GhanaData Protection Act, special personal data
Data Protection Act, 2012 (Act 843), ss. 37-38 (special personal data)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://nita.gov.gh/wp-content/uploads/2017/12/Data-Protection-Act-2012-Act-843.pdfIn force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Consent, Biometric
- Audit expectation
- none
What it requires
- Do not process special personal data, including a person's ethnicity, race, political opinion, religious belief, health, sexual life, or criminal behaviour, or the personal data of a child under parental control, unless a listed exception applies.
- Process special personal data only where it is necessary or the data subject consents, treating processing as necessary where it exercises or performs a right or obligation the law imposes on an employer.
- Where consent cannot be given or has been unreasonably withheld, process special personal data only to protect the vital interests of the data subject.
- Do not process special personal data about race or ethnic origin unless it is necessary to identify and eliminate discriminatory practices and is carried out with appropriate safeguards for the data subject's rights and freedoms.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Sections 37 and 38 prohibit processing special personal data except on stated grounds (necessity, consent, vital interests, and the religious or philosophical exemption). They impose no duty to keep a log or record, and the cited sections carry no territorial clause; the application rule is section 45, which this row does not cite.
- Kind
- None
- As of
What this law does
Section 37(1) prohibits processing personal data relating to a child under parental control, or to an individual's religious or philosophical beliefs, ethnic origin, race, trade union membership, political opinions, health, sexual life, or criminal behaviour, unless the Act otherwise provides.
Section 37(2) permits a data controller to process special personal data only where the processing is necessary or the data subject consents, and section 37(3) treats processing as necessary where it exercises or performs a right or obligation the law imposes on an employer. Section 37(4) permits processing without consent only to protect the vital interests of a data subject who cannot give it, cannot reasonably be expected to give it, or has unreasonably withheld it.
Section 37(5) permits processing for the legitimate activities of a non-profit political, philosophical, religious, or trade union body, limited to its own members and never disclosed to a third party without the data subject's consent. Section 37(8) bars processing special personal data about race or ethnic origin unless it is necessary to identify and eliminate discriminatory practices and is carried out with appropriate safeguards for the data subject's rights and freedoms.
Section 38 exempts a spiritual or religious organisation, or an institution founded on religious or philosophical principles, from the prohibition on processing data about religious or philosophical belief where the processing concerns its own members, employees, or persons belonging to it.
When LexLint raises it
When your app profile says your app handles health records, serves under-18s or processes personal data.
Back to the example · Lint your app
Page updated .