Ghana DPC Flags Companies: Data Protection Breaches Found in 6 Firms

• The Ghana Data Protection Commission (DPC) flagged six companies in Accra for failing to comply with national data protection laws.
• Violations included operating without registration, using expired certificates, or neglecting to renew registrations.
• Companies like Polytex Ghana Limited and JA Biney Packaging were directed to report to the CID's Cyber Security Unit and the DPC.
• Melcom Group of Companies was commended for its compliance efforts, including license renewal and training for a data protection supervisor.
• The DPC's enforcement exercise, based on Sections 53 and 81 of the Data Protection Act, will continue with nationwide inspections, emphasizing that ignorance of the law is not an excuse.

The DPC's firm warning that ignorance of the law will not be tolerated should prompt all data controllers to audit their practices, particularly regarding registration, certificate renewal, and the appointment of a data protection supervisor, given the active enforcement exercises and the potential for referrals to the CID for non-compliance.

The Data Protection Commission (DPC) in Ghana has identified six companies operating in the Kaneshie North Industrial Area and Tudu for significant breaches of the nation's data protection statutes. These companies, which include Polytex Ghana Limited, JA Biney Packaging, Qualiplast Limited, Bragha Company Limited, Melcom Group of Companies, and Menkish Impex Ltd, were found to be non-compliant due to a range of issues such as operating without proper registration, possessing expired certificates, or failing to renew their required registrations. This action by the Ghana DPC flags companies data protection breaches as part of a broader enforcement drive.

Following these findings, the implicated companies received directives to report to both the Cyber Security Unit of the Criminal Investigations Department (CID) at the Police Headquarters and the DPC by Thursday, October 15. During a compliance check conducted on a Wednesday, Polytex Ghana Limited was specifically noted for its inability to demonstrate adequate knowledge of data protection requirements and for not presenting a valid certificate, leading to an invitation from the CID's Cybercrime Unit for an explanation regarding its unregistered status. Similarly, JA Biney Packaging, despite agreeing to pursue compliance, was directed to provide a statement to the CID concerning its unregistered operations, while Qualiplast Limited, which also lacked a valid data protection certificate but expressed willingness to implement necessary measures, is expected to clarify its non-compliance with the CID.

Further investigations revealed that Bragha Company Limited, an oil and gas enterprise, had operated for approximately three decades without either a valid data protection certificate or completing its registration process, resulting in an invitation to meet with both the CID and the DPC. Menkish Impex Ltd was cited for its registration having lapsed in 2019 without renewal; the company has been instructed to regularize its standing with the Commission and account for this oversight to the CID. These referrals underscore the serious nature of the DPC's enforcement activities.

Mr. Quintin Akrobotu, the Director of Regulatory and Compliance at the DPC, highlighted that some entities have been collecting and processing personal data for extended periods without the necessary registration with the Commission. He emphasized that Section 53 of the Data Protection Act explicitly prohibits data controllers from processing personal information unless they are registered with the DPC, forming a cornerstone of Ghana data controller registration requirements. The current enforcement exercise, conducted under the authority of Section 81 of the Act, is a direct response to such widespread non-compliance.

The DPC's enforcement efforts are not confined to this recent week-long initiative; Mr. Akrobotu confirmed that inspections will continue into the next year, with further nationwide checks planned. This sustained Ghana Data Protection Commission enforcement signals a clear intent to ensure adherence across all sectors. The Commission also actively educates organizations on their obligations through various channels, including publications, its website, and social media platforms, reinforcing the message that ignorance of the law will not be considered an excuse for non-compliance.

The DPC's objective is not to cause embarrassment but to foster compliance, a goal evidenced by its commendation of companies that previously contacted the Commission to work towards rectifying their compliance issues. The involvement of the CID's Cybercrime Unit in these referrals underscores the potential for legal consequences for entities that fail to meet their data protection responsibilities.

The recent actions by the DPC serve as a critical reminder for all organizations handling personal data in Ghana to review their compliance status. While several companies faced sanctions, Melcom Group of Companies was notably commended for its proactive data protection efforts. Melcom is currently in the process of renewing its license and is investing in training three professionals, one of whom has been designated as its data protection supervisor, a role mandated under Section 58 of the Data Protection Act. This example illustrates a commitment to Ghana Data Protection Act compliance.

Melcom's proactive stance, including its focus on training and appointing a data protection supervisor, positions it as a model for other businesses. The company is expected to undertake additional steps to achieve full compliance after the completion of this training. The DPC's firm warning that ignorance of the law will not be tolerated should prompt all data controllers to audit their practices, particularly regarding registration, certificate renewal, and the appointment of a data protection supervisor, given the active enforcement exercises and the potential for referrals to the CID for non-compliance. This is a clear signal that Ghana DPC flags companies data protection breaches seriously.

Lawyers and compliance officers in Ghana should immediately advise clients to audit their data protection registration status and compliance with the Data Protection Act, particularly regarding registration, certificate renewal, and appointing a data protection supervisor, as the DPC is actively conducting enforcement exercises with referrals to the CID for non-compliance.

Source: Original reporting via GNA