View source for Data Protection Act, 2012 (Act 843)

==ARRANGEMENT OF SECTIONS==

''Data Protection Commission''
:1. Establishment of Data Protection Commission
:2. Object of the Commission
:3. Functions of the Commission
:4. Governing body of the Commission
:5. Tenure of office of members
:6. Meetings of the Board
:7. Disclosure of interest
:8. Establishment of committees
:9. Allowances
:10. Ministerial directives

''Administration''
:11. Appointment of Executive Director
:12. Functions of the Executive Director
:13. Appointment of other staff

''Finances of the Commission''
:14. Funds of the Commission
:15. Accounts and audit
:16. Annual report and other reports

''Application of principles of data protection''
:17. Privacy of the individual
:18. Processing of personal data
:19. Minimality
:20. Consent, justification and objection
:21. Collection of personal data
:22. Collection of data for specific purpose
:23. Data subject to be made aware of purpose of collection
:24. Retention of records
:25. Further processing to be compatible with purpose of collection
:26. Quality of information
:27. Registration of data controller
:28. Security measures
:29. Data processed by data processor or an authorised person
:30. Data processor to comply with security measures
:31. Notification of security compromises
:32. Access to personal information
:33. Correction of personal data
:34. Manner of access

''Rights of data subjects and others''
:35. Right of access to personal data
:36. Credit bureau as data controller

''Processing of special personal data''
:37. Processing of special personal data prohibited
:38. Exemption related to religious or philosophical beliefs of data subject
:39. Right to prevent processing of personal data
:40. Right to prevent processing of personal data for direct marketing
:41. Rights in relation to automated decision-taking
:42. Rights in relation to exempt manual data
:43. Compensation for failure to comply
:44. Rectification, blocking, erasure and destruction of personal data
:45. Application of the Act

''Data Protection Register''
:46. Establishment of Data Protection Register
:47. Application for registration
:48. Right to refuse registration
:49. Grant of registration
:50. Renewal of registration
:51. Removal from Register
:52. Cancellation of registration
:53. Processing of personal data without registration prohibited
:54. Access by the public
:55. Duty to notify changes
:56. Failure to register
:57. Assessable processing
:58. Appointment of data protection supervisors
:59. Fees

''Exemptions''
:60. National security
:61. Crime and taxation
:62. Health, education and social work
:63. Regulatory activity
:64. Journalism, literature and art
:65. Research, history and statistics
:66. Disclosure required by law or made in connection with a legal proceeding
:67. Domestic purposes
:68. Confidential references given by data controller
:69. Armed Forces
:70. Judicial appointments and honours
:71. Public service or ministerial appointment
:72. Examination marks
:73. Examination scripts
:74. Professional privilege

''Enforcement''
:75. Enforcement notice
:76. Cancellation of enforcement notice
:77. Request for assessment
:78. Determination by the Commission
:79. Restriction on enforcement in case of processing for special purposes
:80. Failure to comply with notice
:81. Authorised officers

''Records obtained under data subject’s right of access''
:82. Conditional request for personal data prohibited
:83. Demand for health records

''Information provided to Commission''
:84. Disclosure of information
:85. Confidentiality of information

''Miscellaneous and general provisions''
:86. General duties of the Commission
:87. International co-operation
:88. Prohibition to purchase, obtain or disclose personal data
:89. Prohibition of sale of personal data
:90. Credit bureau
:91. Application to the State
:92. Transmission of notices by electronic or other means
:93. Service of notices by the Commission
:94. Regulations
:95. General penalties
:96. Interpretation
:97. Transitional provisions
:98. Repeal and savings
:99. Commencement

SCHEDULE

==LONG TITLE==
AN ACT to establish a Data Protection Commission, to protect the privacy of the individual and personal data by regulating the processing of personal information, to provide the process to obtain, hold, use or disclose personal information and for related matters.

==DATE OF ASSENT==
10th May, 2012

==ACT==

===''Data Protection Commission''===

====1. Establishment of Data Protection Commission====
(1) There is established by this Act a Data Protection Commission.

(2) Where there is hindrance to the acquisition of property, the property may be acquired for the Commission under the State Property and Contracts Act, 1960 (C.A.6) or the State Lands Act, 1962 (Act 125)
and the costs shall be borne by the Commission.


====2. Object of the Commission====
The object of the Commission is to
:(a) protect the privacy of the individual and personal data by regulating the processing of personal information, and
:(b) provide the process to obtain, hold, use or disclose personal information.


====3. Functions of the Commission====
To achieve the object, the Commission shall
:(a) implement and monitor compliance with the provisions of this Act;
:(b) make the administrative arrangements it considers appropriate for the discharge of its duties;
:(c) investigate any complaint under this Act and determine it in the manner the Commission considers fair; and
:(d) keep and maintain the Data Protection Register.


====4. Governing body of the Commission====
(1) The governing body of the Commission is a Board consisting of
:(a) a chairperson;
:(b) one representative from the following:
::(i) National Communications Authority not below the rank of a Director;
::(ii) Commission on Human Rights and Administrative Justice not below the rank of a Deputy Commissioner;
::(iii) Ministry of Communications not below the rank of a Director;
::(iv) National Information Technology Agency not below the rank of a Director;
::(v) Bank of Ghana not below the level of Deputy Governor; and
::(vi) Statistical Service not below the rank of a Director;
:(c) one representative elected by the Industry Forum;
:(d) two other persons nominated by the President at least one of whom is a woman; and
:(e) the Executive Director of the Commission.

(2) The members of the Board shall be appointed by the President in accordance with article 70 of the Constitution.

(3) The Board shall ensure the proper and effective performance of the functions of the Commission.


====5. Tenure of office of members====
(1) A member of the Board shall hold office for a period not exceeding three years and is eligible for re-appointment but a member shall not be appointed for more than two terms.

(2) Subsection (1) does not apply to the Executive Director of the Commission.

(3) A member of the Board may at any time resign from office in writing addressed to the President through the Minister.

(4) A member of the Board, other than the Executive Director who is absent from three consecutive meetings of the Board without sufficient cause ceases to be a member of the Board.

(5) The President may by letter addressed to a member revoke the appointment of that member.

(6) Where a member of the Board is, for a sufficient reason, unable to act as a member, the Minister shall determine whether the inability would result in the declaration of a vacancy.

(7) Where there is a vacancy
:(a) under subsection (3) or (4) or section 7 (2);
:(b) as a result of a declaration under subsection (6); or
:(c) by reason of the death of a member
the Minister shall notify the President of the vacancy and the President shall appoint a person to fill the vacancy.


====6. Meetings of the Board====
(1) The Board shall meet at least once every three months for the despatch of business at the times and in the places determined by the chairperson.

(2) The chairperson shall at the request in writing of not less than one-third of the membership of the Board convene an extra-ordinary meeting of the Board at the place and time determined by the chairperson.

(3) The quorum at a meeting of the Board is seven members of the Board or a greater number determined by the Board in respect of an important matter.

(4) The chairperson shall preside at meetings of the Board and in the absence of the chairperson, a member of the Board elected by the members present from among their number shall preside.

(5) Matters before the Board shall be decided by a majority of the members present and voting and in the event of an equality of votes, the person presiding shall have a casting vote.

(6) The Board may co-opt a person to attend a Board meeting but that person shall not vote on a matter for decision at the meeting.


====7. Disclosure of interest====
(1) A member of the Board who has an interest in a matter for consideration
:(a) shall disclose the nature of the interest and the disclosure shall form part of the record of the consideration of the matter; and
:(b) shall not participate in the deliberations of the Board in respect of that matter.

(2) A member ceases to be a member of the Board if that member has an interest on a matter before the Board and
:(a) fails to disclose that interest; or
:(b) participates in the deliberations of the Board in respect of the matter.


====8. Establishment of committees====
(1) The Board may establish committees consisting of members of the Board or non-members or both to perform a function.

(2) A committee of the Board may be chaired by a member of the Board.

(3) Section 7 applies to members of committees of the Board.


====9. Allowances====
Members of the Board and members of a committee of the Board shall be paid the allowances approved by the Minister in consultation with the Minister responsible for Finance.


====10. Ministerial directives====
The Minister may give directives to the Board on matters of policy.


===''Administration''===

====11. Appointment of Executive Director====
(1) The President shall, in accordance with article 195 of the Constitution, appoint an Executive Director for the Commission.

(2) The Executive Director shall hold office on the terms and conditions specified in the letter of appointment.

(3) The Executive Director shall be a person of high moral character and integrity with the relevant qualifications and experience related to the functions of the Commission.


====12. Functions of the Executive Director====
(1) The Executive Director is responsible for
:(a) the day to day administration of the affairs of the Commission and is answerable to the Board in the performance of functions under this Act, and
:(b) the implementation of the decisions of the Board.

(2) The Executive Director shall perform any other functions determined by the Board.

(3) The Executive Director may delegate a function to an officer of the Commission but shall not be relieved of the ultimate responsibility for the performance of the delegated function.


====13. Appointment of other staff====
(1) The President shall in accordance with article 195 of the Constitution appoint for the Commission other staff that are necessary for the proper and effective performance of its functions.

(2) Other public officers may be transferred or seconded to the Commission or may otherwise give assistance to it.

(3) The Commission may engage the services of advisers and consultants on the recommendation of the Board.


===''Finances of the Commission''===

====14. Funds of the Commission====
The funds of the Commission include
:(a) moneys approved by Parliament;
:(b) donations and grants to the Commission for its activities under this Act;
:(c) moneys that accrue to the Commission in the performance of its functions; and
:(d) any other moneys that are approved by the Minister responsible for Finance.


====15. Accounts and audit====
(1) The Board shall keep books of accounts and proper records in relation to them in the form approved by the Auditor-General.

(2) The Board shall submit the accounts of the Commission to the Auditor-General for audit within three months after the end of the financial year.

(3) The Auditor-General shall, not later than three months after the receipt of the accounts, audit the accounts and forward a copy of the audit report to the Minister.


====16. Annual report and other reports====
(1) The Board shall within one month after the receipt of the audit report, submit an annual report to the Minister covering the activities and the operations of the Commission for the year to which the report relates.

(2) The annual report shall include the report of the Auditor-General.

(3) The Minister shall, within one month after the receipt of the annual report, submit the report to Parliament with a statement that the Minister considers necessary.

(4) The Board shall also submit to the Minister any other reports which the Minister may require in writing.


===''Application of data protection principles''===

====17. Privacy of the individual====
A person who processes data shall take into account the privacy of the individual by applying the following principles:
:(a) accountability,
:(b) lawfulness of processing,
:(c) specification of purpose,
:(d) compatibility of further processing with purpose of collection,
:(e) quality of information,
:(f) openness,
:(g) data security safeguards, and
:(h) data subject participation.


====18. Processing of personal data====
(1) A person who processes personal data shall ensure that the personal data is processed
:(a) without infringing the privacy rights of the data subject;
:(b) in a lawful manner; and
:(c) in a reasonable manner.

(2) A data controller or processor shall in respect of foreign data subjects ensure that personal data is processed in compliance with data protection legislation of the foreign jurisdiction of that subject where personal data originating from that jurisdiction is sent to this country for processing.


====19. Minimality====
Personal data may only be processed if the purpose for which it is to be processed, is necessary, relevant and not excessive.


====20. Consent, justification and objection====
(1) A person shall not process personal data without the prior consent of the data subject unless the purpose for which the personal data is processed is
:(a) necessary for the purpose of a contract to which the data subject is a party;
:(b) authorised or required by law;
:(c) to protect a legitimate interest of the data subject;
:(d) necessary for the proper performance of a statutory duty; or
:(e) necessary to pursue the legitimate interest of the data controller or a third party to whom the data is supplied.

(2) Unless otherwise provided by law, a data subject may object to the processing of personal data.

(3) Where a data subject objects to the processing of personal data, the person who processes the personal data shall stop the processing of the personal data.


====21. Collection of personal data====
(1) A person shall collect personal data directly from the data subject.

(2) Despite subsection (1), personal data may be collected indirectly where:
:(a) the data is contained in a public record;
:(b) the data subject has deliberately made the data public;
:(c) the data subject has consented to the collection of the information from another source;
:(d) the collection of the data from another source is not likely to prejudice a legitimate interest of the data subject;
:(e) the collection of the data from another source is necessary:
::(i) for the prevention, detection, investigation, prosecution or punishment of an offence or breach of law;
::(ii) for the enforcement of a law which imposes a pecuniary penalty;
::(iii) for the enforcement of a law which concerns revenue collection;
::(iv) for the conduct of proceedings before any court or tribunal that have commenced or are reasonably contemplated;
::(v) for the protection of national security; or
::(vi) for the protection of the interests of a responsible or third party to whom the information is supplied;
:(f) compliance would prejudice a lawful purpose for the collection; or
:(g) compliance is not reasonably practicable.


====22. Collection of data for specific purpose====
A data controller who collects personal data shall collect the data for a purpose which is specific, explicitly defined and lawful and is related to the functions or activity of the person.


====23. Data subject to be made aware of purpose of collection====
A data controller who collects data shall take the necessary steps to ensure that the data subject is aware of the purpose for the collection of the data.


====24. Retention of records====
(1) Subject to subsections (2) and (3), a data controller who records personal data shall not retain the personal data for a period longer than is necessary to achieve the purpose for which the data was collected and processed unless
:(a) the retention of the record is required or authorised by law,
:(b) the retention of the record is reasonably necessary for a lawful purpose related to a function or activity,
:(c) retention of the record is required by virtue of a contract between the parties to the contract, or
:(d) the data subject consents to the retention of the record.

(2) Subsection (1) does not apply to records of personal data retained for
:(a) historical,
:(b) statistical, or
:(c) research purposes.

(3) A person who retains records for historical, statistical or research purposes shall ensure that the records that contain the personal data are adequately protected against access or use for unauthorised purposes.

(4) A person who uses a record of the personal data of a data subject to make a decision about the data subject shall
:(a) retain the record for a period required or prescribed by law or a code of conduct, or
:(b) where there is no law or code of conduct that provides for the retention period, retain the record for a period which will afford the data subject an opportunity to request access to the record.

(5) A data controller shall destroy or delete a record of personal data or de-identify the record at the expiry of the retention period.

(6) The destruction or deletion of a record of personal data shall be done in a manner that prevents its reconstruction in an intelligible form.


====25. Further processing to be compatible with purpose of collection====
(1) Where a data controller holds personal data collected in connection with a specific purpose, further processing of the personal data shall be for that specific purpose.

(2) A person who processes data shall take into account
:(a) the relationship between the purpose of the intended further processing and the purpose for which the data was collected,
:(b) the nature of the data concerned,
:(c) the manner in which the data has been collected,
:(d) the consequences that the further processing is likely to have for the data subject, and
:(e) the contractual rights and obligations between the data subject and the person who processes the data.

(3) The further processing of data is considered to be compatible with the purpose of collection where
:(a) the data subject consents to the further processing of the information,
:(b) the data is publicly available or has been made public by the person concerned,
:(c) further processing is necessary
::(i) for the prevention, detection, investigation, prosecution or punishment for an offence or breach of law,
::(ii) for the enforcement of a law which imposes a pecuniary penalty,
::(iii) for the enforcement of legislation that concerns protection of revenue collection,
::(iv) for the conduct of proceedings before any court or tribunal that have commenced or are reasonably contemplated, or
::(v) for the protection of national security;
:(d) the further processing of the data is necessary to prevent or mitigate a serious and imminent threat to
::(i) public health or safety, or
::(ii) the life or health of the data subject or another individual;
:(e) the data is used for historical, statistical or research purposes and the person responsible for the processing ensures that
::(i) the further processing is carried out solely for the purpose for which the data was collected, and
::(ii) the data is not published in a form likely to reveal the identity of the data subject; or
:(f) the further processing of the data is in accordance with this Act.


====26. Quality of information====
A data controller who processes personal data shall ensure that the data is complete, accurate, up to date and not misleading having regard to the purpose for the collection or processing of the personal data.


====27. Registration of data controller====
(1) A data controller who intends to process personal data shall register with the Commission.

(2) A data controller who intends to collect personal data shall ensure that the data subject is aware of
:(a) the nature of the data being collected;
:(b) the name and address of the person responsible for the collection;
:(c) the purpose for which the data is required for collection;
:(d) whether or not the supply of the data by the data subject is discretionary or mandatory;
:(e) the consequences of failure to provide the data;
:(f) the authorised requirement for the collection of the information or the requirement by law for its collection;
:(g) the recipients of the data;
:(h) the nature or category of the data; and
:(i) the existence of the right of access to and the right to request rectification of the data collected before the collection.

(3) Where the data is collected from a third party, the data subject shall be given the information specified in subsection (2) before the collection of the data or as soon as practicable after the collection of the data.

(4) Subsection (2), shall not apply in the following situations where it is necessary:
:(a) to avoid the compromise of the law enforcement power of a public body responsible for the prevention, detection, investigation, prosecution or punishment of an offence;
:(b) for the enforcement of a law which imposes a pecuniary penalty;
:(c) for the enforcement of legislation which concerns revenue collection;
:(d) for the preparation or conduct of proceedings before a court or tribunal that have been commenced or are reasonably contemplated;
:(e) for the protection of national security;
:(f) to avoid the prejudice of a lawful purpose;
:(g) to ensure that the data cannot be used in a form in which the data subject is identified; or
:(h) because the data is to be used for historical, statistical or research purposes.


====28. Security measures====
(1) A data controller shall take the necessary steps to secure the integrity of personal data in the possession or control of a person through the adoption of appropriate, reasonable, technical and organisational measures to prevent
:(a) loss of, damage to, or unauthorised destruction; and
:(b) unlawful access to or unauthorised processing of personal data.

(2) To give effect to subsection (1), the data controller shall take reasonable measures to
:(a) identify reasonably foreseeable internal and external risks to personal data under that person’s possession or control;
:(b) establish and maintain appropriate safeguards against the identified risks;
:(c) regularly verify that the safeguards are effectively implemented; and
:(d) ensure that the safeguards are continually updated in response to new risks or deficiencies.

(3) A data controller shall observe
:(a) generally accepted information security practices and procedure, and
:(b) specific industry or professional rules and regulations.


====29. Data processed by data processor or an authorised person====
(1) A data processor or a person who processes personal data on behalf of a data controller shall
:(a) process the data only with the prior knowledge or authorisation of the data controller, and
:(b) treat the personal data which comes to the knowledge of the data processor or the other person as confidential.

(2) A data processor or a person who processes personal data on behalf of a data controller shall not disclose the data unless
:(a) required by law, or
:(b) in the course of the discharge of a duty.


====30. Data processor to comply with security measures====
(1) A data controller shall ensure that a data processor who processes personal data for the data controller, establishes and complies with the security measures specified under this Act.

(2) The processing of personal data for a data controller by a data processor shall be governed by a written contract.

(3) A contract between a data controller and a data processor shall require the data processor to establish and maintain the confidentiality and security measures necessary to ensure the integrity of the personal data.

(4) Where a data processor is not domiciled in this country, the data controller shall ensure that the data processor complies with the relevant laws of this country.


====31. Notification of security compromises====
(1) Where there are reasonable grounds to believe that the personal data of a data subject has been accessed or acquired by an unauthorised person, the data controller or a third party who processes data
under the authority of the data controller shall notify the
:(a) Commission, and
:(b) the data subject
of the unauthorised access or acquisition.

(2) The notification shall be made as soon as reasonably practicable after the discovery of the unauthorised access or acquisition of the data.

(3) The data controller shall take steps to ensure the restoration of the integrity of the information system.

(4) The data controller shall delay notification to the data subject where the security agencies or the Commission inform the data controller that notification will impede a criminal investigation.

(5) The notification to a data subject shall be communicated by
:(a) registered mail to the last known residential or postal address of the data subject;
:(b) electronic mail to the last known electronic mail address of the data subject;
:(c) placement in a prominent position on the website of the responsible party;
:(d) publication in the media; or
:(e) any other manner that the Commission may direct.

(6) A notification shall provide sufficient information to allow the data subject to take protective measures against the consequences of unauthorised access or acquisition of the data.

(7) The information shall include, if known to the data controller, the identity of the unauthorised person who may have accessed or acquired the personal data.

(8) Where the Commission has grounds to believe that publicity would protect a data subject who is affected by the unauthorised access or acquisition of data, the Commission may direct the data controller to publicise in the specified manner, the fact of the compromise to the integrity or confidentiality of the personal data.


====32. Access to personal information====
(1) A data subject who provides proof of identity may request a data controller to
:(a) confirm at reasonable cost to the data subject whether or not the data controller holds personal data about that data subject,
:(b) give a description of the personal data which is held by the party including data about the identity of a third party or a category of a third party who has or has had access to the information, and
:(c) correct data held on the data subject by the data controller.

(2) The request shall be made
:(a) within a reasonable time;
:(b) after the payment of the prescribed fee, if any;
:(c) in a reasonable manner and format; and
:(d) in a form that is generally understandable.


====33. Correction of personal data====
(1) A data subject may request a data controller to
:(a) correct or delete personal data about the data subject held by or under the control of the data controller that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully, or
:(b) destroy or delete a record of personal data about the data subject held by the data controller that the data controller no longer has the authorisation to retain.

(2) On receipt of the request, the data controller shall comply with the request or provide the data subject with credible evidence in support of the data.

(3) Where the data controller and the data subject are unable to reach an agreement and if the data subject makes a request, the data controller shall attach to the record an indication that a request for the data has been made but has not been complied with.

(4) Where the data controller complies with the request, the data controller shall inform each person to whom the personal data has been disclosed of the correction made.

(5) The data controller shall notify the data subject of the action taken as a result of the request.


====34. Manner of access====
The provisions of any legislation relating to the right to information of any data subject shall be additional to data subject rights under this Act.


===''Rights of data subjects and others''===

====35. Right of access to personal data====
(1) A data controller shall
:(a) inform an individual who is the data subject of the processing of the individual’s personal data by the data controller or another person on behalf of the data controller;
:(b) give to the data subject, a description of
::(i) the personal data of which that individual is the data subject;
::(ii) the purpose for which the data is being or is to be processed; and
::(iii) the recipient or class of recipients to whom the data may be disclosed;
:(c) communicate in an intelligible form to the data subject
::(i) information which constitutes personal data of which that individual is the subject;
::(ii) information which is available to the data controller as to the source of the data; and
:(d) inform the individual who is the data subject of the logic or rationale behind the decision that was made based on the processing where the processing constitutes the sole basis for the taking of a
decision which significantly affects that individual.

(2) Where the data constitutes a trade secret, the provision of data related to the logic or rationale involved in any decision taken does not apply.

(3) A data controller shall not comply with a request under subsection (1) unless the data controller is supplied with the data that the data controller may reasonably require to identify the person making the request and to locate the data which that person seeks.

(4) Where a data controller is unable to comply with the request without disclosing data related to another individual who may be identified from the information, the data controller shall not comply with the request unless
:(a) the other individual consents to the disclosure of the data to the person who makes the request, or
:(b) it is reasonable in all the circumstances to comply with the request without the consent of the other individual.

(5) A reference to data related to another individual in subsection (4) includes a reference to data which identifies that individual as the source of the data requested.

(6) A data controller shall not rely on subsection (4)(b) to fail to communicate the information sought that may be communicated without the disclosure of the identity of the individual concerned.

(7) The data controller may make the communication under subsection (6) by omitting or deleting the names or other identifying particulars of the other individual.

(8) For the purposes of subsection (4)(b), to determine whether it is reasonable to comply with the request without the consent of the other individual concerned, regard shall be had in particular, to
:(a) any duty of confidentiality owed to the other individual,
:(b) any steps taken by the data controller to seek the consent of that other individual,
:(c) whether the other individual is capable of giving consent, and
:(d) any express refusal of consent by the other individual.

(9) An individual who makes a request under this section may specify that the request is limited to personal data of any description.

(10) Subject to subsection (5), a data controller shall comply with a request under this section promptly and in any event within forty days from the date of receipt of the request.

(11) Where the commission is satisfied on the application or a complainant in relation to matters under subsections (1) to (10) that the data controller has failed to comply with the request, the Commission may order the data controller to comply with the request.

(12) The obligation imposed on a data controller to provide the data subject with information under section 20 to 26 is fulfilled by supplying the data subject with a copy of the data in permanent form.

(13) Where a data controller has previously complied with a request by a data subject, the data controller shall not comply with a subsequent request which is identical or similar unless a reasonable interval has elapsed between the time of compliance with the previous request and the making of the new request.

(14) For the purposes of subsection (13), to determine whether a request for data by a data subject to a data controller has been made at a reasonable interval, regard shall be had to
:(a) the nature of the data,
:(b) the purpose for which the data is processed, and
:(c) the frequency with which the data is altered.

(15) The data which is supplied pursuant to a request may take into account an amendment or deletion made between the time of the request and the time when the data is supplied.

(16) For the purposes of this section another individual may be identified from the data disclosed if that individual can be identified
:(a) from that data, or
:(b) from that data and any other data which in the reasonable belief of the data controller are likely to be in, or come into the possession of the data subject who made the request.


====36. Credit bureau as data controller====
(1) Where the data controller is a credit bureau within the meaning of the Credit Reporting Act, 2007 (Act 726) a request for information by a data subject shall in addition to the requirements specified under the Credit Reporting Act, be subject to this section.

(2) A data subject who makes a request for information from a data controller may limit the request to personal data relevant to the data subject’s
:(a) financial standing,
:(b) history for the period which precedes twelve months after the date of the request,
and shall be considered to have limited the request of the data subject unless the request shows a contrary intention.

(3) An individual shall not request information which is held beyond the retention period specified in section 30 of the Credit Reporting Act, 2007 (Act726) unless the credit bureau has provided the information to third parties beyond the retention period.

(4) Where a data controller receives a request from a data subject under this section, the obligation to supply information shall include an obligation to provide the data subject with a statement in a form provided by Regulations which deal with the rights of a data subject
:(a) under the Credit Reporting Act, 2007 (Act 726);
:(b) to seek legal redress against a credit bureau set out under the Credit Reporting Act, 2007 (Act 726); and
:(c) to enable a credit bureau which acts as a data controller or processor to acknowledge its obligations to comply with this Act.


===''Processing of special personal data''===

====37. Processing of special personal data prohibited====
(1) Unless otherwise provided by this Act, a person shall not process personal data which relates to
:(a) a child who is under parental control in accordance with the law, or
:(b) the religious or philosophical beliefs, ethnic origin, race, trade union membership, political opinions, health, sexual life or criminal behaviour of an individual.

(2) A data controller may process special personal data in accordance with this Act where
:(a) processing is necessary, or
:(b) the data subject consents to the processing.

(3) The processing of special personal data is necessary where it is for the exercise or performance of a right or an obligation conferred or imposed by law on an employer.

(4) Special personal data shall not be processed unless the processing is necessary for the protection of the vital interests of the data subject where
:(a) it is impossible for consent to be given by or on behalf of the data subject,
:(b) the data controller cannot reasonably be expected to obtain the consent of the data subject, or
:(c) consent by or on behalf of the data subject has been unreasonably withheld.

(5) Special personal data shall not be processed unless the processing is carried out for the protection of the legitimate activities of a body or association which
:(a) is established for non-profit purposes,
:(b) exists for political, philosophical, religious or trade union purposes;
:(c) relates to individuals who are members of the body or association or have regular contact with the body or association in connection with its purposes, and
:(d) does not involve disclosure of the personal data to a third party without the consent of the data subject.

(6) The processing of special personal data shall be presumed to be necessary where it is required
:(a) for the purpose of or in connection with a legal proceeding,
:(b) to obtain legal advice,
:(c) for the establishment, exercise or defence of legal rights,
:(d) in the course of the administration of justice, or
:(e) for medical purposes and the processing is
::(i) undertaken by a health professional, and
::(ii) pursuant to a duty of confidentiality between patient and health professional.

(7) In this section, “medical purposes” includes the purposes of preventive medicine, medical diagnosis, medical research, provision of care and treatment and the management of healthcare services by a medical or dental practitioner or a legally recognised traditional healer.

(8) A person shall not process special personal data in respect of race or ethnic origin unless the processing of the special personal data is
:(a) necessary for the identification and elimination of discriminatory practices, and
:(b) carried out with appropriate safeguards for the rights and freedoms of the data subject.

(9) The Minister may in consultation with the Commission by legislative instrument prescribe further conditions which may be taken by a data controller for the maintenance of appropriate safeguards for the rights and freedoms of a data subject related to processing of special personal data.


====38. Exemption related to religious or philosophical beliefs of data subject====
(1) The prohibition on processing of personal data which relates to the religious or philosophical beliefs of a data subject does not apply if the processing is carried out by
:(a) a spiritual or religious organisation or a branch of the organisation and the processing is in respect of persons who are members of the organisation,
:(b) an institution founded on religious or philosophical principles and the processing is
::(i) with respect to the members, employees or other persons belonging to the institution,
::(ii) consistent with the objects of the institution, and
::(iii) necessary to achieve the aims and principles of the institution.

(2) An individual who believes that data is being processed under subsection (1) may at any time by notice in writing to a data controller require a data controller to provide particulars of data processed under this exemption.


====39. Right to prevent processing of personal data====
(1) An individual shall at any time by notice in writing to a data controller require the data controller to cease or not begin processing for a specified purpose or in a specified manner, personal data which causes or is likely to cause unwarranted damage or distress to the individual.

(2) A data controller shall within twenty-one days after receipt of a notice inform the individual in writing
:(a) that the data controller has complied or intends to comply with the notice of the data subject, or
:(b) of the reasons for non-compliance.

(3) Where the Commission is satisfied that the complainant is justified, the Commission may order the data controller to comply.


====40. Right to prevent processing of personal data for direct marketing====
(1) A data controller shall not provide, use, obtain, procure or provide information related to a data subject for the purposes of direct marketing without the prior written consent of the data subject.

(2) A data subject is entitled at any time by notice in writing to a data controller to require the data controller not to process personal data of that data subject for the purposes of direct marketing.

(3) Where the Commission is satisfied on a complaint by a person who has given notice in subsection (1), that the data controller has failed to comply with the notice, the Commission may order that data controller to comply with the notice.

(4) In this section “direct marketing” includes the communication by whatever means of any advertising or marketing material which is directed to particular individuals.


====41. Rights in relation to automated decision-taking====
(1) An individual is entitled at any time by notice in writing to a data controller to require the data controller to ensure that any decision taken by or on behalf of the data controller which significantly affects that individual is not based solely on the processing by automatic means of personal data in respect of which that individual is the data subject.

(2) Despite the absence of a notice, where a decision which significantly affects an individual is based solely on that processing
:(a) the data controller shall as soon as reasonably practicable notify the individual that the decision was taken on that basis, and
:(b) the individual is entitled, by notice in writing to require the data controller to reconsider the decision within twenty-one days after receipt of the notification from the data controller.

(3) The data controller shall within twenty-one days after receipt of the notice, inform the individual in writing of the steps that the data controller intends to take to comply with the notice.

(4) This section does not apply to a decision made
:(a) in the course of considering whether to enter into a contract with the data subject,
:(b) with a view to entering into the contract,
:(c) in the course of the performance of the contract,
:(d) for a purpose authorised or required by or under an enactment, or
:(e) in other circumstances prescribed by the Minister.

(5) Where the Commission is satisfied on a complaint by a data subject that a person taking a decision has failed to comply, the Commission may order the data controller to comply.

(6) An order for compliance under subsection (5) shall not affect the rights of a person other than the data subject or the data controller.


====42. Rights in relation to exempt manual data====
(1) A data subject is entitled at any time by notice in writing to require a data controller
:(a) to rectify, block, erase or destroy exempt manual data which is inaccurate or incomplete, or
:(b) to cease to hold exempt manual data in a manner which is incompatible with the legitimate purposes pursued by the data controller.

(2) A notice under subsection (1) shall state the reasons for believing that the data
:(a) is inaccurate or incomplete, or
:(b) is held in a manner which is incompatible with the legitimate purposes pursued by that data controller.

(3) Where the Commission is satisfied on a complaint by a person who has given notice that the data controller has failed to comply with the notice, the Commission shall give appropriate direction to the data controller to comply with the notice.

(4) For the purposes of this section, personal data is incomplete if the data is of the kind that its incompleteness would constitute a contravention of data protection principles provided in this Act.


====43. Compensation for failure to comply====
(1) Where an individual suffers damage or distress through the contravention by a data controller of the requirements of this Act, that individual is entitled to compensation from the data controller for the damage or distress.

(2) In proceedings against a person under this section, it is a defence to prove that the person took reasonable care in all the circumstances to comply with the requirements of this Act.


====44. Rectification, blocking, erasure and destruction of personal data====
(1) Where the Commission is satisfied on a complaint of a data subject that personal data on that data subject is inaccurate, the Commission may order the data controller to
:(a) rectify,
:(b) block,
:(c) erase, or
:(d) destroy the data.

(2) Subsection (1) applies whether or not the data is an accurate record of information received or obtained by the data controller from the data subject or a third party.

(3) Where the data is an accurate record of the information, the Commission may make an order requiring the data controller to supplement the statement of the true facts which the Commission considers appropriate.

(4) Where the data complained of has been rectified, blocked supplemented, erased or destroyed, the data controller is required to notify third parties to whom the data has been previously disclosed of
the rectification, blocking, supplementation, erasure or destruction.

(5) To determine whether it is reasonably practicable to require the notification, the Commission shall have regard, in particular, to the number of persons to be notified.


====45. Application of the Act====
(1) Except as otherwise provided, this Act applies to a data controller in respect of data where
:(a) the data controller is established in this country and the data is processed in this country,
:(b) the data controller is not established in this country but uses equipment or a data processor carrying on business in this country to process the data, or
:(c) processing is in respect of information which originates partly or wholly from this country.

(2) A data controller who is not incorporated in this country shall register as an external company.

(3) For the purposes of this Act the following are to be treated as established in this country:
:(a) an individual who is ordinarily resident in this country;
:(b) a body incorporated under the laws of this country;
:(c) a partnership, persons registered under the Registration of Business Names Act, 1962 (Act 151) and the Trustees (Incorporation) Act, 1962 (Act 106);
:(d) an unincorporated joint venture or association operating in part or in whole in this country; and
:(e) any person who does not fall within paragraphs (a),(b), (c) or (d) but maintains an office, branch or agency through which business activities are carried out in this country.

(4) This Act does not apply to data which originates externally and merely transits through this country.



===''Data Protection Register''===

====46. Establishment of Data Protection Register====
(1) There is established by this Act a register of data controllers to be known as the Data Protection Register.

(2) The Commission shall keep and maintain the Register.

(3) A data controller shall register with the Commission.


====47. Application for registration====
(1) An application for registration as a data controller shall be made in writing to the Commission and the applicant shall furnish the following particulars:
:(a) the business name and address of the applicant;
:(b) the name and address of the company’s representative where the company is an external company;
:(c) a description of the personal data to be processed and the category of persons whose personal data are to be collected;
:(d) an indication as to whether the applicant holds or is likely to hold special personal data;
:(e) a description of the purpose for which the personal data is being or is to be processed;
:(f) a description of a recipient to whom the applicant intends to disclose the personal data;
:(g) the name or description of the country to which the applicant may transfer the data;
:(h) the class of persons or where practicable the names of persons whose personal data is held by the applicant;
:(i) a general description of measures to be taken to secure the data; and
:(j) any other information that the Commission may require.

(2) An applicant who knowingly supplies false information in support of an application for registration as a data controller commits an offence and is liable on summary conviction to a fine of not more than one hundred and fifty penalty units or a term of imprisonment of not more than one year or to both.

(3) Where a data controller intends to keep personal data for two or more purposes the Commission shall make separate entries for each purpose in the Register.


====48. Right to refuse registration====
(1) The Commission shall not grant an application for registration under this Act where
:(a) the particulars provided for inclusion in an entry in the Register are insufficient;
:(b) the appropriate safeguards for the protection of the privacy of the data subject have not been provided by the data controller; and
:(c) in the opinion of the Commission, the person making the application for registration does not merit the grant of the registration.

(2) Where the Commission refuses an application for registration as a data controller, the Commission shall inform the applicant in writing within fourteen days
:(a) of its decision and the reasons for the refusal, and
:(b) the applicant may apply for judicial review to the High Court against the refusal.
(3) A refusal of an application for registration is not a bar to reapplication.


====49. Grant of registration====
(1) The Commission shall
:(a) register an applicant if it is satisfied that the applicant has satisfied the conditions required for registration, and
:(b) provide the applicant with a certification of registration upon approval of the application.

(2) The applicant shall pay the prescribed fee upon registration.


====50. Renewal of registration====
A registration shall be renewed every two years.


====51. Removal from Register====
The Commission may at the request of the person to whom an entry in the Register relates, remove that person’s name from the Register at any time.


====52. Cancellation of registration====
The Commission has the power to cancel a registration for good cause.


====53. Processing of personal data without registration prohibited====
A data controller who has not been registered under this Act shall not process personal data.


====54. Access by the public====
(1) The Commission shall provide facilities to make the information contained in the Register available for inspection by members of the public.

(2) The Commission shall supply a member of the public with a duly certified manual or electronic copy of the particulars contained in an entry made in the Register on payment of the prescribed fee.


====55. Duty to notify changes====
A person in respect of whom an entry as a data controller is included in the Register shall notify the Commission of changes in the registered particulars within fourteen days.


====56. Failure to register====
A person who fails to register as a data controller but processes personal data commits an offence and is liable on summary conviction to a fine of not more than two hundred and fifty penalty units or a term of imprisonment of not more than two years or to both.


====57. Assessable processing====
(1) The Minister may by Executive Instrument specify actions which constitute assessable processing if the Minister considers the assessable processing likely to
:(a) cause substantial damage or substantial distress to a data subject, or
:(b) otherwise significantly prejudice the privacy rights of a data subject;

(2) On receipt of an application for registration, the Commission shall consider
:(a) whether the processing to which the notification relates is assessable, or
:(b) if the assessable processing complies with the provisions of this Act.

(3) The Commission shall within twenty-eight days from the day of receipt of the application, inform the data controller whether the processing is likely to comply with the provisions of this Act.

(4) The Commission may extend the initial period by a further period which does not exceed fourteen days or other period that the Commission may specify.

(5) The assessable processing in respect of which a notification has been given to the Commission shall not be carried on unless
:(a) the period of twenty-eight days has elapsed, or
:(b) before the end of that period, the data controller receives a notice from the Commission under subsection (3).

(6) A data controller who contravenes this section commits an offence and is liable on summary conviction to a fine of not more than two hundred and fifty penalty units or to a term of imprisonment of not more than two years or to both.


====58. Appointment of data protection supervisors====
(1) A data controller may appoint a certified and qualified data supervisor to act as a data protection supervisor.

(2) The data protection supervisor is responsible for the monitoring of the data controller’s compliance with the provisions of this Act.

(3) This section is subject to the exemptions or modifications specified in the authorisation.

(4) An authorisation under this section may
:(a) impose a duty on a data protection supervisor in relation to the Commission, and
:(b) confer a function on the Commission in relation to a data protection supervisor.

(5) A data protection supervisor may be an employee of the data controller.

(6) The Commission shall provide the criteria for qualification to be appointed as a data protection supervisor.

(7) A person shall not be appointed as a data protection supervisor unless the person satisfies the criteria set by the Commission.


====59. Fees====
The Minister may by Regulations prescribe fees for the purpose of sections 49, 50 and 54.


===''Exemptions''===

====60. National security====
(1) The processing of personal data is exempt from the provisions of this Act for the purposes of
:(a) public order,
:(b) public safety,
:(c) public morality,
:(d) national security, or
:(e) public interest.

(2) Subject to article 18 (2) of the Constitution, a certificate signed by the Minister is prima facie evidence of exemption from the provisions of this Act.

(3) A certificate may by means of a general description identify the personal data to which it applies.

(4) A person who is directly affected by the issue of a certificate under this section may apply for judicial review at the High Court.


====61. Crime and taxation====
(1) The processing of personal data is exempt from the provisions of this Act for the purposes of
:(a) the prevention or detection of crime,
:(b) the apprehension or prosecution of an offender, or
:(c) the assessment or collection of a tax or duty or of an imposition of a similar nature.

(2) Personal data is exempt from the non-disclosure provisions in any case in which
:(a) the disclosure is for a purpose mentioned in subsection (1), and
:(b) the application of those provisions in relation to the disclosure is likely to prejudice any of the matters mentioned in that subsection.


====62. Health, education and social work====
Personal data on the following subjects shall not be disclosed except where the disclosure is required by law:
:(a) personal data which relates to the physical, mental health or mental condition of the data subject,
:(b) personal data in respect of which the data controller is an educational institution and which relates to a pupil at the institution, or
:(c) personal data of similar description.


====63. Regulatory activity====
(1) The provisions of this Act do not apply to the processing of personal data for protection of members of the public
:(a) against loss or malpractice in the provision of
::(i) banking,
::(ii) insurance,
::(iii) investment,
::(iv) other financial services, or
::(v) management of a body corporate;
:(b) against dishonesty or malpractice in the provision of professional services;
:(c) against the misconduct or mismanagement in the administration of a non-profit making entity;
:(d) to secure the health, safety and welfare of persons at work; or
:(e) to protect non-working persons against the risk to health or safety arising out of or in connection with the action of persons at work.

(2) The processing of personal data is exempt from the subject information provisions of this Act if it is for the discharge of a function conferred by or under an enactment on
:(a) Parliament,
:(b) a local government authority,
:(c) the administration of public health or public financing of health care, prevention, control of disease and the monitoring and eradication of disease .


====64. Journalism, literature and art====
(1) A person shall not process personal data unless
:(a) the processing is undertaken by a person for the publication of a literary or artistic material;
:(b) the data controller reasonably believes that publication would be in the public interest; and
:(c) the data controller reasonably believes that, in all the circumstances, compliance with the provision is incompatible with the special purposes.

(2) Subsection (1) does not exempt a data controller from compliance with the data principles related to
:(a) lawful processing,
:(b) minimality,
:(c) further processing,
:(d) information quality, and
:(e) security safeguards.

(3) For the purposes of subsection (1) (b), in considering whether the data controller believes that the publication would be in the public interest or is reasonable, regard may be had to the compliance by the data controller with any code of practice which is
:(a) relevant to the publication in question, and
:(b) designated by the Minister for purposes of this subsection.


====65. Research, history and statistics====
(1) The further processing of personal data for a research purpose in compliance with the relevant conditions is not to be regarded as incompatible with the purposes for which the data was obtained.

(2) Personal data which is processed for research purposes in compliance with the relevant conditions may be kept indefinitely.

(3) Personal data which is processed only for research purposes is exempt from the provisions of this Act if
:(a) the data is processed in compliance with the relevant conditions, and
:(b) the results of the research or resulting statistics are not made available in a form which identifies the data subject or any of them.

(4) Personal data is not to be treated as processed otherwise than for research purposes merely because the data is disclosed
:(a) to any person for research purposes only,
:(b) to the data subject or a person acting on behalf of the data subject,
:(c) at the request or with the consent of the data subject or a person acting on behalf of the data subject ,or
:(d) in circumstances in which the person making the disclosure has reasonable grounds to believe that the disclosure falls within this section.


====66. Disclosure required by law or made in connection with a legal proceeding====
Personal data is exempt from the provisions on non-disclosure where the disclosure is required by or under an enactment, any rule of law or by the order of a court.


====67. Domestic purposes====
Personal data which is processed by an individual only for the purpose of that individual’s personal, family or household affairs is exempt from the data protection principles.


====68. Confidential references given by data controller====
Personal data is exempt from the data protection principles if it consists of a reference given in confidence by the data controller for the purposes of
:(a) education, training or employment of the data subject,
:(b) the appointment to an office of the data subject, or
:(c) the provision of any service by the data subject.


====69. Armed Forces====
Personal data is exempt from the subject information provisions where the application of the provisions is likely to prejudice the combat effectiveness of the Armed Forces of the Republic.


====70. Judicial appointments and honours====
Personal data processed to
:(a) assess a person’s suitability for judicial office, or
:(b) confer a national honour,
is exempt from the subject information provisions of this Act.


====71. Public service or ministerial appointment====
The Minister may by legislative instrument make Regulations to prescribe exemptions from the subject information provisions of personal data processed to assess a person’s suitability for
:(a) employment by the government, or
:(b) any office to which appointments are made by the President.


====72. Examination marks====
Personal data is exempt from the provisions of this Act if it relates to examination marks processed by a data controller
:(a) to determine the results of an academic, professional or other examination or to enable the results of the examination to be determined, or
:(b) in consequence of the determination of the results.


====73. Examination scripts====
Personal data which consists of information recorded by candidates during an academic, professional or other examination is exempt from the provisions of this Act.


====74. Professional privilege====
Personal data is exempt from the subject information provisions if it consists of information in respect of which a claim to professional privilege or confidentiality between client and a professional adviser could be maintained in legal proceedings.


===''Enforcement''===

====75. Enforcement notice====
(1) Where the Commission is satisfied that a data controller has contravened or is contravening any of the data protection principles, the Commission shall serve the data controller with an enforcement notice to require that data controller to do any of the following:
:(a) to take or refrain from taking the steps specified within the time stated in the notice,
:(b) to refrain from processing any personal data or personal data of a description specified in the notice; or
:(c) to refrain from processing personal data or personal data of a description specified in the notice for the purposes specified or in the manner specified after the time specified.

(2) In deciding whether to serve an enforcement notice, the Commission shall consider whether the contravention has caused or is likely to cause damage or distress to any person.

(3) An enforcement notice issued in respect of a contravention of a provision of this Act may also require the data controller to rectify, block, erase or destroy other data held by the data controller and which contains an expression of opinion which appears to the Commission to be based on the inaccurate data.

(4) Where
:(a) an enforcement notice requires the data controller to rectify, block, erase or destroy personal data, or
:(b) the Commission is satisfied that personal data which has been rectified, blocked, erased or destroyed was processed in contravention of any of the data protection principles, the Commission may require the data controller to notify a third party to whom the data has been disclosed of the rectification, blocking, erasure or destruction.

(5) An enforcement notice shall contain a statement of the data protection principle which the Commission is satisfied has been contravened and the reasons for that conclusion.

(6) Subject to this section, an enforcement notice shall not require any of the provisions of the notice to be compiled with before the end of the period within which an appeal may be brought against the notice and, if the appeal is brought, the notice may not be complied with pending the determination or withdrawal of the appeal.

(7) Despite subsection (6), the Commission may in exceptional circumstances order that the notice apply immediately.


====76. Cancellation of enforcement notice====
The Commission may on its own motion or on an application made by a person on whom a notice is served, cancel or vary the notice to that person.


====77. Request for assessment====
(1) A person who is affected by the processing of any personal data may on that person’s own behalf or on behalf of another person request the Commission to make an assessment as to whether the processing is in compliance with the provisions of this Act.

(2) On receiving a request, the Commission may make an assessment in the manner that the Commission considers appropriate.

(3) The Commission may consider the following in determining whether an assessment is appropriate:
:(a) the extent to which the request appears to the Commission to raise a matter of substance;
:(b) any undue delay in making the request; and
:(c) whether or not the person making the request is entitled to make an application in respect of the personal data in question.

(4) The Commission shall not publish the report of any finding
:(a) the request is accompanied with the prescribed fee, or
:(b) the Commission waives payment based on proven pecuniary challenges of the applicant.

(5) Where the Commission finds that the processing by a data controller is contrary to the provisions of this Act, the Commission shall issue an information notice to the data controller specifying the contravention, and give the data controller notice to cease processing personal data.


====78. Determination by the Commission====
(1) Where at any time it appears to the Commission that personal data
:(a) is being processed in a manner inconsistent with the provisions of this Act, or
:(b) is not being processed with a view to the publication by a person of a journalistic, literary or artistic material which has not previously been published by the data controller,
the Commission may make a determination in writing to that effect.

(2) The Commission shall give a notice of the determination to the data controller.


====79. Restriction on enforcement in case of processing for special purposes====
(1) The Commission shall not serve an enforcement notice on a data controller in relation to the processing of personal data under section 78 (1) (a) unless a determination has been made by the Commission.

(2) The Commission shall not serve an information notice on a data controller in relation to the processing of personal data under section (1) (b) unless a determination has been made by the Commission.


====80. Failure to comply with notice====
(1) A person who fails to comply with an enforcement notice or an information notice commits an offence and is liable on summary conviction to a fine of not more than one hundred and fifty penalty units or to a term of imprisonment of not more than one year or to both.

(2) A person who, in compliance with an information notice,
:(a) makes a statement which that person knows to be false in a material respect, or
:(b) recklessly makes a statement which is false in a material respect
commits an offence and is liable on summary conviction to a fine of not more than one hundred and fifty penalty units or to a term of imprisonment of not more than one year or to both.

(3) It is a defence for a person charged with an offence under sub-section (1) to prove that, that person exercised due diligence to comply with the notice in question.


====81. Authorised officers====
(1) The Board may in writing authorise an officer to perform the functions determined by the Board for the purpose of enforcing the provisions of this Act and the Regulations.

(2) Without limiting subsection (1), an officer authorised by the Commission may at any reasonable time, enter to inspect and search any premises to ensure compliance with this Act.


===''Records obtained under data subject’s rights of access''===

====82. Conditional request for personal data prohibited====
(1) A person who provides goods, facilities or services to the public shall not require a person to supply or produce a particular record as a condition for the provision of the goods, facilities or services to that person.

(2) Subsection (1) does not apply where the imposition of the requirement is required or authorised under an enactment, rule of law or in the public interest.

(3) A person who contravenes subsection (1) commits an offence and is liable on summary conviction to a fine of not more than two hundred and fifty penalty units or to a term of imprisonment of not more than two years or to both.


====83. Demand for health records====
A person shall not be required to provide records which
:(a) consist of information related to the physical, mental health or mental condition of an individual, or
:(b) has been made by or on behalf of a health professional in connection with the care of that individual.


===''Information provided to Commission''===

====84. Disclosure of information====
The provisions of an enactment or a rule of law which prohibit or restrict the disclosure of information do not apply to a case where a person furnishes the Commission with information necessary for the performance of the functions of the Commission under this Act.


====85. Confidentiality of information====
(1) The Commission, an employee or an agent of the Commission shall not disclose information
:(a) obtained by the Commission under or for the purposes of this Act,
:(b) furnished to the Commission under or for the purposes of this Act,
:(c) which relates to an identifiable individual, and
:(d) which is not at the time of the disclosure and has not previously been available to the public from other sources,
unless the disclosure is made with lawful authority.

(2) A disclosure is made with lawful authority where the disclosure
:(a) is made with the consent of the individual or the person for the time being carrying on the business,
:(b) was made for the purpose of its being made available to the public under the provisions of this Act,
:(c) is made for the purposes of, and is necessary for, the performance of a function under this Act,
:(d) is made for the purposes of any civil or criminal proceedings, which arise under or by virtue of this Act or otherwise, or
:(e) having regard to the rights, freedoms or legitimate interests of a person,
the disclosure is necessary in the public interest.

(3) A person who knowingly or recklessly discloses information in contravention of subsection (1) commits an offence and is liable on summary conviction to a fine of not more than two thousand five hundred penalty units or to a term of imprisonment of not more than five years or to both.


===''Miscellaneous and general provisions''===


====86. General duties of the Commission====
(1) The Commission shall provide guidelines and promote the observance of good practice to ensure compliance with this Act.

(2) The Commission may charge the fees that the Commission in consultation with the Minister for Finance determines for the provision of services by the Commission.

(3) The Commission is responsible for the conduct of public education and awareness campaigns to the public on the rights of data subjects and the obligations of data controllers under this Act.


====87. International co-operation====
The Commission shall perform the data protection functions that are necessary to give effect to any international obligations of the Republic.


====88. Prohibition to purchase, obtain or disclose personal data====
(1) A person shall not
:(a) purchase the personal data or the information contained in the personal data of another person;
:(b) knowingly obtain or knowingly or recklessly disclose the personal data or the information contained in the personal data of another person; or
:(c) disclose or cause to be disclosed to another person the information contained in personal data.

(2) A person who contravenes subsection (1) commits an offence and is liable on summary conviction to a fine of not more than two hundred and fifty penalty units or to a term of imprisonment of not more than two years or to both.


====89. Prohibition of sale of personal data====
(1) A person who sells or offers to sell personal data of another person commits an offence and is liable on summary conviction to a fine of not more than two thousand five hundred penalty units or to a term of imprisonment of not more than five years or to both.

(2) For the purposes of this section an advertisement which indicates that personal data is or may be for sale is an offer to sell the data.


====90. Credit bureau====
(1) A credit bureau shall for the purposes of this Act be a data controller and
:(a) is subject to the orders or directions emanating from the Commission,
:(b) shall exercise the rights under this Act, and
:(c) be liable for any offences committed by the Credit Bureau and its officers under this Act.

(2) A person who suffers damage which arises from the supply of inaccurate or incomplete information by a credit bureau about the person is entitled in addition to the remedies under this Act to such further remedies that are provided under the Credit Reporting Act, 2007 (Act 726).


====91. Application to the State====
(1) This Act binds the Republic.

(2) For the purposes of this Act, each government department shall be treated as a data controller.

(3) Each department shall designate an officer to act as a data supervisor.

(4) Where the purposes and the manner in which the processing of personal data are determined by a person acting on behalf of the Executive, Parliament and the Judiciary, the data controller in respect of that data for the purposes of this Act is
:(a) in relation to the Executive, the Chief Director,
:(b) in relation to Parliament, the Clerk to Parliament, and
:(c) in relation to the Judiciary, the Judicial Secretary.

(5) A different person may be appointed under subsection (4) for a different purpose.


====92. Transmission of notices by electronic or other means====
(1) A requirement that a notice, request, particulars or application to which this Act applies shall be in writing is satisfied where the text of the notice, request, particulars or application
:(a) is transmitted by electronic means in a manner specified by the Commission,
:(b) is received in legible form, and
:(c) is capable of being used for subsequent reference.

(2) The Minister may by Regulations exempt a notice, request, particulars or application from these requirements.


====93. Service of notices by the Commission====
(1) A notice authorised or required by this Act to be served on or given to a person by the Commission may
:(a) if that person is an individual, be served on that individual by delivery to that individual,
::(i) by post addressed to that individual at that individual’s usual or last known place of residence or business,
::(ii) by leaving the notice at that individual’s usual or last known place of residence or business, or
::(iii) by sending it to an electronic mail address specified by the individual for service of notices;
:(b) if that person is a body corporate or unincorporated, be served on that body
::(i) by post to the principal officer of the body at its principal office,
::(ii) by addressing it to the principal officer of the body and leaving it at that office, or
::(iii) by sending it to an electronic mail address specified by the body for service of notices under this Act; and
:(c) if that person is a partnership, be served on that partnership
::(i) by post to the principal office of the partnership,
::(ii) by addressing it to that partnership and leaving it at that office, or
::(iii) by sending it to an electronic mail address specified by that partnership for service of notices under this Act.

(2) This section does not limit any other lawful method of serving or giving a notice.


====94. Regulations====
(1) The Minister may in consultation with the Commission by legislative instrument make Regulations to
:(a) extend the transitional period for a data controller in existence at the commencement of this Act,
:(b) specify the conditions that are to be satisfied for consent to be given,
:(c) prescribe further conditions which may be taken by a data controller for the maintenance of appropriate safeguards, for the rights and freedoms of a data subject related to the processing of special personal data,
:(d) make different provisions for different situations,
:(e) exempt notices, requests, particulars or applications from the requirements under the Act, and
:(f) provide generally for any other matter necessary for the effective implementation of the provisions of this Act.

(2) A person who commits an offence under the Regulations is liable on summary conviction to a fine of not more than five thousand penalty units.


====95. General penalty====
Where a person commits an offence under this Act in respect of which a penalty is not specified, the person is liable on summary conviction to a fine of not more than five thousand penalty units or a term of imprisonment of not more than ten years or to both.


====96. Interpretation====
In this Act unless the context otherwise requires
:'''"assessable processing"''' means processing of a description specified in an Executive Instrument made by the Minister under section 57 (1);
:'''"business"''' includes trade or profession;
:'''"Commission"''' means the Commission established under section 1 of this Act;
:'''"corporate finance service"''' means a service which consists of
::(a) underwriting in respect of the issue or the placing of issues of any instrument;
::(b) advice to undertakings on capital structure, industrial strategy and related matters and advice and service related to mergers and the purchase of an undertaking, or
::(c) services related to the underwriting referred to in paragraphs (a) and (b);
:'''"credit bureau"''' means an institution licensed under the Credit Reporting Act, 2007 (Act 726) to carry out credit bureau activities;
:'''"data"''' means information which
::(a) is processed by means of equipment operating automatically in response to instructions given for that purpose,
::(b) is recorded with the intention that it should be processed by means of such equipment,
::(c) is recorded as part of a relevant filing system or with the intention that it should form part of a relevant filing system, or
::(d) does not fall within paragraph (a),(b) or (c) but forms part of an accessible record;
:'''"data controller"''' means a person who either alone, jointly with other persons or in common with other persons or as a statutory duty determines the purposes for and the manner in which personal data is processed or is to be processed;
:'''"data protection principles"''' means the principles set out in sections 17 to 26 of this Act;
:'''"data processor"''' in relation to personal data means any person other than an employee of the data controller who processes the data on behalf of the data controller;
:'''"data protection functions"''' means functions that relate to the protection of personal data in the course of data processing;
:'''"data subject"''' means an individual who is the subject of personal data;
:'''"enactment"''' includes an enactment passed after the commencement of this Act;
:'''"data supervisor"''' means a professional appointed by a data controller in accordance with section 58 to monitor the compliance by the data controller in accordance with the provisions of the Act;
:'''"examination"''' includes any process for determining the knowledge, intelligence, skill or ability of a candidate by reference to the candidate’s performance in a test, work or other activity;
:'''"exempt manual data"''' means information in respect of which a controller is not required to register before manual processing or use;
:'''"foreign data subject"''' means data subject information regulated by laws of a foreign jurisdiction sent into Ghana from a foreign jurisdiction wholly for processing purposes;
:'''" good cause"''' means any failure to comply with or a violation of any of the data protection principles, enforcement or other notices issued by the Commission;
:'''"good practice"''' means the practice in the processing of personal data in a way that the likelihood of causing substantial damage or distress is reduced;
:'''"government department"''' includes a Ministry, Department or Agency and a body or authority exercising statutory functions on behalf of the State;
:'''"health professional :'''" means a registered medical practitioner or a recognised traditional healer or any person who is registered to provide health services under any law for the time being in force;
:'''"information notice"''' means notice given by the Commission pursuant to a determination under section 78 (1) (b);
:'''"instrument"''' means any instrument related to a publicly traded security;
:'''"Minister"''' means the Minister assigned responsibility for Communications;
:'''"personal data"''' means data about an individual who can be identified,
::(a) from the data, or
::(b) from the data or other information in the possession of, or likely to come into the possession of the data controller;
:'''"prescribed fee"''' means a fee set out in relation to any Regulations on fees made pursuant to this Act;
:'''"principal office"''' in relation to a registered company, means the registered office or other address that the company may specify for the delivery of correspondence;
:'''"principal officer"''' in relation to a body, means the secretary or other executive officer charged with the conduct of the general affairs of the body;
:'''"processing"''' means an operation or activity or set of operations by automatic or other means that concerns data or personal data and the
::(a) collection, organisation, adaptation or alteration of the information or data,
::(b) retrieval, consultation or use of the information or data,
::(c) disclosure of the information or data by transmission, dissemination or other means available, or
::(d) alignment, combination, blocking, erasure or destruction of the information or data;
:'''"public funds"''' has the same meaning assigned to it in Article 175 of the 1992 Constitution;
:'''"public register"''' means a register which pursuant to a requirement imposed
::(a) by or under an enactment, or
::(b) in pursuance of any international agreement is open to
:::(i) inspection by the public, or
:::(ii) inspection by a person who has a legitimate interest;
:'''"publish"''' in relation to journalistic, literary or artistic material means to make available to the public or any class of the public, journalistic, literary or artistic material;
:'''"pupil"''' in relation to a school in this country means a registered person within the meaning of the Education Act, 2008 (Act 778) of any registered school;
:'''"recipient"''' means a person to whom data is disclosed including an employee or agent of the data controller or the data processor to whom data is disclosed in the course of processing the data for the data controller, but does not include a person to whom disclosure is made with respect to a particular inquiry pursuant to an enactment;
:'''"registered company"''' means a company registered under any enactment related to an incorporated or unincorporated entity for the time being in force in the country;
:'''"Regulations"''' means Regulations made under this Act;
:'''"relevant authority"''' means
::(a) a government department,
::(b) local authority, or
::(c) any other statutory authority;
:'''"relevant filing system"''' means any set of data that relates to an individual which although not processed by means of equipment operating automatically in response to instructions given for processing that data, the set is structured, either by reference to an individual or by reference to a criteria that relates to the individual in a manner that specific information which relates to a particular individual is readily accessible;
:'''"relevant function"''' means
::(a) a function conferred on a person by or under an enactment,
::(b) a function of the government, a Minister of State or a government department, or
::(c) any other function which is of a public nature and is exercised in the public interest;
:'''"relevant record"''' means any record that relates to a conviction or caution held by a law enforcement agency or security agency;
:'''"research purposes"''' includes statistical or historical purposes;
:'''"security agency"''' means an agency connected with national security as determined by the National Security Council;
:'''"special personal data"''' means personal data which consists of information that relates to
::(a) the race, colour, ethnic or tribal origin of the data subject;
::(b) the political opinion of the data subject;
::(c) the religious beliefs or other beliefs of a similar nature, of the data subject;
::(d) the physical, medical, mental health or mental condition or DNA of the data subject;
::(e) the sexual orientation of the data subject;
::(f) the commission or alleged commission of an offence by the individual; or
::(g) proceedings for an offence committed or alleged to have been committed by the individual, the disposal of such proceedings or the sentence of any court in the proceedings;
:'''"special purposes"''' means any one or more of the following:
::(a) the purpose of journalism,
::(b) where the purpose is in the public interest,
::(c) artistic purposes, and
::(d) literary purposes;
:'''"subject information provisions"''' means the provisions under this Act which deal with the right of a data subject to access information from a data controller;
:'''"teacher"''' includes a head teacher and the principal of a school to whom disclosure is or may be made as a result of, or with a view to, an inquiry by or on behalf of that person made in the exercise of a power conferred by law;
:'''"the relevant conditions"''' in relation to the processing of personal data, means the conditions
::(a) that the data is not processed to support measures or decisions with respect to particular individuals, and
::(b) that the data is not processed in the way that substantial damage or distress is caused or is likely to be caused to the data subject; and
:'''"third party"''' in relation to personal data, means a person other than
::(a) the data subject,
::(b) the data controller, or
::(c) any data processor or other person authorised to process data for the data controller or processor.


====97. Transitional provisions====
(1) A data controller incorporated or established after the commencement of this Act shall be required to register as a data controller within twenty days of the commencement of business.

(2) A data controller in existence at the commencement of this Act shall be required to register as a data controller within three months after the commencement of this Act.


====98. Repeals and savings====
(1) Sections 44 to 49, 51, 52, 56 and 57 of the National Identity Register Act, 2008 (Act 750) are hereby repealed.

(2) Section 18 (1), (g) and (h) of the National Identification Authority Act, 2006, (Act 707) is hereby repealed.

(3) Sections 34 (1), 38 and 40 of the Credit Reporting Act, 2007 (Act 726) are hereby repealed.

(4) Despite the repeal of
:(a) sections 44 to 49, 51, 52, 56 and 57 of the National Identity Register Act, 2008 (Act 750),
:(b) section 18 (1) (g) and (h) of the National Identification Authority Act, 2006 (Act 707), and
:(c) sections 34 (1), 38 and 40 of the Credit Reporting Act, 2007 (Act 726),
the Regulations, bye-laws, notices, orders, directions, appointments or any other act lawfully made or done under the repealed provisions and in force immediately before the commencement of this Act shall be considered to have been made or done under this Act and shall continue to have effect until reviewed, cancelled or terminated.


====99. Commencement====
The Minister shall specify the date when this Act shall come into force by publication in the Gazette.