The Data Protection Act, 2012 (Act 843) is legislation enacted by the Parliament of the Republic of Ghana to protect the privacy and personal data of individuals. It regulates the process personal information is acquired, kept, used or disclosed by data controllers and data processors by requiring compliance with certain data protection principles. Non compliance with provisions of the Act may attract either civil liability, or criminal sanctions, or both, depending on the nature of the infraction. The Act also establishes a Data Protection Commission, which is mandated to ensure compliance with its provisions, as well as maintain the Data Protection Register.
History The Act was first introduced in the Ghana Parliament in 2010, but was subsequently withdrawn by the then Minister of Communications, Haruna Iddrisu, to be revised. Parliament passed the bill in 2012, which then received Presidential assent on May 10, 2012.Data Protection Act, 2012 The notice of the Act was gazetted on 18 May 2012, and in accordance with Section 99, the Act came into effect on 16 October 2012.
Structure The Act is made up of 99 sections that are arranged under various headings, as follows: Heading Sections Data Protection Commission 1-10 Administration 11-13 Finances of the Commission 14-16 Application of principles of data protection 17-34 Rights of data subjects and others 35-36 Processing of special personal data 37-45 Data protection register 46-59 Exemptions 60-74 Enforcement 75-81 Records obtained under data subject's right of access 82-83 Information provided to Commission 84-85 Miscellaneous and general provisions 86-99
Key terms Key terms in the Act are defined in the interpretation section, section 96. Unless the context otherwise requires, section 96 provides the following definitions to the notable terms:
“data controller” means a person who either alone, jointly with other persons or in common with other persons or as a statutory duty determines the purposes for and the manner in which personal data is processed or is to be processed
“data processor” in relation to personal data means any person other than an employee of the data controller who processes the data on behalf of the data controller
“data subject” means an individual who is the subject of personal data
“foreign data subject” means data subject information regulated by laws of a foreign jurisdiction sent into Ghana from a foreign jurisdiction wholly for processing
“personal data” means data about an individual who can be identified,(a) from the data, or (b) from the data or other information in the possession of, or likely to come into the possession of the data controller
“processing” means an operation or activity or set of operations by automatic or other means that concerns data or personal data and the (a) collection, organisation, adaptation or alteration of the information or data, (b) retrieval, consultation or use of the information or data, (c) disclosure of the information or data by transmission, dissemination or other means available, or (d) alignment, combination, blocking, erasure or destruction of the information or data
“recipient” means a person to whom data is disclosed, including an employee or agent of the data controller or the data processor to whom data is disclosed in the course of processing the data for the data controller, but does not include a person to whom disclosure is made with respect to a particular inquiry pursuant to an enactment
“special purposes” means any one or more of the following: (a) the purpose of journalism, (b) where the purpose is in the public interest, (c) artistic purposes, and (d) literary purposes
Application of the Act The Act is applicable, where the data controller is established in Ghana and the data is processed in Ghana, the data processor is not established in Ghana, but uses equipment, or uses the services of a data processor carrying on business in Ghana, to process data, or the information being processed originates either partly or wholly from Ghana. (Section 45(1))
Data which originates externally and merely transits through Ghana is however, not protected by the Act (Section 45(4)). The Act applies to the Ghanaian Government, and for that purpose, each government department is treated as a data controller. (Section 91)
Data protection principles The Act provides for 8 principles that data processors have to take into account in processing data, in order to protect the privacy of individuals. These principles are similar to the OECD Guidelines and the Data Protection Directive of the European Union.
The data protection principles are enumerated at Section 17 as follows: accountability lawfulness of processing specification of purpose compatibility of further processing with purpose of collection quality of information openness data security safeguards, and data subject participation.
Accountability The accountability principle of data protection is seen generally as a fundamental principle of compliance.Alhadeff, Joseph, Brendan Van Alsenoy and Jos Dumortier. The Accountability Principle in Data Protection Regulation: Origin, Development and Future Direction]." Guagnin, Daniel, et al. Managing Privacy Through Accountability. Palgrave Macmillan, 2012. 50-82 It requires that a data controller should be accountable for compliance with measures which give effect to data protection principles.
The Act requires a person who processes personal data to ensure that the data is processed without infringing the rights of the data subject, and should be processed in a lawful and reasonable manner (Section 18(1)). Where the data to be processed involves a foreign data subject, the data controller or processor must ensure that the personal data is processed according to the data protection laws of the originating jurisdiction (Section 18 (2)).
Lawfulness of processing Data processing is lawful where the conditions that justify the processing are present.
The Act has a minimality provision, which requires that personal data can only be processed if the purpose for which it is to be processed is necessary, relevant, and not excessive. (Section 19)
The prior consent of a data subject is also required before personal data is processed. (Section 20) This requirement is, however, subject to exceptions. For instance, where the purpose for which the personal data is processed is necessary for the purpose of a contract to which the data subject is a party; authorised or required by law, to protect a legitimate interest of the data subject; necessary for the proper performance of a statutory duty or necessary to pursue the legitimate interest of the data controller or a third party to whom the data is supplied (section 20(1)). Consent is also required for the processing of special personal data (Section 37(2) (b)). A data subject also object to the processing of personal data (section 20(2)), and the data processor is required to stop processing the data upon such objection (section 20(3)).
In terms of retention of records, the Act prohibits the retention of personal data for a period longer than is necessary to achieve the purpose of the collection, unless, the retention is required by law, is reasonably necessary for a lawful purpose related to a function or activity, is required for contractual purposes, or the data subject has consented to the retention. (Section 24(1)). The retention requirement is, however, not applicable to personal data that is kept for historical, statistical, or research purposes, (section 24(2)), except that such records must be adequately protected against access or used for unauthorized purposes (Section 24(3)). Where a person uses a record of personal data to make a decision about the data subject, the data must only be retained for a period required by law or a code of conduct, and where no such law or code of conduct exists, for a period which will afford the data subject an opportunity to request access to the record. Upon the expiration of the retention period, the personal data must, however, be deleted or destroyed, in a manner that prevents its reconstruction in an intelligible form, or the record of the personal data must be de-identified. (Sections 24(4), (5), (6)).
A data subject may also request that a record of personal data about that data subject held by a data controller be destroyed or deleted where the data controller no longer has the authorisation to retain that data. (Section 33(1) (b))
Specification of purpose The Act requires that a data controller who collects personal data do so for a specific purpose that is explicitly defined and lawful, and is related to the functions or activity of the person. (Section 22) The data controller who collects data is also required to take necessary steps to ensure that the data subject is aware of the purpose for which the data is collected. (Section 23)
Compatibility of further processing The Act requires that where a data controller holds personal data collected in connection with a specific purpose, any further processing of that data must be compatible with the purpose for which the personal data was initially obtained. (Section 25(1))
The circumstances under which processing meets the compatibility requirement include where the data subjects consents to the further processing of the information, the data is in the public domain, further processing is necessary for purposes of fighting crime, for legislation that concerns protection of tax revenue collection, the conduct of court proceedings, protection of national security, public health, or the life or health of the data subject or another person. (Section 25(3))
Quality of information Under section 26 of the Act, a data controller who processes personal data must ensure that the data is complete, accurate, up to date and not misleading, having regard to the purpose for which that data is collected or processed.
Openness The openness principle ensures that individuals know about, and can participate in enforcing their rights under a data protection regime.
Section 27(1) makes it mandatory for a data controller who intends to process personal data to register with the Data Protection Commission. The Data Controller who intends to collect data must also ensure that the data subject is aware the nature of data being collected, the persons responsible for the collection, the purpose of the collection as well as whether or not the supply of data is mandatory or discretionary, among other things. (Section 27(2))
Where the data is collected from a third party, the Act requires the data subject to be informed before the data is collected, or as soon as practicable afterwards. (Section 27(3))
The Act provides circumstances under which the notification requirement is exempt, and they include where it is necessary to avoid compromising law enforcement, protect national security, or where it relates to the preparation or conduct of legal proceedings. Section 27(4))
Also, although it is not mandatory, a data controller can appoint a data protection supervisor, who would be responsible for monitoring compliance with the Act.(Section 58(1), (2)) The data protection supervisor may be an employee (Section 58(1)) and must meet the qualification criteria set out by the Data Protection Commission. (Section 58(7))
Data security safeguards Under the Act, a data controller has a duty to prevent the loss of, damage to, or unauthorized destruction of personal data, as well as the unlawful access to or unauthorized processing of personal data. The data controller must therefore adopt appropriate, reasonable, technical, and organizational means to take necessary steps to ensure the security of personal data in its possession or control. (Section 28(1))