Data controllers granted 6-month relief to regularize their operations

The Ministry of Communications has granted amnesty of six months to allow data controllers in Ghana register with the Data Protection Commission (DPC).

This forms part of efforts to regulate the cyber protection space and effectively monitor all stakeholders in the space.

The amnesty, starts from October 2020 to March 2021, according to the sector minister, Ursula Owusu-Ekuful.

Addressing stakeholders at the launch of the new Data Protection Registration and Compliance Software in Accra, she said, “Considering the impact of the COVID-19 pandemic on businesses, and in accordance with the regulations of section 94 of Act 843 empowering the Minster to extend the transitional period for data controllers, I have directed the Commission to grant an Amnesty for six months from the 1st October, 2020 to 31st March, 2021, to allow defaulting data controllers to register with the Commission, and pay just the current year’s amount due; waiving any applicable arrears.”

She further urged the entities in question to make use of this chance or be made to face the law.

“Data controllers, I would like to take this opportunity to encourage you to take advantage of the Amnesty Period to be in good standing with the Commission. All entities which fail to regularize their operations with the DPC during this amnesty period will face the full brunt of the law after 31st March, 2021. Please be advised and act accordingly.”

The Data Protection Commission is optimistic that this move will go a long way to check the over 50,000 data controllers who have over the years, been operating without authorization.

The Executive Director of DPC, Patricia Adusei-Poku, on the sidelines on the launch of the software told Citi Business News that “When we last checked, the active incorporated businesses at the Registrar General’s office was about 60,000, but we have only 2,000 registered data controllers approximately. So that should tell you the gap between where we are and where we ought to move to be as a nation.”

She continued that, “The cost implication is massive. Let’s say for argument sake, they were just 50,000 and they all owed a GHS1,000, that will be GHS5 million in total. So that is the amount of money the Commission is losing annually that is limiting our ability to educate the public. So it is a challenge to all of us to cause them to do the right thing.”

A data controller is a person, company, or any body that determines the purpose and means of personal data processing. This can be determined alone or jointly with another person, company or a body.

Act 843 under the Data Protection Law demands that all entities within the space duly register with the Commission and pay the required fees; but several qualifying entities have failed to register since 2012.

With the launch of a new Registration Software for the Data Protection Commission, arrears invoice generation is now possible for every incorporated business and established entity that processes personal data.

It is for this reason that the sector Minister has granted the six months amnesty for data controllers who existed before and after May 2012 that have not yet registered with the Commission to do so before April 2021.

This forms parts of efforts to make it easier for the Commission to monitor all payments due it since 2012, when the Data Protection Law became effective.

In order to further tighten the safety of Ghana’s cyber space, the Internal Audit Agency and the Data Protection Commission, have signed a Memorandum of Understanding in a collaborative effort to train about 2,000 internal Auditors nationwide, to expand the scope of audit to include the requirements of Act 843.

New Registration and Compliance Software

According to the Communications Minister, the new software, also known as “REGSYS” is interactive. Below are some key features of the software listed by Mrs. Owusu-Ekuful.

• Applicant Data Controllers now have a login to a profile area, that provides them visibility into their registration record. You can login whenever, to review, amend or update your information held.
• The system automatically assesses your institution’s state of compliance as you complete your form online and presents you with a percentage score against a 100% weighted state of compliance.
• You receive a roadmap of milestones to achieve as the next steps following registration. The systems allows the upload of photos, videos and other documents as evidence of your accountability to your data subjects and the DPC.
• The Commission is able to share letters and messages with you in your profile space.

These enhanced features fulfill DPC’s trifold objective of increased transparency, building trust between the Commission, data controllers and data subjects; all in the effort towards national transformation.

National Cyber Security Awareness Month

The launch of the Data Protection Registration and Compliance Software has come within a month where the Communications Ministry is deliberately raising awareness and tightening its efforts in tackling the cyber crime or fraud menance in the country.

The National Cyber Security Awareness Month program is aimed at building capacity and raising awareness on cybercrimes and the need to improve Ghana’s cybersecurity readiness among children, the general public, corporate Ghana and government agencies.

The theme for this year’s program, which started from October 1 and will end on October 31, is “Cybersecurity in the era of COVID-19”.