Data Protection Commission refers health facilities to police for prosecution

The Data Protection Commission (DPC) has referred several health facilities and a microfinance firm to the police for prosecution following a compliance enforcement exercise in Accra. This action, taken under the mandate of the Data Protection Act, 2012 (Act 843), highlights the commission's commitment to ensuring that institutions handling personal data adhere strictly to regulatory requirements. During the operation, the DPC identified multiple organizations that had failed to maintain valid registrations or meet their financial obligations to the state.

Among those cited during the enforcement drive were two hospitals found to be operating with expired data protection certificates. Additionally, a clinic was flagged for significant compliance issues, including the failure to pay mandatory regulatory fees. The Commission’s officials emphasized that simply registering with the DPC is insufficient; organizations must actively maintain their status and fulfill ongoing legal obligations to ensure the privacy and security of the sensitive information they manage, particularly in sectors as critical as healthcare.

The referral to the police marks a shift toward more stringent enforcement measures as the DPC seeks to protect the data rights of Ghanaian citizens. Commission representatives noted that inspections will not be limited to the healthcare and finance sectors but will expand to other industries in the coming months to ensure nationwide compliance. Organizations across all sectors are urged to review their current data protection status immediately, as the DPC warned that further legal actions will be initiated against any entity found in breach of Act 843.