Data Protection Commission demands restricted access to South Africa evacuees’ personal data

The Data Protection Commission has announced a regulatory review into the public disclosure of personal information belonging to 1,964 Ghanaians evacuated from South Africa.

The Commission, in a press release dated October 20, 2026, said it had noted with serious concern reports that the evacuees’ names, signatures, and records of financial assistance received had been made public.

It warned that the disclosure of identifiable personal information, particularly involving individuals who had faced threats to their safety, could expose them to unwarranted public scrutiny, identity theft, fraud and other forms of harm.

The Commission cited Article 15(1) of the 1992 Constitution, which protects human dignity, and Article 18(2), which guarantees the right to privacy.

It also referenced Sections 18, 19 and 20 of the Data Protection Act, 2012 (Act 843), which provide requirements for the lawful and reasonable processing of personal data, data minimality and the legal grounds for processing such information.

While acknowledging the importance of transparency, parliamentary oversight, the right to information and press freedom, the Commission stressed that the pursuit of public accountability does not automatically justify the unrestricted disclosure of identifiable personal information.

It said disclosures by the Minority Caucus of Parliament, the Ministry of Foreign Affairs, Joy News and other media houses must be assessed against applicable legal requirements, the intended purpose of the disclosures and the rights of the individuals concerned.

The Commission also noted that the Ministry of Foreign Affairs and Parliament are registered data controllers in good standing with the Commission.

However, it emphasised that registration does not exempt data controllers from their continuing obligations under Act 843.

The Commission has urged the Minority Caucus, the Ministry of Foreign Affairs, Joy News and other media organisations to exercise due diligence in handling, disclosing and publishing the records.

It has further called on all parties to take appropriate protective measures, including the immediate restriction or redaction of publicly accessible personal identifiers whose continued disclosure cannot be legally justified.

As part of its regulatory review, the Commission said it would examine the legal basis for the disclosures, the safeguards applied and the extent to which the privacy rights of the affected individuals had been protected.

It added that it would engage the relevant parties within its statutory mandate, taking into account constitutional protections and applicable legal exceptions.

The Commission warned that where non-compliance is established, it would take appropriate regulatory action in accordance with the Data Protection Act.

It reiterated that compliance with data protection laws remains a continuing responsibility for public institutions, media organisations and all other persons who process personal information.

The Commission stressed that the right to privacy and personal dignity must remain central to the exercise of public accountability, reaffirming its commitment to the fair, independent and consistent enforcement of Ghana’s data protection laws.