An Open Letter to the Electoral Commission - Ghana

Dear Electoral Commission of Ghana,

I am writing to express my concerns regarding the upcoming publication of the reviewed Electoral Register online, particularly in light of the data protection laws of Ghana. While the Constitutional Instrument - CI 127 - grants you the authority to publish the register, it is imperative that this action aligns with our nation’s data protection regulations.

Section 91 (1) of the Data Protection Act 843 states “This Act binds the Republic” and what this means is that every entity within the jurisdiction of Ghana is required to comply with the Data Protection Act including the Electoral Commission.

The same way the Electoral Commission is mandated by the 1992 Constitution to conduct elections, Act 843 Section 2 also mandates the Data Protection Commission to protect the privacy of every Ghanaian

2. Object of the Commission. The object of the Commission is to? (a) protect the privacy of the individual and personal data by regulating the processing of personal information

Data Protection Concerns In 2020, the decision to publish the electoral register on Google Drive raised significant alarm among Ghanaians. Many citizens voiced their apprehensions that this approach contravened data protection laws, potentially exposing personal information without adequate safeguards. The implications of such exposure can lead to identity theft and misuse of personal data, undermining public trust in the electoral process. As you prepare to publish the updated register before the elections on December 7, 2024, it is crucial to prioritize the security and confidentiality of voters’ personal information. The Data Protection Act mandates that personal data must be processed in a secured manner.

As much as a constitutional duty is laid on the Electoral Commission to carry out its mandate by publishing the voter register, the data protection Act 843 Section 28 places the obligation on the EC to ensure that whichever means they deem fit to publish the voter’s register, it must be done securely.

Section 28 requires that the EC adopts “appropriate, reasonable, technical and organisational measures to prevent (a) loss of, damage to, or unauthorised destruction; and (b) unlawful access to or unauthorised processing of personal data.”

Again Section 28 (2) requires that the EC shall take reasonable measures to: identify reasonably foreseeable internal and external risks to personal data under that its possession or control; establish and maintain appropriate safeguards against the identified risks; and regularly verify that the safeguards are effectively implemented.

Potential Impact on Voters Failure to adhere to these principles has the potential of putting every Ghanaian Registered Voter at risk. The CI 127 mandates the EC to publish the Voter’s Register and the Data protection Act 843 provides guidance on how the EC should perform their constitutional mandate in a secured manner to ensure that every Ghanaian Registered Voter’s personal data is secured!

The EC has elections to conduct, and the Data Protection also has a mandate to protect Ghanaian Citizens!

The year 2020 was the first time the EC published the Voter’s Register online. There were mistakes and you took the measures to correct them – don’t forget the data was already accessed and the harm may have already been caused or the data could be used in future to harm others or infringe on their privacy or data protection rights.

The EC has the opportunity to publish the Voter’s Register again soon. The questions are: (1) What lessons did the EC learnt from the 2020 mistakes? (2) What security measures has the EC put in place or intends to put in place to protect and secure the data on the register?

(3) Have you consulted the Data Protection Commission (DPC), the Cyber Security Authority (CSA) National Information Technology Agency (NITA) and other relevant authorities for guidance?

And to all these states institutions, rise up to the call to fulfil your individual mandates – you owe it to every Ghanaian.

Recommendation for Compliance To ensure compliance with data protection laws while fulfilling your mandate, I recommend that the Electoral Commission:

1. Publish the register on a secure platform: Utilize your official website or a dedicated secure portal rather than third-party services like Google Drive. 2. Implement robust security measures: Ensure that access to the electoral register is restricted and monitored, and that all personal information is encrypted. 3. Communicate transparently with voters: Provide clear information on how their data will be protected and used, fostering trust and encouraging participation in the electoral process.

In conclusion, while CI 127 empowers you to publish the electoral register, it is essential that such actions are conducted in a manner that respects and upholds the data protection laws of Ghana.

Whatever happens, on 7th December, Ghanaians will either vote to RESET or UPGRADE Ghana.

Thank you for considering these important matters.

Author: Emmanuel K. Gadasu (CEH, CDPS, CIPM, CIPP/E, BSc IT, MSc IT and Law, LLB*)

The writer is a Data Protection and Cybersecurity Consultant, Practitioner and Trainer! You can reach him for further comments by Call/WhatsApp/Telegram +233 24391 3077 or via email: [email protected]. LinkedIn: https://www.dhirubhai.net/in/emmanuelgadasu/ Facebook: https://web.facebook.com/emmanuel.gadasu/