Compliance with Data Protection Regulations

Compliance with Data Protection Regulations
Introduction
Here at Griffin legal, we have a strong resolve to protect the interests of our clients. We try to
understand the industries from which our clients operate and study the nature of your business
to enable us provide you with cutting-edge information which allows you to get ahead in your
business.
Data protection has become one of the major concerns in recent times. There has arisen an
urgent need to protect the privacy right of persons because of recent data breaches exposing
the personal data of persons who in some cases had no idea that other persons were
processing and controlling their data.
Accordingly, many countries in an effort to regulate the protection of data have passed laws
imposing responsibilities and obligations on legal and natural persons who process and control
personal data as part of delivering their services.
We know, through our past dealings with your company, as your advisors, that you provide
security and profiling services to airlines here in Ghana, and as part of your work, you collect
personal data on behalf of your client either on their instruction or on your own accord.
It is our goal to educate you on the obligations imposed on your company by law, in activities
which amount to processing and collecting personal information from persons and entities with
whom you transact business.
Data Protection Act, 2012 (Act 843)
This law regulates the collection and enforces the protection of personal data in Ghana. It
came into effect on 16 October, 2012 but registration of data controllers and processes began
on 1 January, 2015.
The law sets out the rules and principles governing the collection, use, disclosure and care for
personal data or information by a data controller or processor. It recognises a person’s right
to protect their personal data or information by mandating a data controller or processor to
process (collect, use, disclose, erase, etc.) such personal data or information in accordance
with the individual’s privacy rights provided by Article 18(2) of the 1992 Constitution of Ghana.
Data Processing Obligations
This law imposes a duty on all persons or entities which collect personal information such as
names, telephone numbers, pictures, addresses etc. from their customers to register with the
Data Protection Commission. The application of this law is not industry specific but applies to
all industries.
Who is a Data Controller?
A data controller is a natural or legal person who controls and is responsible for the collection,
keeping and use of personal information in computer systems or in manual files.
If an organisation controls and has responsibility over the personal information it collects or
holds, then that organisation is a data controller. That entity must be responsible for any of the
following:
Collect, hold and process personal information.
Determine how personal information collected should be used.
Determine what personal information should be collected and or kept.

Who is a Data Processor?
A natural or legal person could be a data processor if it does any of the following:
Collect, hold or process personal data, but does not exercise responsibility for or
control how the personal data is used.
Have little or no freedom in the determination of what the data processing should entail.
If you or your organisation process the personal information, but some other individual or
organisation decides and is responsible for how you process that personal information, then
the said individual or other organisation that determines how you process the personal
information is the data controller, and your organisation is the data processor.
It is possible for a person or entity to be both a data controller and a data processor, in respect
of distinct sets of personal information.
General Data Protection Regulations (GDPR)
The General Data Protection Regulation (GDPR) standardizes data protection law across all
28 EU countries and imposes strict new rules on controlling and processing personally
identifiable information (PII). It also extends the protection of personal data and data protection
rights by giving control back to EU residents. GDPR replaces the 1995 EU Data Protection
Directive, and goes into force on May 25, 2018.
There are many essential items in the regulation, including increased fines, breach
notifications, opt-in consent and responsibility for data transfer outside the EU. As a result, the
impact to businesses is huge and will permanently change the way customer data is collected,
stored, and used.
GDPR applies to all organizations holding and processing EU resident’s personal data,
regardless of geographic location. Many organisations outside the EU are unaware that the
EU GDPR regulation applies to them as well. If an organization offers goods or services to, or
monitors the behaviour of EU residents, it must meet GDPR compliance requirements.
Fines for noncompliance are large. They can be as high as €20 million or 4% of a company’s
total global revenue, whichever is larger. This is the maximum fine that can be imposed for
the most serious violations, e.g. not having sufficient customer consent to process data or
violating core Privacy by Design concepts. However, there is a tiered approach to fines, e.g.
a company can be fined 2% for not having their records in order, not notifying the supervising
authority and data subject about a breach, or not conducting an impact assessment. It is
important to note that these rules apply to both controllers and processors.
Next Steps
Your company must as a matter of urgency determine if it is a data controller or processor and
take steps to comply with the Data Protection Act, 2012 (Act 843).
We have included information on the GDPR because we are aware that you offer services to
European airlines and may process personal information of EU citizens from time to time.
Steps must be taken to comply with the GDPR to avoid possible liability arising from any
breach of the regulations when it comes into force on May 25, 2018.
Should you have any data protection queries, please contact Griffin Legal here.
Likewise, if you require assistance drafting GDPR compliant contracts, please contact
a member of Griffin Corporate’s Commercial Transaction team here.