251 defaulting institutions to be prosecuted in 2 weeks if - Data Protection Commission

The Data Protection Commission says it will be giving defaulting data controllers final notices of a 2 weeks ultimatum to register with the Commission or they face legal action.

This follows a closed-door discussion yesterday, with the Director of Public Prosecution, Ms. Yvonne Atakora-Obuobisa, where the Commission was asked to issue final notices to the defaulters.

Institutions that collect and process personal data are mandated by Section 46 of the Data Protection Act, 2012 (Act 843) to register with the commission.

The Executive Director of the Commission, Ms. Patricia Adusei Poku, earlier indicated in February that the commission had started processes to prosecute non-compliant data controllers.

She said the defaulting institutions owed the state some GHC1.5 million, an amount which also represents penalties to be paid by the institutions. 

“We have taken our time to commence the prosecution of companies and institutions that have defaulted in their obligation. In October 2020, we gave them an amnesty period of six months to register, as required under Section 46(3) of the act.

While some came, others remained adamant to the caution. We have, therefore, compiled a list of those who have failed to register with the commission. We have about 800,000 institutions on our list, out of which only 251, representing 2.5 per cent, have received their 14-day notices,” Ms. Adusei Poku told reporters when she presented the list of defaulting institutions to the Director of Public Prosecutions.  

She continued: “So we are going to issue letters to all 251 defaulting institutions and give their key decision-makers a chance to respond to the charges against them, after which we will publish the list in the newspapers.

We know they are active businesses registered with the GRA and paying taxes, but they have failed in their obligation to register with the DPC.”