Ghana

The Data Protection Act, 2012 (Act 843) is administered by the Data Protection Commission, an independent statutory body it establishes. A data controller or processor established in Ghana, or using equipment or a processor in Ghana, must have a lawful basis before processing personal data. It must also register with the Data Protection Commission before processing begins. The Act binds the Republic itself, treating each government department as a data controller.

Processing special personal data, including an individual's DNA, ethnic origin, political opinion, religious belief, or sexual life, is prohibited unless a listed exception applies, such as the data subject's consent or a legal obligation on an employer. A data subject may require that a decision significantly affecting them is not based solely on automated processing of their personal data.

The data subject may also require reconsideration of such a decision within twenty-one days of being notified of it. A data controller must notify the Commission and the affected data subject of unauthorized access to or acquisition of personal data as soon as reasonably practicable after discovering it. The Act imposes no adequacy test or other substantive condition on transferring personal data outside Ghana.

An applicant for registration as a data controller must, however, disclose the countries to which it may transfer the data it holds. The Act was gazetted on 18 May 2012. Its commencement was left to a date the Minister specifies by notice in the Gazette. The Act came into force in October 2012.

Section 94 punishes a person who, without lawful authority, retrieves subscriber information or intercepts traffic data or content data. This offence is narrower than the Electronic Transactions Act's general unauthorized-access offences: it binds a person dealing in communications data held by or passing through a service provider, rather than a general web crawler collecting data from public pages it does not own.

The Act also imposes retention and cooperation duties on a service provider, and creates a licensing regime for cybersecurity service providers, enforced by the Cyber Security Authority.

Section 124 punishes a person who intentionally accesses or intercepts an electronic record without authority or permission. Section 130 punishes a person who knowingly and without authority causes a computer to perform any function to secure access to a programme or electronic record held in that computer or any other computer, and section 131 punishes an unauthorized modification of a programme or electronic record.

Section 133 creates an aggravated offence, whoever knowingly accesses a computer without authorisation or exceeds authorised access to a protected computer, one holding information from a financial institution, a government department, a national-security matter, or otherwise designated protected, and carries the Act's highest tier. Section 134 punishes intentionally causing a computer to cease to function, including by virus or worm.

None of these provisions exempts a publicly accessible, unauthenticated page from the definition of unauthorized access, which the Act defines as access a person is neither personally entitled to nor has been given consent to obtain.

Section 1 defines a literary work eligible for copyright to include encyclopedias, dictionaries, directories, time tables, anthologies, databases, or a compilation of data or other material, whether in machine-readable form, which by reason of the selection or arrangement of contents constitutes an intellectual creation.

Ghana has no separate sui generis database right: a database that is a mere collection of facts, without an original selection or arrangement, is not protected on that basis alone. Section 19's personal-use exception, which otherwise permits reproduction for a person's exclusive personal use, expressly does not extend to reproducing the whole or a substantial part of a database in digital form.

Section 19(1)(b) of the Copyright Act, 2005 (Act 690) permits, without the copyright owner's consent, the inclusion of quotations from a work in another work, including quotations from articles in newspapers or periodicals in the form of press summaries, provided the work quoted has been made public.

Section 19(3) makes this conditional on the quotation being compatible with fair practice, with its extent not exceeding what is justified for the purpose of the work in which it is used, and on the source and the author's name being indicated. Section 19 carries no headline-length or short-extract cap distinct from this fair-practice test, and no reported Ghanaian decision applies it to a systematic news aggregator rather than an individual quoting a published work.

Neighbouring rights under the Act, covering performers and broadcasting organisations, do not extend to a print or online news publisher's own reporting.