CHAMBERS Global Practice Guides BERMUDA FinTech...clude: financial institutions, global...

BERMUDA

LAW AND PRACTICE: p.3Contributed by Appleby

The ‘Law & Practice’ sections provide easily accessible information on navigating the legal system when conducting business in the jurisdic-tion. Leading lawyers explain local law and practice at key transactional stages and for crucial aspects of doing business.

CHAMBERSGlobal Practice Guides

FinTech

2018

Law & Practice – BermudaContributed by

Appleby

BERMUDA

LAW AND PRACTICE: p.3Contributed by Appleby

The ‘Law & Practice’ sections provide easily accessible information on navigating the legal system when conducting business in the jurisdic-tion. Leading lawyers explain local law and practice at key transactional stages and for crucial aspects of doing business.

Law and Practice BerMUdaContributed by Appleby Authors: Steven Rees Davies, Megan Denos

3

Law and PracticeContributed by Appleby

CONTENTS1. Fintech Market p.4

1.1 The Development of FinTech Products and Services p.41.2 The Market for FinTech Products and Services p.51.3 The Key Market Participants in the Specified

Activities p.51.4 FinTech Technologies/Companies p.61.5 Partnerships Between Traditional Insititutions and

FinTech Companies p.61.6 Approach to FinTech Innovation p.61.7 Laws or Policy to Encourage Innovation p.6

2. regulation p.62.1 Regulatory Regimes for Specified Activities or

FinTech Companies p.62.2 Regulatory or Governmental Agencies for

Specified Activities or FinTech Companies p.62.3 Capital and Liquidity Requirements p.72.4 “Sandbox” or Other Regulatory “Neutral Zones” p.72.5 Change of Control Approval Requirements p.72.6 Recent Developments or Notable Proposed/

Forthcoming Regulatory Changes p.72.7 Burden of Regulatory Framework and Protection

of Customers p.72.8 Regulatory Impediments to FinTech Innovation

at Traditional Financial Institutions p.72.9 Regulatory Regime’s Approach to Consumers

and Small Business Customers p.72.10 Outreach by Regulators or Government

Authorities to Engage with FinTech Innovators p.82.11 Unregulated Specified Activities p.82.12 Foreign FinTech Companies p.82.13 Regulatory Enforcement Actions Against

FinTech Companies p.82.14 “Shadow Banking” p.8

3. Form of Legal entity p.83.1 Potential Forms of Charter p.83.2 Key Differences in Form p.83.3 Recent Legal Changes p.9

4. Legal infrastructure (non-regulatory) p.94.1 Desirable Changes to Facilitate Specified Activities p.94.2 Access to Real Time Gross Settlement Systems p.94.3 Special Insolvency Regimes p.94.4 Electronic Signatures p.94.5 Standards for Proving Identity in Electronic

Transactions p.9

5. data Privacy and cybersecurity p.95.1 Data Privacy and Cybersecurity Regulatory Regimes p.95.2 Recent and Significant Data Privacy Breaches p.105.3 Companies Utilising Public Key Infrastructures or

Other Encryption Systems p.105.4 Biometric Data p.11

6. intellectual Property p.116.1 Intellectual Property Protection Regime p.116.2 Trade Secret Regime p.116.3 Copyrights, Patents, Trade Marks p.126.4 Protection of Intellectual Property or Trade Secrets p.126.5 Joint Development of Intellectual Property p.126.6 Intellectual Property Litigation p.126.7 Open Source Code p.12

7. tax Matters p.127.1 Special Tax Issues, Benefits or Detriments p.128.1 Additional Legal Issues p.13

BerMUda Law and PracticeContributed by Appleby Authors: Steven Rees Davies, Megan Denos

4

appleby is one of the world’s leading offshore law firms. The Group has offices in the key offshore jurisdictions of Bermuda, the British Virgin Islands, the Cayman Islands, Guernsey, Isle of Man, Jersey, Mauritius, and Seychelles, as well as a presence in the international financial centres of Hong Kong and Shanghai. Offering strength and depth across these jurisdictions, Appleby gives clients access to impartial offshore business knowledge and experience, as well as a talented pool of lawyers in each of its locations. This

ensures that the most appropriate jurisdiction and team are always available to meet a client’s requirements. Clients in-clude: financial institutions, global corporations, FTSE 100 and Fortune 500 companies and high net worth individuals. Appleby is a member of Terralex, an international associa-tion of law firms, as well as Lex Mundi, a leading network of independent law firms covering 100+ countries worldwide.

authorsSteven rees davies is a partner in the Bermuda corporate practice group. Steven practises in the areas of corporate finance, capital markets, regulation and intellectual property, and has represented clients in a wide variety of cross-jurisdictional

corporate transactions and restructurings as well as private and public offerings, placements and introductions to the Bermuda, London and New York stock exchanges. He is also frequently involved in multinational joint ventures and private equity projects. His Bermuda and international corporate and regulatory experience covers telecommuni-cations, technology, pharmaceutical, energy, inter-govern-mental and software industry sectors as well as corporate governance and constitutional advisory work. Steven is

particularly renowned for his technical expertise in the area of international regulation which extends to interna-tional treaties, tax information exchange agreements, FATCA and the Common Reporting Standard.

Megan denos is Senior Professional Support Lawyer, Knowledge Management Bermuda. legislative developments, providing legal research support for several Appleby offices, preparing legal guides and contributing to comparative

materials for all practice areas. She also works closely with PSLs in other Appleby offices, and the Director of Knowl-edge Management, on several joint projects and initiatives that develop Appleby’s knowledge management services.

1. Fintech Market

1.1 The development of Fintech Products and Services Bermuda is one of the world’s leading offshore financial cen-tres with a long history of providing pragmatic financial and professional services to international businesses.

The Island has particularly strong (re)insurance, investment fund and trusts sectors which are supported by a world-class advisory and financial services infrastructure, including a sophisticated legal system, a robust regulatory framework, speed-to-market capability, a business-friendly government, simple tax regime, close proximity to the US and a highly skilled work force.

There is a national push to establish Bermuda as a regional FinTech hub. The Bermuda Monetary Authority (BMA) and Bermuda Government are already in discussions with inter-est groups.

Quote from Grant Gibbons, Bermuda’s Economic Develop-ment Minister:

“From captives to sidecars, Bermuda has long been at the forefront of innovation. Now, it is well positioned again to lead from the front and become a global innovator in Fin-Tech and regtech …. The ingredients are all here in a tightly networked and easily navigable ecosystem: a highly devel-oped corporate infrastructure, an agile regulatory system, and a talent pool adept in advisory expertise — but also, and most promisingly, a significant user base of customers for FinTech innovators. Hundreds of actuaries, underwriters, claims analysts, IT and computer science specialists, bank-ers, auditors, lawyers, and regulators all collaborate within the square mile of the City of Hamilton.” Innovation and the FinTech frontier (Bermuda: Re + ILS 9Mar17)

Bermuda took part in the December 2016 Financial Stability Board Regional Consultative Group for the Americas which discussed the implications of FinTech. In its 2017 Business Plan, the BMA stated that it will work with FinTech experts from industry to explore the need for associated regulation


5

and the development of specific supervisory skills related to FinTech.

1.2 The Market for Fintech Products and Services FinTech is a largely undeveloped sector in Bermuda, but one that has received a lot of attention from the government and local financial and technology companies. The highly de-veloped insurance market in Bermuda is seen as a good fit for FinTech, providing plenty of opportunities for improv-ing efficiency and transparency across the insurance sector, largely focusing on how technology can disrupt the origina-tion, pricing and placement of risks.

Whilst there is an active local market in the FinTech sec-tor (see 1.3 The Key Market Participants in the Specified activities), the volume of FinTech activity cannot currently be measured; however, the latest government figures point to the importance of the finance sector to the economy, and the number of potentially interested parties.

In current market prices, international business contributed the greatest amount to the Bermuda economy in 2015 (latest figure available). This sector provided USD1.66 billion in total output or 28.0% of total GDP. The financial interme-diation sector was also a significant contributor, accounting for USD706.3 million in output, which represents 11.9% of total GDP.

1.3 The Key Market Participants in the Specified activitiesRecent activity includes:

•The Hub Culture innovation campus was held in Bermuda from June to August 2017. Experts in the fields of block-chain, artificial intelligence and virtual currencies attended including senior people involved in digital currency and digital banking from the Massachusetts Institute of Tech-nology. The campus was expected to attract innovators who control approximately USD5 billion of investable assets. The Hub Culture manages the Ven digital currency which is the only currency used for transactions at the campus. The decision to host this incubator for collaboration and co-working in Bermuda coincided with America’s Cup. Founder of Hub Culture, Mr Stalnaker stated: “Ven has the potential to catapult Bermuda forward. Bermuda is an ideal location to lead the global trillion-dollar market for digital currency. Bermuda has a chance to be 100 times bigger than it is, financially.”

•R3, a blockchain innovation company, leads a consortium of financial institutions in the research and development of blockchain database usage. It has recently demonstrated to the BMA and local reinsurance companies that distributed ledgers, based on blockchain technology, could fundamen-tally change and improve their business.

•The BMA recently met with New York-based Agentic Group LLC – a global consortium with members in the blockchain, FinTech and digital currency industries – and an agreement was reached for the two to work together on raising awareness about the benefits of blockchain technol-ogy and digital currencies in the region.

•Also hoping to encourage FinTech development is a recent-ly formed, cross-sector think-tank, called Bermuda 4.0, a group of like-minded industry professionals exploring the streamlining, cost-cutting possibilities of blockchain and other distributed ledger technologies and also acting as an actual incubator/accelerator for new business.

•The Bermuda Business Development Agency (BDA) has announced that one of its key strategic business develop-ment initiatives in 2017 is supporting risk solutions by in-troducing distributed ledger and blockchain technologies.

Local companies involved in the FinTech sector include:

•Blockchain Bermuda: a non-profit, cross-industry think-tank, offering thought leadership, education and advocacy to promote the adoption of distributed ledger technologies and FinTech in Bermuda.

•Fireminds: an international technology consulting firm serving clients in Bermuda, the Caribbean, LATAM and North America. It is organised into two divisions, software development and cloud solutions.

•First Atlantic Commerce: a provider of secure and robust internet payment solutions, offering a range of services that includes multi-currency, real-time credit card and debit card processing, as well as online consumer authentica-tion and other fraud management services.

•Hub Culture Ltd: provides global trade mark and intellec-tual property protection from Bermuda. It is the sole owner of all Hub Culture related trade marks, service marks, log-os, symbols and other intellectual property including the Hub Culture website, currency services and Ven, franchise and brand related components.

•Igility: a group of autonomous, technology-related busi-nesses that find synergies and cost savings working to-gether. Igility was formed as a holding company to provide the funding and direction for BCS Agencies Ltd., Systems Business Integration and Transact FKB.

•Nova: a Bermuda-based, Microsoft partner-certified, soft-ware engineering and consulting company located in cen-tral Hamilton. The company has built and been the archi-tect of several successful enterprise-level software systems and has also worked with start-ups and established Class-4 reinsurance companies in bringing ideas from concept to market-execution, as well as global Silicon-valley start-ups. Nova provides a well-balanced blend of technical skills, market knowledge, effective methodology and a passion for IT.


6

•Trunomi: uses consent-based, data-sharing across all data types and industries including the streamlining of custom-er-verification for companies.

1.4 Fintech technologies/companies New FinTech technology/companies have not yet displaced traditional financial service providers, but it is clear that the push to move forward with FinTech in Bermuda is currently being driven by technology-focused new entrants to finan-cial services, such as First Atlantic Commerce and Trunomi.

1.5 Partnerships Between traditional insititutions and Fintech companiesCo-development has not yet begun, but there is a cross-sector FinTech think tank initiated by the Bermuda Devel-opment Agency, called Bermuda 4.0 that brings together IT and communications specialists, legal and accounting minds, insurance industry technologists and members of the BMA. Bermuda 4.0 is building a platform for entrepre-neurs to create transformative technologies — connecting global innovators with Bermuda-based multinationals seek-ing technological evolution. It is likely to morph into a new business incubator and accelerator.

1.6 approach to Fintech innovationPlease see 1.1 The development of Fintech Products and Services.

1.7 Laws or Policy to encourage innovationThere are a variety of government initiatives in Bermuda which encourage the use of technology, including the Tech-nology Leadership Forum, a public/private partnership that aims to provide qualified Bermudian talent in the field of Information and Communication Technologies (ICT) to local employers, and the Inspire eBusiness initiative. The Department of ICT Policy and Innovation (ICT Depart-ment) supports the jurisdiction to leverage and advance the digital economy. The ICT Department develops a progres-sive regulatory framework and facilitates the advancement of technology skills and innovation.

2. regulation

2.1 regulatory regimes for Specified activities or Fintech companiesThe FinTech sector is still at an early stage in Bermuda but a number of legal and regulatory steps (described in 1.1 The development of Fintech Products and Services) have been taken in recent years to make the Island a jurisdiction that will allow FinTech innovation to thrive.

See also the discussion of the Personal Information Protec-tion Act 2016 in 5.1 data Privacy and cybersecurity regu-latory regimes and the discussion on consumer protection

in 2.9 regulatory regime’s approach to consumers and Small Business customers.

2.2 regulatory or Governmental agencies for Specified activities or Fintech companiesThe BMA, which has the responsibility for regulating Ber-muda’s financial services sector, will be the main regulator for the FinTech sector as it grows. The BMA develops risk-based financial regulations that it applies to the supervision of Bermuda’s banks, trust companies, investment businesses, investment funds, fund administrators, money service busi-nesses, corporate service providers and insurance compa-nies.

The Money Service Business Act 2016 (MSB Act) which be-came operative on 31 January 2017, provides a comprehen-sive regulatory framework necessary to protect the interests of clients, or potential clients, of persons carrying on money service business. Money service business includes:

•money transmission services; •cashing cheques which are made payable to customers, and

guaranteeing cheques; •issuing, selling or redeeming drafts, money orders or trav-

eller’s cheques for cash; •payment service business; or •operating a bureau de change whereby cash in one cur-

rency is exchanged for cash in another currency.

Because there is growth potential in this sector, the MSB Act includes the power to amend the list of activities that money service businesses (MSBs) are allowed to engage in by adding any other service that the Minister of Finance may deem appropriate as and when the need arises. The MSB Act helps create an environment that fosters innovation in the Bermuda market. Previously MSBs were regulated under the Bermuda Monetary Authority Act 1969, and the Money Service Business Regulations 2007.

As a leading risk-based regulator, the BMA supervises enti-ties licensed under the Banks and Deposit Companies Act 1999 in accordance with the standards established by the Basel Committee on Banking Supervision, and in particular with the revised Concordat and with the precepts for the su-pervision of cross-border banking. The BMA liaises closely with other regulators, both domestically and internationally, in order to ensure effective consolidated supervision, both in relation to entities for which the BMA acts as a consolidated group-wide supervisor and where licensed institutions may form part of international banking groups.

The BMA is a member of the following international stand-ard setting bodies: the International Association of Insur-ance Supervisors (IAIS), the International Organisation of Securities Commissions (IOSCO), the Group of Internation-


7

al Insurance Centre Supervisors (GIICS) and the Group of International Financial Centre Supervisors (GIFCS).

2.3 capital and Liquidity requirementsFinTech companies at present are not subject to any spe-cific regulatory requirements, nor any capital, liquidity or transaction limitations, other than those required for spe-cific entities registered in Bermuda, such as companies or partnerships or as specified under current banking and in-surance legislation.

Bermuda has adopted Basel III banking capital/liquidity/credit risk standards for the banking sector. The BMA chose the Common Equity Tier 1 Capital (CET1) as the primary form of regulatory capital. Full compliance is expected by 2019. In the publication, Basel III for Bermuda Banks – Fi-nal Rule, the BMA states that the “final rule appropriately balances prudent risk taken by banks while simultaneously preserving prudent capital buffers and liquidity resilience to protect depositors and preserve the stability of the banking sector within Bermuda.”

2.4 “Sandbox” or Other regulatory “neutral Zones”No such zones or initiatives have been established in Ber-muda at the time of writing.

2.5 change of control approval requirements Change of control provisions are set out in Sections 25, 26, 27, 28 and 29 of the Banks and Deposit Companies Act 1999. Section 25 requires that any person who proposes to become a shareholder controller of a bank or deposit company to obtain the approval of the BMA first. A person who intends to become a controller must serve notice on the BMA, and only becomes a controller if the BMA either does not object or does not respond within three months.

Under Section 26, the BMA can object to new or increased control of various thresholds starting at 10% if it is not satis-fied with a number of matters, including whether the person concerned is a fit and proper person to become a controller of the bank or deposit company.

Section 27 provides for the BMA to object to an existing shareholder controller who it considers is no longer a fit and proper person.

A bank or deposit company that fails to comply with Section 25 is guilty of an offence under Section 28. The BMA may also place restrictions on the sale of shares under Section 29, if a person has contravened Section 25 by becoming a shareholder controller of any description, or continues to be a shareholder controller of any description after being served under Section 27.

Under Section 30J of the Insurance Act 1978 (Insurance Act), insurers must provide written notice to the BMA of the fact that a person has become, or ceased to be, a con-troller of that insurer. Under Section 30H of the Insurance Act and the minimum criteria for registration contained in the Schedule to the Insurance Act, every person who is, or is to be, a controller should be a fit and proper person to perform functions in relation to any activity carried out by the insurer. Where it appears to the BMA that a person who is a controller is not, or is no longer, a fit and proper person to be such a controller, the BMA may serve him or her with a written notice of objection to them continuing as a controller of the insurer.

2.6 recent developments or notable Proposed/Forthcoming regulatory changesSee 1.1 The development of Fintech Products and Ser-vices.

2.7 Burden of regulatory Framework and Protection of customersThe FinTech sector is still in its early stages in Bermuda but a number of legal and regulatory steps (described 1.1 The development of Fintech Products and Services) have been made in recent years to make the Island a jurisdiction that will allow FinTech innovation to thrive.

2.8 regulatory impediments to Fintech innovation at traditional Financial institutionsAt present, there are no additional specific FinTech require-ments.

2.9 regulatory regime’s approach to consumers and Small Business customersThe Consumer Protection Act 1999 established the Consum-er Affair Board, which ensures that the rights of consumers are preserved and protected in respect of unfair business practices and the safety of consumer goods. A person can file a complaint, which is reviewed by an Enforcement Officer at Consumer Affairs who will give the consumer non-legal advice and mediate between the parties, if necessary, in order to have the matter resolved. Enforcement Officers have the power to enter premises, seize products and documents, and make test purchases of the goods.

The Supply of Services (Implied Terms) Act 2003 (Supply of Services Act) codifies the principles developed at common law to form basic obligations owed by those who provide services. The Supply of Services Act requires that:

•work must be done with reasonable care and skill; •work must be carried out within a reasonable time; and•the party contracting the supplier will pay a reasonable

charge.


8

The Sale of Goods Act 1978 requires that goods purchased should be:

•of a satisfactory quality; •fit for the purpose for which they are generally sold; and•as described (either verbally, in words or pictures on a sign,

packaging or an advert).

2.10 Outreach by regulators or Government authorities to engage with Fintech innovators In addition to the information provided in 1.1 The develop-ment of Fintech Products and Services, Agentic Group, a New York-based global blockchain consortium held meet-ings with the BMA to educate it on the global development of the FinTech industry, specifically digital currencies and blockchain technology. The consortium plans to work with the Bermuda government to establish both a digital currency incubator and a blockchain start-up facility. The consortium suggested ways that Bermuda could use its reputation, as a highly successful and respected financial centre, to become a FinTech leader.

2.11 Unregulated Specified activities Please see 1.1 The development of Fintech Products and Services.

2.12 Foreign Fintech companiesCompanies incorporated in Bermuda fall into two prin-cipal categories: companies formed to trade primarily in Bermuda, and companies incorporated for the purpose of conducting business outside Bermuda. FinTech companies seeking to carry on business within the local Bermuda mar-ket, whether Bermudian or foreign, will be required to have certain levels of local ownership and participation, or an exemption from such requirements.

2.13 regulatory enforcement actions against Fintech companies There have been no regulatory enforcement actions to date in relation to FinTech laws and regulation.

2.14 “Shadow Banking” The BMA is participating in the Financial Stability Board Shadow Banking monitoring exercise.

There is a general prohibition against undertaking deposit-taking business without a licence, and penalties for a breach are serious. Under the Banks and Deposit Companies Act 1999, a person carries on deposit-taking business if, in the course of business, he or she lends money received by way of deposit to others; or finances any other activity of the busi-ness wholly or to any material extent, out of the capital of or the interest on money received by way of deposit.

Bermuda also has robust money transfer business regula-tions.

3. Form of Legal entity

3.1 Potential Forms of charterThe main types of entities in Bermuda are companies, part-nerships, limited liability companies and segregated ac-counts companies.

Companies incorporated in Bermuda fall into two princi-pal categories: local companies formed to trade primarily in Bermuda, and exempt companies incorporated for the purpose of conducting business outside Bermuda. FinTech companies seeking to carry on business within the local Ber-muda market will be required to have certain levels of local ownership and participation, or an exemption from such requirements.

Exempt partnerships are registered to carry on business out-side Bermuda, from a place of business within Bermuda and must have at least one non-Bermudian partner and may be general or limited.

A limited liability company (LLC) is a corporate structure whereby members of the company cannot be held personally liable for the company’s debts or liabilities.

The Segregated Accounts Companies Act 2000 establishes a registration regime whereby a Bermudian company may register as a segregated accounts company, thereby establish-ing, operating and maintaining a company with segregated accounts. The segregated account is an account containing assets and liabilities that are legally separated from the assets and liabilities of the company’s ordinary account.

All the above entities can be used for FinTech Specified Ac-tivities and the regulations mentioned in section 2 regula-tion, may be applicable.

3.2 Key differences in FormRefer to 3.1 Potential Forms of charter.

All of the entities described above can be used for the Spec-ified Activities. The best choice, however, will depend on whether the business is incorporated or registered in (but carrying on business outside of Bermuda) or if the intention is to carry on local trade.

Bermuda predominantly sees companies or partnerships being utilised, however segregated accounts companies are becoming popular in IP heavy industries for the purposes of separating and protecting assets.


9

3.3 recent Legal changes Please refer to 3.1 Potential Forms of charter and 3.2 Key differences in Form.

LLCs are new and increasingly popular for their commercial flexibility. The legislation provides only the basic require-ments for such entities, and the parties are largely free to operate their business in accordance with a contract agreed between them.

4. Legal infrastructure (non-regulatory)

4.1 desirable changes to Facilitate Specified activitiesThere have been no changes to relevant FinTech laws at this stage.

4.2 access to real time Gross Settlement Systems In Bermuda, FinTech companies must access real-time gross settlement systems through regulated financial institutions.

4.3 Special insolvency regimesBermuda is in the process of implementing a special in-solvency regime for regulated financial institutions in the country. The Banking (Special Resolution Regime) Act 2016, when fully operative, will establish a special resolution re-gime for banks and provide the Minister of Finance and the BMA with tools to deal with banks that get into financial difficulty.

4.4 electronic Signatures The Electronic Transactions Act 1999 (ETA) was established to promote public confidence in the validity, integrity and reliability of conducting transactions electronically, and rec-ognises electronic records as records created, stored, gener-ated, received or communicated by electronic means. It also specifies information to include data, text, images, sounds, codes, computer programs, software and databases. The ETA generally puts electronic signatures on an equal footing with “wet ink” signatures in Bermuda. Electronic signatures must meet the following criteria:

•it is uniquely linked to the signatory;•it is capable of identifying the signatory;•it is created using means that the signatory can maintain

under their sole control; and•it is linked to the information to which it relates in such a

manner that any subsequent alteration of the information is revealed.

Technology neutral, the ETA lays a foundation for the con-duct of electronic transactions that is sufficiently flexible to embrace new technological developments and that contem-plates a high degree of self-regulation.

Signatures that are not electronic signatures must also satisfy a legal requirement for a signature under Section 11(1) of the ETA. The requirement is met by an electronic record if a method was used to identify that person, and to indicate that that person intended to sign, or otherwise adopt the information in the electronic record. The method must be reliable, as appropriate, for the purpose for which the elec-tronic record was generated or communicated.

4.5 Standards for Proving identity in electronic transactionsThe Certification Service Providers (Relevant Criteria and Security Guidelines) Regulations 2002 (Regulations) pro-vide for an authorisation scheme for Certification Service Providers (CSP). A CSP issues identity certificates for the purposes of electronic signatures or provides other services to the public related to electronic signatures. The Regulations include a Code of Practice for authorised CSPs.

5. data Privacy and cybersecurity

5.1 data Privacy and cybersecurity regulatory regimes The Bermuda Constitution Order 1968 states that individu-als have the fundamental right to protection for the privacy of their home and other property and from deprivation of property without compensation.

The Personal Information Protection Act 2016 (PIPA) re-ceived Royal Assent in July 2016 and applies to all organisa-tions that use personal information in Bermuda. The PIPA was drafted as a bespoke privacy framework designed to meet Bermuda’s unique requirements. PIPA’s provisions are drawn from privacy legislation in a number of jurisdictions but are drafted around a set of EU-style privacy principles.

The initial operative provisions of the PIPA came into force in December 2016 to enable the appointment of a Privacy Commissioner. The law is expected to become fully effec-tive by December 2018 to allow organisations in Bermuda to achieve compliance. This transition period will also be used to prepare necessary secondary legislation, and for the Privacy Commissioner to draft guidance to help local busi-nesses achieve compliance.

The intention was that the new law would allow Bermuda to be recognised by the EU Commission as providing ad-equate data protection for the free flow of EU national data between Bermuda and the EU. Now with the introduction of the General Data Protection Regulation on 25 May 2018, Bermuda may need to revisit the current legislation in light of changes to the European approach.


10

The PIPA grants individuals specific rights in relation to their personal data, including, subject to specified excep-tions:

•the right to be informed by the entity controlling their data of whether their personal data is being processed;

•the right to access their personal data;•the right to require that the processing of their personal

data cease;•the right to require that the processing of their personal

data for the purpose of direct marketing cease; and•the right to correct inaccurate data, block data from further

use, or delete data.

Transferring personal data outside Bermuda is restricted un-less the jurisdiction to which the data is being transferred of-fers an adequate level of protection. The organisation trans-ferring the data is responsible for assessing the adequacy of the transferee jurisdiction. Adequacy can also be formally determined by the Privacy Commissioner. If the jurisdiction does not offer an adequate level of protection contractual safeguards need to be put in place between the transferor and transferee to ensure the level of protection meets the standards set out in the PIPA.

In order to ensure that personal data can be used in ap-propriate circumstances, the PIPA recognises a number of exemptions including national security, the prevention and detection of crime, compliance with international obliga-tions, the assessment or collection of any tax or duty, and legal professional privilege. Internet service providers act-ing as a conduit for personal information transmitted by a third party are not liable under the PIPA for any breach committed while acting as a pure communication provider. Personal information can also be disclosed as part of a busi-ness transaction such as a purchase, sale, lease, merger or amalgamation, or any other type of acquisition or disposal.

The Privacy Commissioner will be responsible for enforcing the legislation. The new law establishes a number of offences and penalties for failure to comply with its requirements. Penalties include fines of up to BMD250,000, and prison sentences of up to two years. The Privacy Commissioner also has the power to ‘name and shame’ organisations found to be in breach of the PIPA.

5.2 recent and Significant data Privacy Breaches Whilst not yet legally effective, the PIPA requires that “ap-propriate” safeguards be put in place to protect personal information against unauthorised access, destruction, use, modification or disclosure.

Also under the PIPA, breaches of security leading to the loss, unlawful destruction, unauthorised disclosure of, or access to personal information which is likely to adversely affect an

individual must be reported to the Privacy Commissioner and the affected individual without undue delay.

The notification to the Privacy Commissioner must describe:

•the nature of the breach;•the likely consequences of the breach for that individual;

and•the measures taken or to be taken by the organisation to

address the breach by the data controller.

An organisation which fails to notify the Privacy Commis-sioner of a breach commits an offence and is liable on con-viction to a fine of BMD250,000.

5.3 companies Utilising Public Key infrastructures or Other encryption SystemsCompanies utilising public infrastructure or other encryp-tion services are bound by the Certification Service Provid-ers (Relevant Criteria and Security Guidelines) Regulations 2002 (Regulations). The Code of Practice (Code), found in Schedule 1 of the Regulations, is divided into nine parts. Part II covers the authorisation process; Parts III and IV out-line the requirements to be met by those CSPs wishing to be authorised to issue accredited certificates. Part V outlines requirements that a subscriber of a CSP may have to adopt if they want their electronic signature to be recognised as directly equivalent to a written one in certain jurisdictions. Part VI outlines the audit and compliance requirements for authorised CSPs. Part VII deals with the revocation and suspension of authorisation; Part VIII the conduct of busi-ness by authorised CSPs and Part IX the requirements for administration.

The minister shall take into account this Code when deter-mining whether to grant authorisations to CSPs under Sec-tion 20 of the Electronic Transactions Act 1999 and recogni-tion, in the case of external service providers, under Section 21 of the Act.

Schedule 2 of the Regulations set out security guidelines (Guidelines) for authorised CSPs, including the general provisions, standards and procedures to be read and used in conjunction with the specific requirements and condi-tions set out in Section 20 of the ETA and the Code. The Guidelines set out the minimum standards that authorised CSPs need to comply with in order to meet the requirements and the criteria defined in the Code.

The general provisions and procedures outlined in the Guidelines are based on a number of internationally recog-nised technical specifications relating to certification prac-tice statements, such as those of the Internet Engineering Task Force and European ETSI/CEN standards, in addition to various ISO/IEC standards including the best practice


11

management system standards such as ISO/IEC 17799 and BS 7799 Part 2. They are also formulated to be consistent with the AICPA/CICA Web Trust Program for Certification Authorities.

5.4 Biometric dataBiometric information, defined as: “Any information relating to the physical, physiological or behavioural characteristics of an individual which allows his unique identification, such as facial images or fingerprint information” benefits from enhanced protection as “sensitive personal information” under the PIPA.

6. intellectual Property

6.1 intellectual Property Protection regime Bermuda is a common law jurisdiction with a robust intel-lectual property protection regime. Bermuda laws in this area are mostly based on the UK equivalents. The regime continues to develop to meet industry needs.

For FinTech providers, the principal intellectual property right that protects software is copyright - the right to pre-vent others from, among other things, copying the software. Intellectual property protection is automatic for copyright in Bermuda. The Copyright and Designs Act 2004 expressly includes a computer program, preparatory design material for a computer program, and a database within the defini-tion of “literary work.” For computer-generated work, the copyright expires at the end of the period of 50 years from the end of the calendar year in which the work was made.

The main intellectual property rights available to protect branding are trade and service marks, designs, patents and domain names. Trade and service marks can be registered or unregistered. Unregistered trade mark rights are enforced through the law of passing off.

The registration of trade marks in Bermuda is governed by the Trade Marks Act 1974 (Act), and associated Regulations. The Act is closely based on the United Kingdom Trade Marks Act of 1938 and offers similar protections.

A significant provision offers registration in Bermuda on the basis of a previous registration in the United Kingdom. This is an important provision and is used extensively to se-cure registration for marks that would otherwise meet with problems under the Bermuda Trade Marks Act. There are no other similar arrangements with other jurisdictions.

Any person claiming to be the proprietor of a trade mark may apply to register the mark with the Registrar General. Registration of a trade mark is initially valid for a seven-year period. Marks may be renewed, upon payment of a fee, for

successive periods of 14 years. The application process, from initial application to receipt of a certificate of registration, normally takes between six and 12 months.

After successful registration, the proprietor can sell, market, license and mortgage the trade mark. Trade mark rights give registered owners the right to prevent others using identical or confusingly similar marks to their registered mark.

Currently, patent protection in Bermuda is provided by the Patents and Designs Act 1930 (1930 Act). The 1930 Act is largely based on the United Kingdom Patents and Designs Act 1919. The Registry General offers three types of patent registration: a full patent, a provisional patent, and United Kingdom and European Patent registrations. A patent reg-istered in the UK or a European Patent that designates the UK can be reregistered in Bermuda within three years of its first registration.

The initial grant of the exclusive patent right is for a 16-year term. The application process, from initial application to reg-istration of the patent, takes approximately three months. After the initial 16-year term, patents may be protected for successive periods of seven years.

The Bermuda Patents Act 2015 (2015 Act) has been circu-lated to the industry for consultation. If enacted the 2015 Act will repeal Part II of the 1930 Act. The number of countries included as designated countries, and therefore eligible for reregistration in Bermuda, would be significantly broader. Schedule 2 of the 2015 Act includes the following countries as designated countries: Australia, Austria, Canada, China, France, Germany, Hong Kong, India, Ireland, Israel, Japan, New Zealand, Norway, the Russian Federation, Singapore, Sweden, United Kingdom, United States of America and the European Patents Office.

6.2 trade Secret regime Trade secrets are protected in Bermuda through a combina-tion of common law and rules of equity. A range of remedies is available where trade secrets have been improperly ac-quired, disclosed or used.

Confidential information is protected either through a con-tractual agreement to keep certain information confidential, or through the common law obligation to keep information confidential, because of the nature of the relationship be-tween the discloser and disclosee, the nature of the com-munication or the nature of the information itself.

While most kinds of information is capable of being protect-ed, establishing that there has been a breach of confidence requires something extra: a situation or relationship which imposes on the recipient an obligation to keep the informa-tion confidential. Even where there is no such relationship, a


12

non-disclosure agreement or confidentiality clause in a com-mercial contract can impose such an obligation. There is no restriction as to the type of information that can constitute a trade secret. Anything beyond mere trivia can be protected.

Equitable remedies for infringement include injunctions, Anton Piller orders and damages.

6.3 copyrights, Patents, trade MarksPlease see our response to 6.1 intellectual Property Protec-tion regime.

6.4 Protection of intellectual Property or trade SecretsAccording to the Bermuda government website, some com-puter programs cannot be patented.

For more, see www.gov.bm/online-services/register-patent.

6.5 Joint development of intellectual Property Intellectual property in Bermuda can have more than one owner. It can belong to people or a business, and can be sold or transferred.

Although the FinTech sector is at the early stages in Bermu-da, there are no restrictions under Bermuda law to prevent collaborations between technology developers and service providers. These collaborations can happen in a variety of ways, for example through funding FinTech start-ups, but the IP rights issues will be broadly similar, irrespective of the model used.

Where FinTech is developed by employees within an organi-sation, for the IP rights to vest with the employer, the devel-opment work must be done in the course of employment. If an employee is not employed to develop new technology the employer may not have any rights to claim ownership of work created outside the employee’s normal role.

FinTech, developed by team members engaged as consult-ants, will generally be owned by the individual consultant, unless there is an agreement providing otherwise. Pre-ex-isting IP rights (background IP) should be addressed in an agreement to make it clear who will own the IP going for-ward and what happens if the IP becomes incorporated in new FinTech that is developed.

As FinTech solutions are often required to interact with other third-party solutions, arrangements permitting interoper-ability may also be required. At its simplest, collaboration can occur through a process of cross-licensing.

Where all of the FinTech development is being done by a third party and the solution is being offered to, or imple-mented for, an organisation by an external vendor, unless expressly otherwise agreed, the organisation may not acquire any IP rights and may, as a customer, only obtain a licence to the solution.

6.6 intellectual Property LitigationIP for FinTech companies is not a source of litigation at this stage, but it potentially could be as the sector grows.

6.7 Open Source code Open source code is not separately regulated or protected in Bermuda.

7. tax Matters

7.1 Special tax issues, Benefits or detriments Exempted undertakings (companies, partnerships, unit trust schemes or LLCs) can apply to the Minister of Finance under the Exempted Undertakings Tax Protection Act 1966 (Tax Protection Act) for assurance that, in the event of there being enacted in Bermuda any legislation imposing tax computed on profits or income, or computed on any capital asset, gain or appreciation, then the imposition of any such tax shall not be applicable to such undertakings or to any of its opera-tions. The tax assurance exemption is granted until 31 March 2035 under the Tax Protection Act.

There may be tax implications for beneficial owners in their own jurisdiction however.

applebyCanon’s Court22 Victoria StreetPO Box HM 1179HamiltonBermudaHM EX

Tel: +1 441 295 2244Fax: +1 441 292 8666Email: [email protected]: http://www.applebyglobal.com/


13

8. issues Specific to the Specified activities

8.1 additional Legal issues There is no usury or interest limitation legislation in Ber-muda. However, interest levels that are so high as to be con-sidered penal in nature might not be upheld by the courts.

Section 3 of the Interest and Credit Charges (Regulation) Act 1975 states that if an interest rate is not provided by agreement of the parties, the rate of interest is 2% per an-num below the statutory interest rate. The current statutory interest rate in Bermuda is 3.5%. All sums of money due or payable under, or by virtue of, any judgment, order or decree from any court can carry interest at the statutory rate unless the court orders otherwise.

CHAMBERS Global Practice Guides BERMUDA FinTech...clude: financial institutions, global...

Documents

Transcript of CHAMBERS Global Practice Guides BERMUDA FinTech...clude: financial institutions, global...