The Data Protection Commission (DPC) has expressed concern over the public disclosure of personal information relating to 1,964 Ghanaian citizens evacuated from South Africa, warning that such actions could violate privacy rights and expose affected individuals to various risks.
In a statement issued on Tuesday, the Commission said it had taken note of reports involving the publication of identifiable personal information, including names, signatures and records of financial assistance received by the evacuees.
According to the Commission, the disclosure of such information, particularly involving individuals who may have faced threats to their safety, raises concerns about exposure to unwarranted public scrutiny, identity theft, fraud and other forms of harm.
The DPC cited Article 15(1) of the 1992 Constitution, which guarantees the dignity of all persons, and Article 18(2), which protects the right to privacy. It further noted that these constitutional protections are reinforced by the Data Protection Act, 2012 (Act 843), particularly provisions governing lawful processing, data minimisation and the legal basis for handling personal information.
While acknowledging the importance of transparency, parliamentary oversight, the right to information and press freedom, the Commission stressed that the pursuit of public accountability does not automatically justify the unrestricted disclosure of identifiable personal data.
It noted that any disclosure of personal information by the Minority Caucus in Parliament, the Ministry of Foreign Affairs, media organisations or any other entity must be assessed against applicable legal requirements, its intended purpose and the rights of affected individuals.
The Commission observed that both the Ministry of Foreign Affairs and Parliament of Ghana are registered data controllers in good standing with the Commission, but emphasised that such registration does not remove their obligations under the country’s data protection laws.
It therefore called on the Minority Caucus, the Ministry of Foreign Affairs, JoyNews and other media organisations to exercise due diligence in the handling, disclosure and publication of the records in question. The Commission urged all parties to take appropriate protective measures, including the immediate restriction or redaction of publicly accessible personal identifiers where continued disclosure cannot be legally justified.
As part of its response, the DPC announced that it will conduct a regulatory review to examine the legal basis of the disclosures, the safeguards applied and the extent to which the privacy rights of affected individuals have been protected.
The Commission indicated that it would engage all relevant parties within its statutory mandate and take appropriate regulatory action where breaches of Act 843 are established.
It further reminded public institutions, media organisations and all persons processing personal data that compliance with data protection requirements is an ongoing responsibility and that the rights to privacy and personal dignity must remain central to public accountability processes.
The Data Protection Commission reaffirmed its commitment to the fair, independent and consistent enforcement of Ghana’s data protection laws.