Data Protection Bill Passed

Parliament has passed the Data Protection Bill into an Act to set out the rights and responsibilities of data controllers, data processers and data subjects in relation to personal data.

The Act, which is awaiting presidential assent to be fully operational, is also intended to establish a Data Protection Commission.

This will provide for the protection of privacy relating to individuals including the process by which information is obtained, held, used or disclosed.

It provides a framework to ensure that as e-country principle is entrenched in using the Information Communications Technology (ICT) platform for administrative and business activities, the issues that arise from data subject privacy and third party use of data subject information would be regulated in a manner which would ensure confidence in the development of ICT mediator platforms and technologies.

The Minister for Communication, Haruna Iddrisu, who vigorously promoted the passing of the bill, indicated that the legislation is to deal with personal data which relates to data subjects or individuals who are the subjects of the personal data.

The development of the internet and computer networks, according to him, has caused the amount of personal data generated to reach significant proportions.

However, the personal data generated is kept across servers in different locations that have the potential to be shared by different legal and natural persons in a manner which the data subject could not have contemplated at the time the original data was obtained.

Haruna Iddrisu, who is also the Member of Parliament (MP) for Tamale South, said having recognized that every Ghanaian has the right to privacy with respect to the processing of personal data, the Act will activate or give meaning to Article 18 (2) of the 1992 constitution.

According to Communications Minister, the absence of legislation on this matter is an infringement of the right to privacy.

Other matters that have been spelt out include the regime which governs sanctions for breaches of privacy by data controllers and processors.