The Data Protection Commission (DPC) has intensified its enforcement of Ghana’s data protection laws following the identification of compliance deficiencies at several companies during a spot surveillance exercise in Accra.
The exercise covered several institutions operating within the Kaneshie industrial area and its surrounding environs, with the commission identifying concerns ranging from the absence of valid data protection certificates to expired registrations and incomplete renewal processes.
The Director for Regulatory and Compliance at the Commission, Quintin J. Akrobotu, disclosed this in an interview with the media following the inspections, explaining that some of the companies visited had operated for several years without demonstrating compliance with the requirements of the Data Protection Act.
According to him, the inspections revealed that some companies were unfamiliar with their data protection obligations, while others had failed to maintain valid registration with the Commission.
He said the affected institutions have been directed to take steps to regularise their status, while the Criminal Investigations Department (CID) of the Ghana Police Service has invited some representatives to provide statements regarding their failure to comply.
Mr Akrobotu stressed that the exercise was primarily intended to encourage compliance and ensure that organisations handling personal information take appropriate measures to protect it.
Quintin J. Akrobotu, Director, Regulatory and Compliance, DPC addressing the media
Among the institutions inspected was Polytex Ghana Limited, which, according to Mr Akrobotu, could not provide valid certificates demonstrating compliance with the data protection requirements applicable to its operations.
He said the company had been operating for some time but appeared to have limited knowledge of its obligations under the law.
The Commission engaged the company on the steps required to achieve compliance, with its representatives expressing a willingness to address the deficiencies identified during the inspection.
However, Mr Akrobotu disclosed that the police CID has invited the company to provide a statement explaining why it had not registered with the Commission.
A similar situation was encountered at J.A. Biney Packaging Ltd, which the Director said had operated for a considerable period without registering with the Commission.
He indicated that the company has also agreed to take immediate steps to establish the necessary processes to comply with the law.
According to him, the company’s representatives have been invited to report to the CID headquarters to provide a statement regarding their failure to register.
Qualiplast was another company identified during the exercise as lacking valid data protection certification.
Mr Akrobotu said the company appeared unfamiliar with the applicable data protection requirements but has expressed its willingness to introduce the necessary measures to regularise its operations.
He added that the company’s representatives has also been invited by the police to provide statements.
The Commission’s inspection also covered Braga Company Limited, an oil and gas company operating within the same industrial enclave.
Mr Akrobotu said the company had been operating for approximately 30 years but do not have a valid data protection certificate at the time of the inspection.
He explained that the company is yet to complete the registration requirements and has consequently been directed to engage with the Commission to address its compliance status.
According to him, representatives of Braga Company Limited has also been invited to the police CID headquarters to explain why the company do not have a valid certificate.
The Director said the Commission would continue engaging the affected institutions to ensure that they understand and fulfills their obligations under the Data Protection Act.
He emphasised, however, that the police would handle investigations arising from suspected breaches in accordance with their mandate.
Mr Akrobotu described the situation at Melcom as encouraging, noting that the retail company was taking steps to renew its data protection registration and strengthen its internal compliance arrangements.
He said management was in the process of renewing its licence and has arranged training for three professionals to improve the company’s data protection capacity.
According to him, the company has also appointed a principal data protection supervisor, as required under Section 58 of the Data Protection Act.
He explained that the next stage involves completing the necessary processes following the training, with the aim of achieving full compliance.
The director said Melcom’s actions demonstrates a willingness to take data protection seriously and establish appropriate arrangements to safeguard the personal information entrusted to the company.
He encouraged other institutions to adopt a similar approach by ensuring that their registration, staff training and internal data protection arrangements meet the requirements of the law.
The final institution visited during the exercise was Menkish Impex Limited.
Mr Akrobotu said the company could not locate its data protection certificate during the inspection.
However, records available to the Commission indicates that the company had previously registered, but its registration had expired in 2019.
He said the company had subsequently abandoned the renewal process and has therefore been directed to report to the Commission to regularise its status.
The police CID has also invited the company to explain why it does not have a valid data protection certificate.
Mr Akrobotu urged the company to act promptly to resolve the issue and fulfil its obligations under the law.
The director warned that organisations can not rely on ignorance of the law as justification for failing to meet their data protection obligations.
He said the Commission regularly undertakes public education through publications, its website and social media platforms to inform organisations and individuals about their responsibilities and rights under the law.
He added that the surveillance exercise has also received media attention, providing businesses with further opportunities to familiarise themselves with the requirements.
Mr Akrobotu cited Section 53 of the Data Protection Act, 2012 (Act 843), which prohibits an unregistered data controller from processing personal data.
He said organisations found operating without the required registration could face the legal consequences provided for under the Act.
According to him, the police would investigate the cases involving the affected institutions and determine the appropriate next steps under the applicable legal framework.
He clarified that the Commission’s role centres on regulatory compliance, while the police handles the investigative and enforcement aspects of suspected offences.
Mr Akrobotu said the surveillance exercise would continue in other locations and institutions as the Commission seeks to improve compliance with the Data Protection Act.
He explained that Section 8 of the Act provides the basis for the Commission’s regulatory oversight responsibilities, including monitoring compliance with data protection requirements.
The exercise is intended to ensure that organisations collecting, storing or processing personal information have the necessary registration and safeguards in place.
He said the Commission is particularly concerned about ensuring that personal information provided by members of the public to businesses and other institutions was not exposed to unauthorised persons.
According to him, the public must be confident that organisations entrusted with their personal information handle it responsibly and protect it against misuse or unauthorised access.
The director stressed that the commission’s objective is not to embarrass businesses but to encourage them to comply with the law and contribute to a safer environment for handling personal information.
He disclosed that following an earlier inspection at the Tema Free Zones enclave, several institutions whose certificates had expired have submitted applications to renew their registration.
He described the development as evidence that enforcement activities have encouraged organisations to take corrective action.
However, he maintained that institutions that failed to address their compliance deficiencies would have to respond through the appropriate regulatory and legal processes.
The director also highlighted the commission’s “Privacy is personal” campaign, which seeks to educate the public about their rights under the Data Protection Act and encourage organisations to fulfil their legal responsibilities.
He said the campaign is designed to help individuals understand their rights regarding the collection, use, storage and protection of their personal information.
It also seeks to remind businesses and other data controllers of their obligations when handling information belonging to customers, employees and members of the public.
Mr Akrobotu said the commission would continue its public education activities alongside its compliance surveillance and enforcement efforts.
He indicated that the campaign would encourage people to ask questions about how their personal information is handled and whether the organisations collecting it had met the applicable registration requirements.
The commission, he added, would continue working to ensure that organisations understand their obligations and that individuals become more aware of the protections available to them under the law.
The exercise forms part of broader efforts to strengthen data protection compliance in Ghana and ensure that institutions handling personal information put appropriate safeguards in place.
By 1960news.com
