Data Protection Commission Warns Against Exposure of Ghanaian Evacuees’ Personal Information
Story by: Regina Bless
The Data Protection Commission (DPC) has expressed serious concern over the public disclosure of personal information belonging to 1,964 Ghanaian citizens evacuated from South Africa, warning that the publication could expose the individuals to privacy violations and other potential risks.
In a press release dated October 20, 2026, the Commission said the disclosed information reportedly included the names, signatures and records of financial assistance received by the evacuees.
The Commission cautioned that publishing identifiable personal information, particularly involving individuals who may have faced threats to their safety, could expose them to identity theft, fraud, unwarranted public scrutiny and other forms of harm.
It cited Article 15(1) of the 1992 Constitution, which protects human dignity, and Article 18(2), which safeguards individual privacy. The Commission also referenced the Data Protection Act, 2012 (Act 843), which establishes requirements for the lawful and responsible processing of personal information.
While acknowledging the importance of transparency, parliamentary oversight, the right to information and press freedom, the Commission stressed that these principles do not automatically justify the unrestricted disclosure of personal data.
It noted that any disclosure by Members of the Minority Caucus, the Ministry of Foreign Affairs, Joy News or other media organisations must be assessed against applicable legal requirements, the purpose of the disclosure and the rights of the individuals concerned.
The Commission further clarified that although the Ministry of Foreign Affairs and Parliament of Ghana are registered data controllers in good standing, registration does not exempt them from their continuing obligations under Act 843.
Consequently, the DPC has urged the Minority Caucus, the Ministry of Foreign Affairs, Joy News and other media houses to exercise due diligence in handling and publishing the records. It also called for the immediate restriction or redaction of publicly accessible personal identifiers whose continued disclosure is not legally justified.
The Commission announced that it would undertake a regulatory review to examine the legal basis for the disclosures, the safeguards applied and the extent to which the privacy rights of the affected individuals have been protected.
It added that where non-compliance is established, appropriate regulatory action would be taken in accordance with the law.
The Commission concluded by reminding public institutions, media organisations and all persons who process personal data that protecting privacy and personal dignity remains a continuing responsibility, even in the pursuit of public accountability.