National Identity Register Act, personal information, user agencies and offences

The National Identity Register Act, 2008 (Act 750) was assented to on 28 January 2008 and notified in the Gazette on 15 February 2008. Section 2 establishes the National Identity Register as an electronic database that the Executive Secretary of the National Identification Authority keeps and maintains. Section 4(3) requires the personal information of a registered individual to include a recorded fingerprint or other biometric information determined by the Board, and a photograph.

Section 75 defines a national identity card as an identity card with a personal identification number issued by the Authority for the identification of the individual to whom it is issued.

Section 75 defines a user agency as including the Social Security and National Insurance Trust, the National Health Insurance Service, the Revenue Agencies Governing Board, the Ghana Immigration Service and any other public or private organisation approved of by the Minister which requires identity data from the Authority.

Section 48(1) permits the Authority to provide a person with personal information from an individual's entry in the Register if that person obtains the prior consent of the individual and makes the application with the authority of that individual. Section 48(3) bars a person provided with personal information under section 48(1) from using it for any other purpose unless one of four listed grounds applies.

Section 50(3) bars a person from making available any record of personal information received by a registration official to an unauthorised person or a person not entitled to receive the information. Section 50(4) makes a contravention of section 50 an offence punishable on summary conviction by a fine of not more than 250 penalty units or imprisonment of not more than two years or both.

Section 53(2) requires a user agency that accesses, uses, retains or discloses personal information from the Authority to comply with the applicable provisions of Part II of the Act and the guidelines the Authority issues.

Section 54(1) requires a user agency that intends to access an individual's personal information from the Authority's database to take reasonable steps to ensure that the individual is aware of the authority for the access, the purpose for which the information is required and the intended recipient.

Section 56 bars a user agency from using personal information obtained from the Authority for any purpose other than the one it was obtained for, unless the individual authorises the use, the use is authorised or required by law, or another ground listed in that section applies.

Section 57(1) bars a user agency from disclosing personal information it holds to any other person unless the individual has consented, the disclosure is required or authorised by law, or another ground listed in that subsection applies. Section 57(2) bars a person to whom personal information is disclosed from disclosing it for a purpose other than the purpose for which it was provided.

Section 58(1) permits a user agency to use or disclose personal information only where the use or disclosure does not invade the privacy of the individual concerned. Section 59 requires a user agency that holds personal information to secure and store it in accordance with the guidelines the Authority issues.

Section 41(1) makes it an offence, punishable on summary conviction by a fine of not more than 450 penalty units or imprisonment of not more than three years or both, to use a national identity card other than the one issued for the person's own use, or to permit another person to use a card issued to someone else, among other listed acts.

Section 41(3) makes it an offence, punishable on summary conviction by a fine of not more than 500 penalty units or imprisonment of not more than four years or both, to take or keep possession without reasonable cause of a national identity card that is false, that the person knows to be improperly obtained, or that belongs to another person.

Section 42 bars a person from using equipment or apparatus to produce a national identity card without the approval of the Authority, or to produce a false card, and makes a contravention punishable on summary conviction by imprisonment of not more than five years.

Section 66(1) makes it an offence, punishable on summary conviction by a fine of not more than 5,000 penalty units or imprisonment of not more than ten years or both, for an unauthorised person to cause a computer or other electronic device of the Authority to perform a function with intent to obtain access to a programme or data it holds, or to attempt to access personal information it holds contrary to the Act.

Section 68 bars a person from communicating to any other person a number, code, password or other means to access personal information contained in a computer of the Authority, other than to a person the first person is duly authorised to communicate it to, and makes a contravention punishable on summary conviction by a fine of not more than 2,500 penalty units or imprisonment of not more than five years or both.

Section 70(1) sets a penalty for an offence under the Act for which no penalty is specified of a fine of not more than 250 penalty units or imprisonment of not more than two years or both.

Section 70(2) makes every director, manager, partner, secretary or officer of a body corporate that commits an offence under the Act liable to the penalty provided for that offence, and section 70(3) excuses a person who proves the offence was committed without that person's consent or connivance and that due diligence was exercised.

Section 73(1)(f) lets the Minister make regulations to provide that every public office should demand the presentation of an identity card as a condition precedent to the provision of its service. Section 73(2) sets the penalty for contravention of regulations made under the Act at a fine of not more than 2,500 penalty units or imprisonment for a term of not more than five years.

The Authority states that section 3 of the National Identity Register (Amendment) Act, 2017 (Act 950) requires an applicant for registration to establish eligibility by providing any one of a birth certificate, a valid passport, a valid certificate of acquired citizenship, or other information the Authority requires.