Ghana, like many other countries has created a solid system to regulate the collection, processing, storage and usage of personal data to protect the data privacy of individuals. In today's digital world where data privacy is crucial for businesses, safeguarding data privacy of persons is the topmost priority for businesses. In this article, we will look at Ghana's legal framework for data privacy and how businesses can put in place measures to comply with data protection laws in Ghana.
Legal Framework of Data Protection in Ghana
The Data Protection Act, 2012 (Act 843) is the main legislation governing data privacy in Ghana. Act 843 establishes a Data Protection Commission with the core mandate to protect the privacy of the individual and personal data by regulating the processing of personal information, to provide the process to obtain, hold, use or disclose personal information.
Principles applicable to Data Processing
Section 17 of the Data Protection Act, 2012 (Act 843) outlines principles a person who processes data must apply. The principles of accountability, lawfulness of processing, specification of purpose, compatibility of further processing with purpose of collection, quality of information, openness, data security safeguards and data subject participation must be applied when processing personal data.
Under Act 843, personal data must be processed without infringing the privacy rights of the data subject, in a lawful manner, and in a reasonable manner.
Processing of personal data must be done with the prior consent of the data subject unless the purpose for which the data is been processed is necessary for a contract to which the data subject is a party, authorised or required by law, to protect a legitimate interest of the data subject or the data controller.
Salient Features of the Data Protection Act, 2012 (Act 843)
- Establishment of Data Protection Commission
(DPC)
The Act establishes the Data Protection Commission with the sole mandate of enforcing data protection laws and ensuring compliance. - Data Subject Rights
Data subject according to Act 843 is an individual who is subject of personal data. These individuals have the right to access their personal data, request corrections or deletion of their personal data, and withdraw consent to the processing of their personal data.
Data controllers are mandated by law to take the necessary steps to ensure that the data subject is aware of the purpose for the collection of the data. - Data Controller Obligations
Act 843 defines a data controller as a person who either alone, jointly with other persons or in common with other persons or as a statutory duty determines the purposes for and the manner in which personal data is processed or is to be processed.
Data controllers are required to;
- Process data lawfully, fairly, and transparently.
- Ensure data is collected for specified, legitimate purposes.
- Take necessary steps to ensure the integrity and security of personal data.
- Register with the Data Protection Commission.
- Data Breach Notification
The Act mandates data controllers to notify the Data Protection Commission and data subjects in situations whereby there are reasonable grounds to believe that the personal of a data subject has been accessed or acquired by an unauthorized person.
The notification shall provide sufficient information to allow the data subject to take protective measures against the consequences of unauthorised access or acquisition of the data. - Penalties for Non-Compliance
The Act provides for penalties for non-compliance with its provisions. Data controllers who contravene any of the data protection principles shall be served with an enforcement notice by the Data Protection Commission. A data controller who fails to comply with the notice commits an offence and is liable on summary conviction to a fine of not more than one hundred and fifty penalty units or a term of imprisonment of not more than one year or to both.
Again, where a person commits an offence under Act 843 in respect of which a penalty is not specified, the person is liable on summary conviction to a fine of not more than five thousand penalty units or a term of imprisonment of not more than ten years or to both.
Data Protection Compliance
- Register with DPC: It is mandatory for all data controllers to register with the Commission before processing personal data of individuals or persons.
- Application of Data Protection Principles: Section 17 of Act 843 spells out the various data protection principles data controllers are to apply when processing data. Some of the principles are accountability, lawfulness of processing, openness, data security safeguards, among others.
- Appointment of Data Protection Supervisors: Section 58 states that data controllers may appoint certified and qualified data protection supervisors. Their role is to oversee compliance internally with the provisions of Act 843.
- Security Measures: Safeguarding the integrity and confidentiality of personal data is a must for data controllers.
- Notification of Security Compromises: Data controllers are required to notify the Commission where there are reasonable grounds to believe that personal data of individuals or persons have been accessed or acquired by an unauthorised person.
- Develop Internal Policies and Security Measures: Clear and concise policies on collection, processing, and storage of personal data should be put in place. It is important to obtain consent from data subjects before collecting, processing and storing their data. Provision of regular training and awareness for employees on data protection principles, policies, and procedure like integrating Data Protection impact Assessment (DPIA) which is to identify and assess the potential risks to individuals' privacy and personal data protection before beginning or updating any data processing activities.
Conclusion
Data protection compliance is a must for companies in Ghana who are collecting, processing and storing personal data. By complying with the data protection laws of Ghana, companies can mitigate risks, build trust with data subjects, and ensure the lasting success of their business activities in Ghana.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
