Seek clearance on personal data processes: Data Protection Commission tells institutions
The Data Protection Commission has urged government institutions and industries to refer projects involving the processing of personal data to the Data Protection Commission for clearance prior to commencement.
The commission has also implored all universities in the country to register with it and to comply with the Data Protection Act 2012 (Act 843) on the use of appropriate technologies and organisational measures to secure personal data.
The Executive Director of the Commission, Patricia Adusei-Poku, in a statement, noted that the Commission was not positioned to disable research or stand in the way of academia but to ensure that data controllers processed personal data appropriately and remained accountable to their data subjects.
Ms Adusei-Poku commended the University of Ghana’s School of Public Health for registering with the Data Protection Commission and for training one of its staff as their data protection supervisor as required by law.
She explained that in October 2021, the School of Public Health commenced a research study known as the Accra Urban Adolescent Nutrition study which was made public.
The study, she said, sought to describe the nutritional status, dietary intake, physical activity patterns, and food environment of about 1,000 data subjects, which included adolescent children from low and middle-class households in 10 selected neighbourhoods in the Greater Accra Region.
The data subjects were from communities in Chorkor, Abelenkpe, South La, New Mamprobi, Achimota, Old Nungua, West Legon, Kokomlemle, New Town, and Nungua.
“As part of the process to collect the data, the data subject were required to wear a fi xed belt with an accelerometer and GPS that would track their physical activity and movement trajectories over the period of the study.
“The research met the distress and concerns of additional data subjects: teachers, parents and the general public, due to the intrusive and highly sensitive nature of the data processing of the children.
“The data set included blood samples, GPS location, nutritional data and other personal data,” she noted.
Ms Adusei- Poku said in line with the national digitisation efforts by the Ministry of Communication and Digitalisation, the commission investigated the concerns of the public, and it was established that the University of Ghana was not in good standing with the commission as a data controller.
She said the university had also breached the contract with their international sponsor — International Food Policy Research Institute (IFPRI) — which had directed the university to comply with its jurisdictional data protection legal requirements.
She said the commission, in accordance with its mandate under the Data Protection Act 2012 (Act 843) Section 2 (a), directed the university to, among others, halt the study with immediate effect, register with the commission, notify its international sponsor of the breach, and also conduct a data protection impact assessment to ascertain potential risks and show mitigation measures.
She said the university was also directed to train at least one member of staff to oversee the implementation of privacy programmes and also train all relevant staff of their ethics committee heading such projects.
Ms Adusei-Poku said the commission followed steadily the progress made by the university and confirmed that the university had made efforts towards being accountable to the public and also registered with the commission.
She, therefore, urged all institutions and organisations to comply with the Data Protection Act 2012 (Act 843) in accordance with the law.