The Data Protection Act, 2012 (The Act) is legislation enacted by the Parliament of the Republic of Ghana to protect the privacy and personal data of individuals. It regulates the process personal information is acquired, kept, used or disclosed by data controllers and data processors by requiring compliance with certain data protection principles. Non compliance with provisions of the Act may attract either civil liability, or criminal sanctions, or both, depending on the nature of the infraction. The Act also establishes a Data Protection Commission, which is mandated to ensure compliance with its provisions, as well as maintain the Data Protection Register.
History
The Act was first introduced in the Ghana Parliament in 2010, but was subsequently withdrawn by the then Minister of Communications, Haruna Iddrisu, to be revised. Parliament passed the bill in 2012, which then received Presidential assent on May 10, 2012. The notice of the Act was gazetted on 18 May 2012, and in accordance with Section 99, the Act came into effect on 16 October 2012.
Structure
The Act is made up of 99 sections that are arranged under various headings, as follows:
Key terms
Key terms in the Act are defined in the interpretation section, section 96. Unless the context otherwise requires, section 96 provides the following definitions to the notable terms:
“data controller” means a person who either alone, jointly with other persons or in common with other persons or as a statutory duty determines the purposes for and the manner in which personal data is processed or is to be processed
“data processor” in relation to personal data means any person other than an employee of the data controller who processes the data on behalf of the data controller
“data subject” means an individual who is the subject of personal data
“foreign data subject” means data subject information regulated by laws of a foreign jurisdiction sent into Ghana from a foreign jurisdiction wholly for processing
“personal data” means data about an individual who can be identified,(a) from the data, or (b) from the data or other information in the possession of, or likely to come into the possession of the data controller
“processing” means an operation or activity or set of operations by automatic or other means that concerns data or personal data and the (a) collection, organisation, adaptation or alteration of the information or data, (b) retrieval, consultation or use of the information or data, (c) disclosure of the information or data by transmission, dissemination or other means available, or (d) alignment, combination, blocking, erasure or destruction of the information or data
“recipient” means a person to whom data is disclosed, including an employee or agent of the data controller or the data processor to whom data is disclosed in the course of processing the data for the data controller, but does not include a person to whom disclosure is made with respect to a particular inquiry pursuant to an enactment
“special purposes” means any one or more of the following: (a) the purpose of journalism, (b) where the purpose is in the public interest, (c) artistic purposes, and (d) literary purposes
Application of the Act
The Act is applicable, where
the data controller is established in Ghana and the data is processed in Ghana, the data processor is not established in Ghana, but uses equipment, or uses the services of a data processor carrying on business in Ghana, to process data, or the information being processed originates either partly or wholly from Ghana. (Section 45(1))
Data which originates externally and merely transits through Ghana is however, not protected by the Act (Section 45(4)). The Act applies to the Ghanaian Government, and for that purpose, each government department is treated as a data controller. (Section 91)
Data protection principles
The Act provides for 8 principles that data processors have to take into account in processing data, in order to protect the privacy of individuals. These principles are similar to the OECD Guidelines and the Data Protection Directive of the European Union.
The data protection principles are enumerated at Section 17 as follows: accountability lawfulness of processing specification of purpose compatibility of further processing with purpose of collection quality of information openness data security safeguards, and data subject participation.
