Ghana

Section 31(1) requires a data controller, or a third party processing data under its authority, to notify the Data Protection Commission and the affected data subject where there are reasonable grounds to believe personal data has been accessed or acquired by an unauthorised person. Section 31(2) requires that notification to be made as soon as reasonably practicable after discovery of the unauthorised access or acquisition.

Section 31(3) requires the data controller to take steps to restore the integrity of the information system. Section 31(4) lets the data controller delay notifying the data subject where a security agency or the Commission says notification would impede a criminal investigation.

Section 31(5) lets the notification to a data subject be made by registered mail, electronic mail, prominent placement on the responsible party's website, publication in the media, or another manner the Commission directs. Section 31(6) and (7) require the notification to give the data subject enough information to take protective measures, including the identity of the unauthorised person if it is known to the data controller.

Section 31(8) lets the Commission direct the data controller to publicise the compromise where publicity would protect an affected data subject.

The Data Protection Act, 2012 (Act 843) is administered by the Data Protection Commission, an independent statutory body it establishes. A data controller or processor established in Ghana, or using equipment or a processor in Ghana, must have a lawful basis before processing personal data, and section 27 requires it to register with the Commission before processing begins.

Section 27(2) requires a data controller collecting personal data to tell the data subject the nature of the data, the purpose of collection, the recipients, and whether supplying the data is mandatory or discretionary. Sections 28 to 30 require appropriate, reasonable technical and organisational measures to secure personal data against loss, damage, or unlawful access, and require a data processor acting for a data controller to maintain the same measures under a written contract.

Sections 45 to 59 establish the Data Protection Register and govern an application for registration, its refusal, grant, renewal, removal, and cancellation, and section 47(1)(g) requires an applicant to disclose the countries to which it may transfer the data it holds. Sections 60 to 74 exempt processing carried out for national security, crime and taxation, health, education and social work, regulatory activity, journalism, and research, among other listed purposes.

Section 82 bars a person providing goods, facilities, or services to the public from requiring a person to supply a particular record as a condition of that provision, and section 83 bars demanding a record of a person's physical or mental health or condition. The Act binds the Republic itself, treating each government department as a data controller. The Act was gazetted on 18 May 2012. Its commencement was left to a date the Minister specifies by notice in the Gazette. The Act came into force in October 2012.

Section 35 gives a data subject the right to be told the personal data a data controller holds about them, the purpose of processing, the recipients, and the source of the data, communicated in an intelligible form. Section 35(10) requires a data controller to comply with an access request promptly and in any event within forty days of receiving it.

Section 33 gives a data subject the right to have inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or unlawfully obtained personal data corrected or deleted, and requires the data controller to tell every person the data was disclosed to of the correction. Section 39 lets an individual require a data controller to cease or not begin processing personal data that causes or is likely to cause them unwarranted damage or distress.

Section 40 bars a data controller from using a data subject's personal data for direct marketing without their prior written consent, and lets the data subject object to direct marketing at any time. Section 41 gives a data subject the right to demand that a decision significantly affecting them is not based solely on automated processing of their personal data.

Despite the absence of a prior notice, section 41(2) entitles the data subject to require reconsideration of such a decision within twenty-one days after receipt of the notification from the data controller. Section 42 gives a data subject the right to require the rectification, blocking, erasure, or destruction of exempt manual data that is inaccurate or incomplete.

Section 44 lets the Commission order a data controller to rectify, block, erase, or destroy personal data on a data subject's complaint that it is inaccurate. Section 36 applies these rights to a credit bureau acting as a data controller, letting a data subject limit an information request to their financial standing and history for the twelve months before the request.

Section 75 lets the Commission serve a data controller who has contravened or is contravening a data protection principle with an enforcement notice requiring it to take or refrain from taking specified steps within a stated time, or to stop processing specified personal data. Section 76 lets the Commission cancel or vary an enforcement notice on its own motion or on the application of the person it was served on.

Section 77 lets a person affected by processing request the Commission to assess whether it complies with the Act, and section 78 lets the Commission make a formal determination that processing is inconsistent with the Act. Section 80 makes it an offence, carrying a fine of not more than one hundred and fifty penalty units or imprisonment of not more than one year or both, to fail to comply with an enforcement notice or an information notice, or to make a false statement in response to one.

Section 43 entitles an individual who suffers damage or distress through a data controller's contravention of the Act to compensation from that data controller, subject to the defence that the data controller took reasonable care to comply. Section 88 bars a person from purchasing, knowingly obtaining, or knowingly or recklessly disclosing another person's personal data, and section 89 bars selling or offering to sell personal data.

Section 95 sets the residual penalty for an offence under the Act with no penalty otherwise specified at a fine of not more than five thousand penalty units or imprisonment of not more than ten years, or both.

Section 37(1) prohibits processing personal data relating to a child under parental control, or to an individual's religious or philosophical beliefs, ethnic origin, race, trade union membership, political opinions, health, sexual life, or criminal behaviour, unless the Act otherwise provides.

Section 37(2) permits a data controller to process special personal data only where the processing is necessary or the data subject consents, and section 37(3) treats processing as necessary where it exercises or performs a right or obligation the law imposes on an employer. Section 37(4) permits processing without consent only to protect the vital interests of a data subject who cannot give it, cannot reasonably be expected to give it, or has unreasonably withheld it.

Section 37(5) permits processing for the legitimate activities of a non-profit political, philosophical, religious, or trade union body, limited to its own members and never disclosed to a third party without the data subject's consent. Section 37(8) bars processing special personal data about race or ethnic origin unless it is necessary to identify and eliminate discriminatory practices and is carried out with appropriate safeguards for the data subject's rights and freedoms.

Section 38 exempts a spiritual or religious organisation, or an institution founded on religious or philosophical principles, from the prohibition on processing data about religious or philosophical belief where the processing concerns its own members, employees, or persons belonging to it.

Section 94 punishes a person who, without lawful authority, retrieves subscriber information or intercepts traffic data or content data. This offence is narrower than the Electronic Transactions Act's general unauthorized-access offences: it binds a person dealing in communications data held by or passing through a service provider, rather than a general web crawler collecting data from public pages it does not own.

The Act also imposes retention and cooperation duties on a service provider, and creates a licensing regime for cybersecurity service providers, enforced by the Cyber Security Authority.

Section 124 punishes a person who intentionally accesses or intercepts an electronic record without authority or permission. Section 130 punishes a person who knowingly and without authority causes a computer to perform any function to secure access to a programme or electronic record held in that computer or any other computer, and section 131 punishes an unauthorized modification of a programme or electronic record.

Section 133 creates an aggravated offence, whoever knowingly accesses a computer without authorisation or exceeds authorised access to a protected computer, one holding information from a financial institution, a government department, a national-security matter, or otherwise designated protected, and carries the Act's highest tier. Section 134 punishes intentionally causing a computer to cease to function, including by virus or worm.

None of these provisions exempts a publicly accessible, unauthenticated page from the definition of unauthorized access, which the Act defines as access a person is neither personally entitled to nor has been given consent to obtain.

Section 1 defines a literary work eligible for copyright to include encyclopedias, dictionaries, directories, time tables, anthologies, databases, or a compilation of data or other material, whether in machine-readable form, which by reason of the selection or arrangement of contents constitutes an intellectual creation.

Ghana has no separate sui generis database right: a database that is a mere collection of facts, without an original selection or arrangement, is not protected on that basis alone. Section 19's personal-use exception, which otherwise permits reproduction for a person's exclusive personal use, expressly does not extend to reproducing the whole or a substantial part of a database in digital form.

A person may not provide a cybersecurity service in Ghana without a licence issued by the Cyber Security Authority. The First Schedule defines a cybersecurity service as one provided for reward and aimed at ensuring or safeguarding the cybersecurity of a computer or computer system.

Its list runs from penetration testing, forensic examination, incident response and threat hunting through to designing, selling, importing, exporting, installing, maintaining, repairing or servicing a cybersecurity solution, so a vendor distributing a security software product for reward in Ghana falls within the licensing duty even without performing any of the Schedule's other listed services.

A granted licence runs for two years and must be renewed at least one month before expiry, may not be transferred, and may not be used for a purpose other than the one for which it was granted. Providing a cybersecurity service without a licence carries an administrative penalty equal to the cost of the damage caused and the value of the financial gain made rather than a fixed sum, while transferring a granted licence is a separate criminal offence.

The Cyber Security Authority must develop, establish and adopt standards for cybersecurity covering education and skills development, hardware and software engineering, governance and risk management, research and development, and any other area it determines in line with international best practice. It must publish them on its website, and take the necessary measures to enforce them and monitor compliance by the public and private sectors.

A person who breaches an adopted standard is liable to an administrative penalty of not less than two hundred and fifty penalty units and not more than twenty-five thousand penalty units, payable to the Authority.

The Act names no size or sector gate for this duty and states no criminal penalty for a breach; the specific technical content of a standard the Authority adopts under this section, including whatever it requires of hardware and software engineering, is set outside the Act's own text and is not described here.

The person in charge of any institution, public or private, must report a cybersecurity incident to the relevant Sectoral Computer Emergency Response Team, or to the National Computer Emergency Response Team where no Sectoral team covers that institution, within twenty-four hours after the incident is detected.

A cybersecurity service provider licensed by the Cyber Security Authority carries a further duty to submit a periodic report on its own operations, including any cybersecurity incident, within a period the Authority determines. Failing to report within the twenty-four-hour window is an administrative penalty of not less than two hundred and fifty penalty units and not more than five thousand penalty units, payable to the Authority, rather than a criminal offence.

Section 19(1)(b) of the Copyright Act, 2005 (Act 690) permits, without the copyright owner's consent, the inclusion of quotations from a work in another work, including quotations from articles in newspapers or periodicals in the form of press summaries, provided the work quoted has been made public.

Section 19(3) makes this conditional on the quotation being compatible with fair practice, with its extent not exceeding what is justified for the purpose of the work in which it is used, and on the source and the author's name being indicated. Section 19 carries no headline-length or short-extract cap distinct from this fair-practice test, and no reported Ghanaian decision applies it to a systematic news aggregator rather than an individual quoting a published work.

Neighbouring rights under the Act, covering performers and broadcasting organisations, do not extend to a print or online news publisher's own reporting.