The Data Protection Commission (DPC) has initiated action to prosecute officials of 177 institutions which function as data controllers but have failed to register with the commission, as required by the law.

The  institutions, comprising 25 airlines, 89 hotels, 50 hospitals and 13 shopping centres, have violated the Data Protection Act, 2012 (Act 843) which makes it obligatory for institutions that perform functions as data controllers to register, in accordance with Section 27 (1) of the act.

The Executive Director of the DPC, Mrs Teki Akuetteh Falconer, told the Daily Graphic that the commission had already initiated legal action against those organisations.

She said it was working with the Cyber Crime Unit of the Criminal Investigations Department (CID) of the Ghana Police Service for the police to go through their own processes to open dockets for the cases.

She said in the case of limited liability companies, their directors and secretaries would be held liable.

However, for public institutions, such as ministries, departments and agencies (MDAs), the chief directors were culpable.

“Each institution is expected by the law to designate someone as a data controller. For instance, for Parliament, it is the Clerk of Parliament, and for the universities, it is the heads, including the vice-chancellors,” she said.

Mrs Falconer said the commission was working on releasing the next list, which includes educational institutions that are yet to register with the DPC. 

Earlier in a statement signed by Mrs Falconer, the commission said in order to protect the interest of the public, it had no choice but to commence the prosecution of the offending institutions and the publication of their names to prevent reckless misapplication, use and abuse of personal data.

“This is the first in the series of publications that the commission will be undertaking. We are advising offending institutions to, as a matter of urgency, register now to avoid prosecution,” the Executive Director warned.           

The Data Protection Act mandates all entities, public and private, local and international, consultants and individuals who collect, hold and use personal data in Ghana to register with the DPC, in accordance with sections 27(1) and 46(3), which prohibit the collection, holding and using of personal data by data controllers that have not registered with the commission.

Section 53 and Section 56 of the act states that: “a person who fails to register as a data controller but processes personal data commits an offence and is liable, on summary conviction to a fine of not more than 250  penalty units or a term of imprisonment of not more than two years or to both’,” Mrs Teki said.

Caution statement

The statement cautioned the public against providing their personal information to such institutions, since doing that increased the dangers associated with the unlawful processing of their personal data, which included sale of their information, such as credit card details, residential address and phone numbers, to third parties for criminal and fraudulent purposes, lack of access or control over their information and identity theft.

Past warnings

The DPC commenced the registration of data controllers on May 1, 2015. During the period of the registration, notices were published in the Daily Graphic on Wednesday, July 15, 2015; Wednesday, July 22, 2015 and Wednesday, August 5, 2015.

The publications informed potential data controllers of their obligation to register with the commission. In the said publications, it was stated that an institution or individual existing prior to the commencement of Act 843 had three months to comply with the requirement to register.

Date extended

The three-month period, however, expired on July 31, 2015 and was subsequently extended by another three months, on the request of data controllers.

But many institutions the commission expected to comply with the directive failed to do so.

Subsequently, the commission, in April last year, sounded the clarion call to such organisations again but it did not yield fruits.

Who is a data controller

The act defines a ‘data controller’ as “a person who, either alone, jointly with other persons or in common with other persons or as a statutory duty, determines the purposes for and the manner in which personal data is processed or is to be processed”.

The list

Shopping malls

The affected companies include Accra’s top shopping centres —  A&C, the Marina Supermarket, the West Hills and the Junction malls, the Koala and the Max Mart Shopping centres, the Palace Hypermarket Interchange, the Achimota Retail Centre, the Game Stores, Mr Price, Shop-N-Save and the Citydia Supermarket.

Hotels

The hotels list include The Royal Senchi Hotel, the African Regent Hotel, the Aqua Safari Resort, the Peduase Valley Resort, the Volta Senera Hotel, the Villa Monticello Boutique Hotel, The Aknac Hotel, the MJ Grand Hotel, the Amir Hotel, the Royal Nick Hotel, the Midindi Hotel, the Best Western Premier, Accra Airport Hotel, the Royal Richester, His Majesty’s Hotel, the Urbano Hotel, the Prestige Suites Hotel, the Roots Hotel Apartment, the M Suites Hotel, the Hill View Hotel (McCarthy Hills), The Highbridge Guest Lodge, the Best Western Plus Accra Beach Hotel, the Niagara Plus Hotel, La Villa Boutique Hotel, the Hotel Casarere, the Rayporsh Hotel Limited, the Okera Inn, the Sonant Court Hotel, the Accra Luxury Lodge, the G.S. Plaza Hotel, the Deon Hotels, the Ellking Hotel, the Aristocrat Hotel, the Kings Royal Atlantic Hotel and the Sunlodge Hotel Limited.

Others are the Eastgate Hotel,Olma Colonial Suites, the Tropical Enclave Hotel, the Maxlot Hotel, the Nirvana Inn Hotels Ltd, the Golden Key Hotel, the Earl Heights Apartment Hotel, the Lake Bosumtwi Hotel and Apartments, the Vis-a-Vis Hotel Limited, the Hill View Hotel West Airport, the Ridge Over Suite, the Eden Vale Hotel and Executive Training Centre, The Congress Hotel, the Charleston Hotel, the Beauty Hotel Accra, the Hotel Obama, the Crown Liberty Hotel, the Bharridan Royal Hotel, the Lane Residence, the Robin Hood Hotel, the Grace Land Lodge, the Tenko Plaza Hotel, the Acacia Guest Lodge, the Silicon Lodge, the Hotel Westgate, the Crown Apartmento Hotel, the Cresta Royale Hotel, the Alexis Hotel, the Lincoln Hotel, the Manet Paradise Beach Resort, the Nogahill Hotel, the Ramada Resort Accra Coco Beach, the Central Hotel Ltd, the Courtesy International Hotel, the Blue Royal Hotel, the Crystal Rose Hotel, the Hotel Georgia, the Royal Basin Hotel and the Silicon Hotel & Conference Centre.

The rest are the Anita Hotel, the Ashanti Gold Hotel, the Lorneh Lodge and Beach Resort, the Villar Cisneros Resort Limited, the Greenland Hotel, the Manna Heights Hotel, the Capital Hill Hotel, the Pempamsie Hotel, the Little Acre Hotel, the Modern City Hotel, the Akayet Hotel, the Gariba Lodge Limited, the Mariam Hotel, the Eusbett Hotels Limited and the Upland Hotel.

Hospitals/clinics

The list of hospitals and clinics which have failed to comply with the law includes the Korle Bu Teaching Hospital, the Komfo Anokye Teaching Hospital, the Cape Coast Teaching Hospital, the Tamale Teaching Hospital, the 37 Military Hospital, the Tema General Hospital, the Ghana Police Hospital, the Accra Psychiatric Hospital, the Ridge Hospital, Accra, the Princess Marie Louise Children’s Hospital, the General Family Hospital, the Del International Hospital, the Yeboah Hospital, the Ghana-Canada Medical Centre, the Sweden Ghana Medical Centre, the Manna Mission Hospital, the Airport Women’s Hospital, Robert & Sons Limited, the Lapaz Community Hospital, the Inkoom Hospital, the La General Hospital, the Karikari Brobbey Hospital, the Airport Women’s Hospital, the Eben Family Hospital, the Cocoa Clinic, the Faith Mission Hospital, the Ark Clinic Ltd, the Bemuah Royal Hospital, the Holy Trinity Medical Centre, the Bethel Dental Ghana, the Canada Optical Laboratories Ltd, the Egon German Clinic,the Van J. Eye Care, the Iran Clinic, the University Hospital, Legon, the Beijing Clinic, the Champion Divine Clinic, the Third Eye and Vision Centre, the Danpong Medical Centre, the Universal Hospitals Group-Ghana, the Healthnet Airport Medical Centre, the Family Health Medical School, the Beaver Clinic Limited, the New Generation Medical Centre, Lifehealth Care, the Barnor Hospital, the Nadkof Physiotherapy & Wellness Centre, the West African Rescue Association (Wara), the Accra Clinic, the Medicare Centre Clinic & Laboratory and the North Ridge Clinic.

Airlines

Airlines on the list include Arik Air, Royal Air Maroc, Goldstar Airlines, Air Namibia, Lufthansa Airlines, Iberia Airlines, Tap Portugal Airlines, British Airways, Afriqiyah Airlines, Britannia Airways, Ghana International Airlines Limited, Das Air Cargo, Cargolux, Africa West Cargo, Aerogem Aviation, Tropicana, Falcon Express, Mk Airlines, Aero Contractors, Air Burkina and Alitalia, with Starbow Airlines, Ghana Air, Antrak Airlines and Citylink Airline making up the local list.

Not operating/defunct

However, Daily Graphic checks indicate that while Lufthansa Airlines no longer operates in Ghana, Ghana International Airlines Limited and Citylink Airline are defunct.

But Mrs Falconer told the Daily Graphic that the list showed that although such companies might not be operating in the country, they were still on the official records of the Registrar-General’s Department.