image courtesy:  ico.org.uk

GDPR data protection legislation comes into effect in the fifth month of this year; it is set to regulate the collection and use of personal information on people living in the 28 countries that make up the European Union.

This EU privacy legislation is a global law regarding data protection, as it covers any organization that has data on individuals living in the EU. In January last year the consultancy firm PwC issued a press release, stating that 92% of companies in the United States said complying to GDPR is their top data protection priority, this is enough proof that the GDPR is set to impact global business.

In the GDPR, the organization that defines what and how data is collected is called the Data Controller, this is no different from what is provided for under the Data Protection Act 2012, Act 843 of Ghana.

Data Controllers are ultimately responsible for all data protection, no matter where the data travels and who else accesses it. The Data Controller must therefore ensure that all subcontractors, outsourcers and cloud service providers have the necessary processes, procedures, technologies and have trained their teams to ensure data is controlled.

The GDPR has 99 articles and covers many forms of data risk. Being compliant takes a mix of knowledge, processes, policies and training, as well as data tracking, controlling, and user and device management, all coming from a “privacy first” IT philosophy.

It is noteworthy to reiterate that no technology on its own can deliver compliance as GDPR requires a whole-company approach including policies, procedures, training, legal agreements with partner companies and should be led by governance, risk and compliance groups.

Notwithstanding for all intents and purposes an European statute, the new General Data Protection Regulation (GDPR), which is applicable come May, 25^th of this year, is expected to have copious impact in African countries, as its span will also cover many data controllers and processors established outside of the European Union – namely, all those who process data of individuals located within the EU as part of the selling of goods and services to such individuals.

Those, which especially include e-commerce websites or targeted advertising providers and/or their Africa-based processors, will be directly subject to the new provisions under the GDPR.

The free flow of data between European and African countries will therefore be conditional upon proactive lawmaking and good practices in the latter, oriented towards the offering of an “adequate level” of data protection – that is, a level equivalent to the one set by GDPR.

In July 6, 2017 the International Association of Privacy Professionals stated on its website, that;

Bird & Bird reports on the state of data protection in Africa less than a year before the EU General Data Protection Regulation goes into effect. Some African countries are ahead of the curve in terms of having sufficient data protection authorities in place, with Morocco standing out, having requested an adequacy recognition decision from the European Commission in 2009. 

Other countries in Africa lack comprehensive GDPR-compliant data protection legislation or have no legislation in place at all. Legal frameworks in Cameroon, Rwanda and Congo only focus on certain aspects of electronic communication data, leaving them far short of European data protection authorities’ expectations and little chance of receiving adequacy status, the report states.

It has been further noted that Morocco had made efforts to integrate into the EU Data Protection framework by requesting for this adequacy recognition from the EU; which is basically a mutual recognition procedure set up in order to speed up the EU procedure of recognition for data protection authorities.

Bird & Bird LLP captured this position in a publication by Merav Griguer in 05 July 2017 titled “Data protection in Africa: where do we stand one year before GDPR”, as follows;

…Morocco is remarkable for having requested an adequacy recognition decision from the European Commission, as early of 2009. This request is still pending to this day, mostly due to the simultaneous changing of the European framework; Moroccan officials have yet reaffirmed their will to reach compliance as soon as possible.

The [Moroccan case however sheds light on the European Commission’s rationale for the scrutiny of adequacy recognition applications, and thus might serve as an example] for other concerned countries: adequacy, in the views of the Commission, is primarily a matter of effectiveness; African data protection authorities should therefore be provided with the necessary means to enforce relevant legal provisions, so that compliance be thoroughly ensured by companies and public bodies under their jurisdiction. [Emphasis added]

The view is expressed here that such adequacy recognition will be highly successful where the country seeking the recognition has an equivalent high-standard domestic provisions that might very well be the best incentive to ensure compliance with the new GDPR regulation and Ghana finds itself in a better position has its laws are comprehensive and world-class enough to meet GDPR requirements where need be.

However the laws per se do not provide compliance and there is presently a mistaken believe that the Data Protection Act 2012, Act 843 by itself protects personal data, this is erroneous to the extent that Act 843 only guarantees the rights of data subjects and sets obligations for the data controller and/or processor.

The protection of the information is vested in the implementation of the 8 data protection principles embedded in the law coupled with the regulators enforcement roles, of which without any shred of doubt includes awareness and training on the requirements of the law.

These principles include accountability, lawfulness of processing, specification of purpose, compatibility of further processing with purpose of collection, quality of information, openness, data security safeguards and data subject participation.

The GDPR however requires a more practical approach to these principles and one can say it’s more granular in its requirements, for example extracts from the legal text of the GDPR provides as follows;

• Article 5 stipulates principles relating to processing of personal data, where the GDPR requires that the controller shall be able to demonstrate compliance.

• Article 24: stipulates responsibility of the Controller, and requires that the controller shall implement appropriate technical … measures to ensure and demonstrate that the processing of data is performed in accordance with GDPR.

• Article 25: stipulates data protection by design and default, requiring …implementation of appropriate technical measures and …necessary safeguards into the processing.

• Article 28: stipulates obligations of a Processor, GDPR requires the controller shall use only processors providing sufficient guarantees … of this regulation.

• Article 30: stipulates records of processing activities and provides that each controller … shall maintain a record of processing activities.…and provides for transfers of data to a third country or international organisation …identify that organization.… and provides that there should be general description of the technical measures [deployed].

• Article 32: stipulates security of processing which includes; shall implement appropriate measures … confidentiality, integrity, resilience..and appropriate level of security … [against] … accidental, destruction, loss, alteration, unauthorised disclosure of or access to personal data

•  Article 33: stipulates notification of data breach to authority and provides that the controller shall … not later than 72 hours … notify the … authority.… and provides that Describe nature of breach … numbers concerned … consequences.… and provides that measures taken to address breach …mitigate breach be stated.

• Article 34: stipulates communication breach … to data subject and states that shall communicate data breach to subject without delay.… and states that shall not be required if … data unintelligible …such as encryption.

• Article 35: stipulates data protection impact assessment and states that In particular, when using new technologies … carry out risk assessment of the impact … including measures to address the risks.

• Article 45: stipulates transfers [to a third country] based on adequacy and states that transfers to third country only if commission has decided … ensures an adequate level of protection.

• Article 46: stipulates transfers subject to appropriate safeguards and states that binding corporate rules, standard data protection clauses or enforceable commitments.

In essence the GDPR covers from processing of the data, transfers, security safeguards, impact assessments and breach notifications; all these are provided for under the Data Protection Act 2012, Act 843 of Ghana.

In recent times there has been the argument for safe-harbor rules under the Act 843, its not far-fetched but the it professionally expressed here that as Article 46 provides for under the GDPR, contractual documents, standards and agreements can suffice for this requirements without hurriedly tampering with the current law.

Act 843 is wide in scope and resilient in application; it is a matter of the regulators punch and the corporations/firms due diligence and application that will make it a success and provide companies in Ghana less stress when benchmarked against the GDPR.

Whiles corporations and firms operating in Ghana, from a data protection perspective, should be focused on putting structures in place to ensure compliance with ACT 843, they should not neglect the GDPR when it comes into force on 25 May 2018 with its improved data protection and privacy laws.

What businesses operating in Ghana need to be aware of is that the GDPR applies in EU member states as well as where data is transferred to or from the EU.

This means that businesses operating in Ghana which engage in business with persons in EU member states will fall within the ambit of the GDPR.

Notably, the GDPR will apply where businesses in Ghana, process the data of an EU member state citizen or temporary resident, have employees based in an EU member state, offer goods or services in an EU member state and have a partnership with an EU business.

The obvious is that, businesses in Ghana that have a presence in the EU will therefore need to be aware of the new requirements under the GDPR in order to continue to conduct their businesses in a data protection compliant manner.

Desmond Israel

Privacy/Infosec Practitioner

desmond[at]isa.com.gh