "use" of this broadly defined personal information, from the permitted use of personal information and the transfer of personal information outside of Bermuda. It also requires that organizations implement adequate safeguards to prevent data loss and unauthorized access. Those who do not comply could face fines not exceeding $250,000.

The Cayman Islands and Bermuda have recently passed comprehensive data protection laws.  Cayman's Data Protection Law was passed in March 2017 and will be enforced beginning in January 2019, while Bermuda 's Personal Information Protection Act will be enforced beginning in December 2018. Both laws support a growing expectation from international businesses and their clients that organizations operating in offshore centers have in place extensive data protection compliance policies backed up by robust data privacy legislation.

Drafted around a set of internationally recognized privacy principles, the new laws will provide a framework of rights and duties designed to give individual data subjects greater control over their personal data and, once in full force, will stand as the most comprehensive data protection laws in the region.

Recent cases involving the Fair Credit Reporting Act (FCRA) emphasize the importance of employers allowing disclosures to obtain background checks from consumer reporting agencies to "stand alone" from every other document.

While the FCRA allows the disclosure form to also include an authorization, courts have recently cracked down on employers who include anything extraneous. In Syed v. M-I, Ltd. Liab. Co., 853 F .3d 492 (9th Cir. 2017), the Ninth Circuit of Appeal held that the inclusion of a liability waiver in the same document at the FCRA disclosure violated the "stand-alone" requirement.
 
In another case, Petco Animal Supplies, Inc., asked a Federal Court in the Southern District of California to approve a class-wide settle of a 2016 lawsuit based on allegations that its web-based application contained an FCRA disclosure containing a broad authorization of "any person" to provide "any and all information" to the consumer reporting agency, in addition to information relating to the laws of seven different states.

And on April 12, 2018, Frito-Lay, Inc., asked a Federal Court in the Northern District of California to approve a class-wide settlement of a 2017 lawsuit based on allegations that Frito-Lay violated the FCRA’s “stand alone” requirement by including additional language in its FCRA disclosure form including, among other things, a statement that “I have been given a standalone consumer notification that a report will be requested and used [.]” Frito-Lay agreed to a settlement of about $2.4 million to resolve the claims of roughly 38,000 class members.

2018 marks a new opportunity for employers to review and update their hiring forms to ward off FCRA lawsuits.