The Data Protection Commission in Ghana has referred four food processing companies to the Criminal Investigations Department (CID) of the Ghana Police Service for allegedly breaching the Data Protection Act, 2012 (Act 843). The companies, Barry Callebaut, TF Commodities, Wilmar Africa Limited, and De Heus, were found to be operating without valid data protection certificates, using expired certificates, or failing to produce their certificates during compliance checks.
According to Mr. Quintin Akrobotu, Director of Regulatory and Compliance at the Data Protection Commission, the breaches were identified during inspections at the Free Zones Enclave as part of a week-long enforcement exercise. The exercise aimed to ensure organizations handling personal data complied with the law. The commission's records showed that Barry Callebaut had no valid certificate, while TF Commodities' certificate had expired in 2020.
Wilmar Africa Limited was also unable to produce a valid certificate and confirmed that its previous certificate had expired, although it was taking steps to renew it. De Heus had registered with the Commission but could not produce its certificate during the inspection. However, the Commission's records showed that the company had collected the certificate, which was due for renewal next year.
The Data Protection Commission has directed Barry Callebaut to report to the CID headquarters in Accra to explain its failure to renew its certification. TF Commodities and Wilmar Africa Limited have also been invited to provide statements on their compliance failures. Mr. Akrobotu emphasized that registration and certification are mandatory for organizations collecting and processing personal information.
Under Section 50 of Act 843, certificates must be renewed every two years. Mr. Akrobotu noted that if a certificate is expired, it's as good as not being registered. He urged organizations to maintain valid certification and adopt appropriate safeguards for personal information. The commission commended Cargill Ghana Limited and Imperial Health Sciences for demonstrating compliance.
Cargill Ghana Limited had renewed its certificate and appointed a Data Protection Supervisor in accordance with Section 58 of the Act. However, the company was required to submit a report on the supervisor's training and compliance activities by October 31. Imperial Health Sciences had also renewed its certification, appointed and trained a data protection supervisor, and demonstrated measures to protect customers' and employees' personal information.
The Data Protection Commission's enforcement exercise will continue until organizations processing personal information comply with the law. Mr. Akrobotu urged institutions to train more data protection supervisors and equip employees with the knowledge to handle personal information responsibly. He also condemned alleged attacks on journalists covering the exercise, saying they were reporting the Commission's findings and should not be targeted for doing their work.
Key points
- Four food processing companies in Ghana have been referred to the CID for alleged data protection breaches.
- The companies were found to be operating without valid data protection certificates or using expired certificates.
- The Data Protection Commission will continue its enforcement exercise until organizations comply with the law.
