In an era defined by rapid technological advancement, the digital realm has become both a powerful enabler and a potential minefield for privacy violations. As our personal data increasingly fuels innovation, the risk of infringing upon fundamental rights to privacy looms large.
Ghanaian courts appear to be growing increasingly aware of this challenge and demonstrating a commitment to balance technological progress with the need to safeguard individual rights, and the Ghanaian legal space seems to be following suit. This article reports on a recent case in Ghana’s telecom sector, where the complexities of data protection and the right to privacy were keenly examined.
Background: Challenge to Data Collection by Telecommunications Operators
In April 2020, an individual named Francis Kwarteng Arthur initiated legal proceedings against the National Communications Authority (NCA), two telecommunications service providers—MTN Ghana and Vodafone Ghana—and Kelni GVG, the entity responsible for managing the Central Subscriber Identity Module (SIM) Register.
The lawsuit stemmed from privacy concerns regarding an Executive Instrument (EI) issued by former President Nana Akuffo Addo, which mandated network operators to facilitate mass information dissemination and provide specific data to the NCA’s Common Platform in the wake of the COVID-19 pandemic, which was admittedly a health emergency.
The Executive Instrument required network operators to share subscriber data, including caller and called numbers, merchant codes (for mobile money transactions), international mobile equipment identity (IMEI) codes, site locations, and mobile station international subscriber directory numbers with Kelni GVG, an entity the Government of Ghana had designated for the purpose.
The directive was grounded in Section 100 of the Electronic Communications Act, 2008 (Act 775), which empowers the President to issue orders to electronic communications providers for the interception of communications or user data in the interest of law enforcement.
Claims by the Applicant:
The applicant argued that the Executive Instrument and its enforcement by the telecommunications companies violated privacy rights protected under the Data Protection Act, 2012 (Act 843). Specifically, he contended that the Government’s collection and processing of private subscriber data were unconstitutional and that the affected entities had unlawfully facilitated this breach of privacy.
Respondents’ Core Argument: Public Health Emergency Justified Data Use
The entities sued argued that Ghana was facing urgent public health emergencies, and that the Executive Instrument was needed at the time. The respondents said it was important to quickly set up a system that could:
1. Trace people who might have been exposed: Find everyone who had been in contact with someone suspected of having or actually been affected with the COVID-19 disease.
2. Identify locations visited by those people: Figure out where these potentially affected people had been for health measures such as quarantining them and subjecting them to a health check.
They argued that all of these steps were necessary to deal with the emergency effectively. The Respondents insisted that, in order to solve these problems, tracing the movement of people and their contacts was key to a successful outcome.
Decision of the High Court:
The High Court ruled in favour of the applicant, recognizing a breach of privacy rights and the unlawful collection of subscriber data. The court made the following key rulings:
- Breach of Data Protection Laws: That the respondents had facilitated the unauthorized collection and processing of private subscriber data, violating the Data Protection Act, 2012 (Act 843).
- Damages Awarded: The court ordered the NCA, Vodafone Ghana, and Kelni GVG to pay the applicant GHS 20,000 in damages as compensation for the privacy infringement.
- Prohibition of Data Collection: The High Court directed the NCA to cease the ongoing collection of private data from mobile phone users.
- Deletion of Unlawfully Collected Data: The Government was instructed to delete all previously collected data within 14 days of the court’s ruling.
The Appeal: Challenge to the High Court’s Ruling
One of the parties appealed to the Court of Appeal, particularly challenging the High Court’s award of damages and its jurisdiction to order amendments to Executive Instrument (EI) 63. The appellant contended among other things that:
- The damages awarded were not supported by sufficient evidence.
- The High Court overstepped its authority by issuing orders requiring amendments to an Executive Instrument.
Court of Appeal Decision:
The Court of Appeal upheld the High Court’s ruling on damages, affirming that the applicant had suffered personal rights violation that warranted compensation. However, the appellate court held that the High Court exceeded its authority by ordering amendments to EI 63, as such actions fell within the legislative and executive purview. Accordingly, the Court of Appeal:
- Confirmed the damages award in favour of the applicant; and
- Set aside the High Court’s order requiring amendments to EI 63, citing the principle of separation of powers.
Takeaways from the Case:
- Right to Privacy: The case reinforces the constitutional right to privacy and the requirement for lawful justification before accessing personal data. It affirmed the rule that one must always seek a court order before violating the another’s right to privacy such as disclosing their personal data to third parties.
- Limits of Executive Authority: Executive Instruments must comply with statutory and constitutional safeguards, particularly concerning data protection. Where any part of the executive order breaches constitutional and statutory requirements, they may be quashed by the courts.
- Judicial Oversight: Courts can intervene where privacy rights are breached, but they must respect the separation of powers in issuing directives regarding legislative instruments.
- Data Protection Compliance: Entities handling personal data must adhere to the provisions of the Data Protection Act, 2012 (Act 843), ensuring that data collection and processing align with legal standards.
This case establishes a significant precedent for data privacy in Ghana, reinforcing the boundaries of governmental authority in digital surveillance and telecommunications regulation.
Alhassan Aboagye on behalf of OSD and Partners. [email protected]
