For fear of identity theft, others, Ghana begins enforcement of Act on data collection
Worried by rising identity theft and related financial crimes, the agency in charge of personal information and allied data in Ghana, Data Protection Commission (DPC), has concluded plans to begin newspaper publications of unregistered and illegal data collectors from Monday June 19, 2017.
Identity theft in ICT parlance can be described as identity fraud; a crime in which an imposter obtains key pieces of personally identifiable information, such as Social Security or driver’s license numbers, in order to impersonate someone else.
Illegal data collectors being referred to included a number of Ministries, Departments and Agencies; Municipal, Metropolitan and District Assemblies; public and private organisations; security agencies, airline companies, Law firms, hotels and restaurants, companies, partnerships and trusts, hospitals and clinics, microfinance and insurance companies, accounting and auditing firms, educational institutions, media houses, voluntary groups and associations.
Addressing the development in Accra, the Executive Director of the Commission, Mrs. Teki Akuetteh Falconer, noted that the decision was due to the observed apathy and defiance of many data controllers, who create rooms for illegal access of personal data in the country by fraudsters’ and allied criminals.
Relying on the provisions of Ghana Data Protection Act 2012 (Act 843) which mandated all entities whether public, private, local or international consultants and individuals, who collect, hold and use personal data in Ghana, to register with the DPC, which also prohibits the collection, possession and use of such records by institutions that were not registered with the Commission, she announced the criminalization of collection of peoples data without being fully registered with DPC.
Falconer quoted a section of the Act which provided that “a person who fails to register as a data collector, but processes personal data commits an offence is liable on summary conviction to a fine of not more than two hundred and fifty penalty units or a term of imprisonment of not more than two years or to both”.
According to her in a report by Ghana News Agency (GNA), “subject to the numerous public education by the DPC since 2014, and giving the long grace period to these operators to register with the Commission, a number of measures including calling on the public to stop using the services of the said institutions and shutting down the operations of recalcitrant ones, were being undertaken, with the objective of preventing further unlawful processing of individual’s information, and the dangers associated with such practices”.
Continuing, the Executive Director noted that “the dangers associated with the unlawful processing of personal data was real and included risks of trading such information on the web and potential use for all sort of unauthorised and fraudulent businesses”.
Illegal access to personal information could also provide the basis for identity theft as a result of careless handling and sale of personal data by these operators to third parties for unsolicited marketing communications, while the unauthorised disclosure or sharing of such records that could put individuals at the risk of discrimination, fraud, stealing and armed robberies.
Some of the observed dangers in some parts of the world include misrepresentation of information, lack of access or control by persons over their own personal data, as well as illegal collection and sale of credit card information for fraudulent purposes.
Falconer averred that the risks of unregistered bodies having access to peoples’ personal data are now in the increase in many parts of the world including Ghana, hence the need to begin enforcement and monitoring.
