The Data Protection Commission has raised concerns over the public disclosure of personal information belonging to 1,964 Ghanaians evacuated from South Africa, warning of potential risks to their privacy, dignity and safety.
In a press release dated October 20, 2026, the Commission said the disclosed information included the names, signatures and records of financial assistance received by the evacuees.
It cautioned that publishing identifiable personal information, particularly concerning individuals who have faced threats to their safety, could expose them to unwarranted public scrutiny, identity theft, fraud and other forms of harm.
The Commission cited Articles 15(1) and 18(2) of the 1992 Constitution, which protect human dignity and individual privacy, respectively. It also referenced Sections 18, 19 and 20 of the Data Protection Act, 2012 (Act 843), which outline requirements for the lawful and reasonable processing of personal data.
While acknowledging the importance of transparency, parliamentary oversight, the right to information and press freedom, the Commission stressed that the pursuit of public accountability does not automatically justify the unrestricted disclosure of identifiable personal information.
It said disclosures involving the Minority Caucus in Parliament, the Ministry of Foreign Affairs, Joy News and other media organisations must be assessed against applicable legal requirements, their intended purpose and the rights of the individuals concerned.
The Commission further noted that the Ministry of Foreign Affairs and Parliament of Ghana are registered data controllers in good standing. However, it emphasised that registration does not exempt them from their continuing obligations under the Data Protection Act.
Consequently, the Commission has urged the Minority Caucus, the Ministry of Foreign Affairs, Joy News and other media houses to exercise due diligence in handling, disclosing and publishing the records.
It called on the parties to take appropriate protective measures, including the immediate restriction or redaction of publicly accessible personal identifiers whose continued disclosure cannot be legally justified.
The Commission announced that it would undertake a regulatory review to examine the legal basis for the disclosures, the safeguards applied and the extent to which the privacy rights of the affected individuals have been protected.
It said it would engage the relevant parties within its statutory mandate and take appropriate regulatory action under Act 843 if any non-compliance is established.
The Commission reiterated that public institutions, media organisations and other persons processing personal data have a continuing responsibility to comply with data protection laws.
It stressed that the right to privacy and human dignity must remain central to the exercise of public accountability.
By: Bernard Mensah
Discussion about this post