The Data Protection Commission (DPC) has given the Electoral Commission (EC) up to July 22, 2019, to furnish it with details of how the EC allegedly gave out Ghanaian voters data to a foreign software company, which intend sold it to financial service providers.
Failure to comply with the 21-day ultimatum on at 10:00 a.m. on July 22, the DPC said it shall be compelled to issue an Enforcement Notice for prosecution for the EC for non-compliance under section 80 of Data Protection Act, Act 843.
The DPC’s decision to issue the ultimatum followed the Auditor General’s Report that the data of the EC was being hosted by Bysystem Limited, a foreign company which possesses unlimited access for the processing of the data of Ghanaian electorates.
Ms Patricia Aduse Poku, the Executive Director of the DPC told the Ghanaian Times in an interview on Tuesday that the 21-day ultimatum was given to the EC based on these findings, saying “we have made the determination to them (EC) asking them to provide the technical and organisational measures that they have put in place to safeguard the electoral register and that of the EC staff data.”
She said “if the DPC did not hear from EC, the only option would be to resort to the enforcement of the law to compel them to comply.”
According to the DPC, the 2019 report of the Auditor General’s Special Audits carried out on selected state institutions including the Electoral Commission in 2018, cited a possible non-compliance with the Data Protection Act (Act 843).
The Data Protection Commission stated that “In accordance with its mandate under section 2 of Act 843, the DPC requires of the EC to comply with the Data Protection Act 2012 (Act 843) as an accountable institution and requires the EC to provide the following information regarding the processing of personal data of both employees of the EC and the Ghanaian electorate.”
According to a two-page document dated July 1, 2019, in possession of the Ghanaian Times, the DPC further requested the EC to provide evidence of adopting appropriate, reasonable technical measures as evidence of continued safeguarding of personal data including the technology in use for managing employee and electorate data.
Copies of full contracts, agreements with third party suppliers, documentary evidence of due diligence, risk assessment conducted in selecting the suppliers and procurement documents inclusive.
The DPC has also requested the EC during the 21-day period to provide documentary evidence of correspondence between the EC and suppliers regarding their access to personal data of the electorate and the EC staff data.
Details of other third party access to the electoral data base and justifications on record including exempted bodies.
Apart from that, the DPC is demanding of the EC documentary evidence of training arrangements for the EC staff, third party partners on personal data management, authorised database access to unauthorised processing of personal data including all policies and procedure guidelines for staff relating to accessing and processing of electoral staff data bases.
When contacted the Director of Elections at the Electoral Commission, Dr Serebour Quaicoe, told the Ghanaian Times that he had taken over the position barely two months ago at the EC and was, therefore, not privy to the issue for him to make an informed comment on it.
The Deputy Commissioner of the EC in charge of Operations, Mr Samuel Tettey, and former Director of Elections when contacted said the Dr Eric Bossman Asare was the right EC official who could speak to the issue.
When the Ghanaian Times got in touch with Dr Asare for his reaction at about 3:50 p.m. he told this reporter to give him up to 5:00 p.m. to get back to office to see if he could lay hands on the document in question.
This reporter obliged and called Dr Bossman Asare a few minutes after 5:00 p.m. but he said there was no trace of the document, adding “It could be that it is still in the mail.”
He asked the reporter to send him a copy of the document so that he could study it overnight and react to it appropriately.
By Norman Cooper
