DPC Raises Privacy Concerns Over Publication of Evacuees’ Records

The Data Protection Commission (DPC) has expressed concern over public disclosure of personal information relating to 1,964 Ghanaian citizens evacuated from South Africa, warning that the publication may expose affected individuals to privacy breaches and other forms of harm.

In a statement issued on Tuesday, the Commission noted that the information made public included names, signatures and records of financial assistance received by the evacuees. It said the disclosure of such identifiable personal data, particularly involving individuals who may have faced threats to their safety, raises concerns about exposure to identity theft, fraud, unwarranted public scrutiny and other risks.

The Commission noted that the privacy and dignity of individuals are protected under Articles 15(1) and 18(2) of the 1992 Constitution, which guarantee the inviolability of human dignity and the right to privacy.

It added that these protections are further reinforced by the Data Protection Act, 2012 (Act 843), particularly provisions relating to lawful and reasonable processing of personal data, data minimisation and the legal grounds for processing personal information.

While acknowledging the importance of transparency, parliamentary oversight, the right to information and media freedom, the DPC stated that public accountability does not automatically justify the unrestricted disclosure of identifiable personal information.

According to the Commission, any disclosure by the Minority Caucus in Parliament, the Ministry of Foreign Affairs, Joy News and other media organisations must be assessed against the legal requirements governing data protection, the purpose of the disclosure and the rights of the individuals concerned.

The DPC noted that both the Ministry of Foreign Affairs and Parliament of Ghana are registered data controllers in good standing with the Commission. However, it mentioned that registration does not exempt data controllers from their ongoing obligations under Act 843.

The Commission therefore called on the Minority Caucus, the Ministry of Foreign Affairs, Joy News and other media houses to exercise due diligence in handling, publishing and disclosing the records. It urged all parties to take immediate steps to restrict access to, or redact, personal identifiers whose continued public disclosure cannot be legally justified.

The DPC further announced that it will undertake a regulatory review to examine the legal basis for the disclosures, the safeguards applied and the extent to which the privacy rights of the affected individuals have been protected.

“We would engage the relevant parties within its statutory mandate and take appropriate regulatory action where non-compliance with the Data Protection Act is established,” the statement read.

The Commission reiterated that compliance with data protection requirements remains a continuing responsibility for public institutions, media organisations and all persons processing personal data, stating “The right to privacy and personal dignity must remain central to efforts aimed at ensuring public accountability.”

Margaret Adjeley Sowah, ISD