WHEN PRIVACY BECOMES RISK-BASED: THE SUPREME COURT’S DECISION IN GORNI V VODAFONE

 INTRODUCTION

The recent decision of the Supreme Court in Gorni v Vodafone Ghana Ltd & Others signals an important shift in the constitutional understanding of privacy under Article 18(2) of the 1992 Constitution. In effect, it reflects a move toward a more risk-based conception of privacy, particularly in the context of SIM registration and digital identity systems.

At first glance, the case appears straightforward: an individual discovers that a telephone number has been linked to his Ghana Card without his consent and seeks constitutional redress. The concern is legitimate. In an era of mobile money, digital transactions and identity-linked services, the misuse of identity documents carries real risks.

However, beyond the facts lies a deeper legal issue. Did the Supreme Court determine the case within the proper constitutional framework required under Article 18(2) of the 1992 Constitution? Or did it expand the right to privacy beyond what that provision actually provides?

This article examines the decision of the Supreme Court in Gorni v Vodafone Ghana Ltd & Others (Civil Appeal No. J4/40/2025, delivered 25th February 2026), arguing that while the majority opinion by Prof. Mensa-Bonsu JSC identified a genuine concern about identity misuse within Ghana’s SIM registration system, it expanded Article 18(2)’s right to privacy beyond its textual limits. In doing so, the Court effectively recast privacy under Article 18(2) into a risk-based, informational framework not grounded in the Constitution’s specific protections of property, correspondence, or communication. In contrast, Dzamefe JSC’s dissent maintains constitutional discipline by requiring actual interference with enumerated interests, not merely risk of misuse. On a proper analysis, even if the claim is reframed within statutory data protection frameworks, the facts remain contestable, raising doubt as to whether any actionable breach is established.

THE CONSTITUTION AND THE RIGHT TO PRIVACY

Article 18(2) of the 1992 Constitution provides:

“No person shall be subjected to interference with the privacy of his home, property, correspondence or communication…”

This provision is not an open-ended guarantee of privacy. It is structured and specific, protecting identifiable and constitutionally enumerated interests:

• privacy of property;
• privacy of correspondence;
• privacy of communication.

The constitutional question, therefore, is not whether there has been a general “breach of privacy,” but whether the facts disclose an interference with any of these specific protected interests, as defined in Article 18(2).

Privacy, in constitutional terms, is not merely anything that may be regarded as private. The Constitution itself defines, with precision, the categories of privacy it protects.

That distinction is fundamental. It marks the boundary between what properly constitutes a constitutional violation and what falls outside the scope of Article 18(2), however legitimate the underlying concern may be. It is against this constitutional framework that the appellant’s claim must be understood.

THE FACTS AND CLAIM OF THE APPELLANT

The appellant, a Vodafone subscriber, discovered that a number (0203618193) unknown to him had been linked to his Ghana Card without his consent. He further discovered that the number had subsequently been de-linked, again without his involvement.

He brought an action under Article 33 of the Constitution against the respondents, including Vodafone Ghana Ltd, alleging a violation of his right to privacy under Article 18(2) of the Constitution, and sought declarations, disclosure of registration records, and damages.

It is important to emphasise that the claim was squarely constitutional, not statutory. The appellant did not rely on the Data Protection Act, 2012 (Act 843) but grounded his entire case on Article 18(2) as the basis of his claim. This choice of legal framework determines the scope and limits of the constitutional inquiry before the Court. It is this constitutional framing that shaped the issues before the Court and informed the reasoning of the majority.

THE DECISION OF THE SUPREME COURT (MAJORITY)

Against this background, the Supreme Court proceeded to determine the claim. The majority of the Supreme Court held that the appellant’s right to privacy had been breached and awarded damages. In reaching this conclusion, the Court focused on:

• the unauthorised linkage of the appellant’s identity to a SIM card;
• the risks associated with identity misuse;
• the responsibility of the respondents within the SIM registration system.

However, a critical difficulty arises. The majority, in effect, asked its own question—whether there had been a breach of a broad and evolving “right to privacy”, which can be understood as extending to a form of informational privacy—and answered that question correctly on its own terms. But that was not the constitutional question placed before the Court.

At this point, a legitimate question arises: if the majority asked the wrong constitutional question but answered it correctly on its own terms, what then were the real issues before the Court? The appellant’s claim was not an abstract appeal to a general right to privacy. It was a specific constitutional complaint under Article 18(2), requiring the Court to determine whether the facts disclosed an interference with the privacy of his property, communication or correspondence. That was the question the Court was called upon to answer—not whether there had been a broad or undefined breach of “privacy.”

At the same time, the majority’s approach may be understood as implicitly recognising informational privacy as an extension of the constitutional protection of communication, and as responding to the risks inherent in digital identity systems, where misuse of personal data may occur without direct interception or traditional forms of intrusion. On this view, the absence of proven misuse or harm may not be decisive, as the risk of identity misuse itself could justify constitutional protection in an increasingly digital environment.

However, while this reasoning is intuitively appealing, it lacks a clear anchor in the text and structure of Article 18(2). The constitutional provision requires an identifiable interference with specific protected interests, not a generalised concern with risk or potential harm. To treat informational privacy, or the risk of its violation, as falling within the scope of “communication” without clear textual grounding is to extend the provision beyond its defined limits. In that sense, the difficulty is not merely that the majority reached a broad conclusion, but that it did so by transforming the nature of the constitutional inquiry itself.

The effect of this reasoning is to introduce what may properly be described as a risk-based, informational privacy expansion of Article 18(2). The ratio decidendi—the legal principle upon which the decision rests—may be understood as holding that:

“Where an individual’s identity is linked to a SIM card without their consent, and that linkage exposes the individual to the risk of identity misuse, this constitutes a breach of the right to privacy under Article 18(2) of the Constitution, even in the absence of proven misuse or actual interference with property, correspondence, or communication.”

So framed, the decision departs from the traditional requirement of an identifiable interference with the privacy of property, communication or correspondence, and instead recognises a broader, risk-oriented conception of privacy grounded in the potential for data misuse. While this approach reflects a legitimate concern for the protection of personal identity in a digital environment, it extends the scope of Article 18(2) beyond its textual and structural limits, thereby transforming a provision defined by specific protected interests into one that accommodates a more generalised and evolving notion of privacy. This approach, however, was not unanimous.

THE DISSENTING VIEW – A TEXTUALLY FAITHFUL APPROACH

Dzamefe JSC, in dissent, approached the matter from a textually anchored constitutional standpoint. His analysis was grounded in three key points:

• the absence of any proprietary interest in the telephone number;
• the absence of any evidential basis for interference with communication or correspondence;
• the absence of any demonstrated harm or misuse.

The dissent insisted on fidelity to the constitutional text and declined to extend Article 18(2) beyond its defined scope. This approach is doctrinally significant. It recognises that while constitutional interpretation may be informed by broader policy considerations, and the Court may in appropriate cases adopt a purposive approach, such interpretive latitude must remain disciplined by the text and structure of the Constitution.

In that sense, the dissent does not reject constitutional evolution. Rather, it insists that such evolution must occur within the limits of the constitutional provision itself, and not by effectively transforming Article 18(2) into a free-standing and open-ended right to privacy.

At the same time, it must be acknowledged that this textually disciplined approach may give rise to legitimate concerns, particularly in relation to modern forms of informational intrusion and the misuse of personal identity in digital systems. Such harms may not always fit neatly within the traditional categories of property, communication or correspondence, yet they remain real and increasingly significant. However, this concern does not justify extending Article 18(2) beyond its text. Rather, it underscores the importance of resorting to the proper legal framework, including statutory regimes such as the Data Protection Act, 2012 (Act 843), which are specifically designed to regulate the collection, use and misuse of personal data. In this way, the protection of informational privacy can be effectively secured without distorting the structure and limits of the Constitution. The divergence between the majority and dissent ultimately reflects a deeper question about the proper limits of constitutional interpretation.

CONSTITUTIONAL INTERPRETATION: EVOLUTION WITHIN LIMITS

The Constitution is a living organism, as recognised by Justice Sowah in Tuffuor v. Attorney-General, and must adapt to changing realities. The Supreme Court is therefore empowered to interpret constitutional provisions purposively to address contemporary circumstances. However, this interpretive power is not unlimited. The critical distinction lies between legitimate interpretation and judicial creation, and the limit is reached where interpretation becomes creation.

A clear example of legitimate purposive interpretation is Article 18(2)’s protection of “communication.” While originally referring to letters and telephone calls, it naturally extends to emails, WhatsApp messages, and other digital forms. This is because the text protects “communication” without restricting the medium. The Court, in such instances, applies an existing right to new forms—it does not create a new right.

The present case is materially different. Article 18(2) protects privacy in respect of “property, correspondence or communication”—a defined set of interests. The majority’s reasoning treats the risk of identity misuse as sufficient to constitute a constitutional violation, even without interference with these categories. However, the Constitution does not expressly protect “information” or “identity” in the abstract, nor does “risk” equate to interference within the meaning of Article 18(2). This, in effect, introduces a form of risk-based informational privacy not grounded in the text of the Constitution.

The distinction is therefore clear: while digital messages fall within “communication,” the risk of identity misuse does not fall within “property, correspondence or communication.” Without adherence to these textual limits, there is no principled boundary to constitutional rights. If risk alone suffices, then risks of financial loss or reputational harm could equally be constitutionalised, effectively transforming courts into super-legislatures. Constitutional expansion, where necessary, should occur through the amendment process under Article 290, ensuring democratic legitimacy and predictability.

It is my position that the Constitution evolves within its textual structure, not beyond it. In this case, the majority treats the risk of identity misuse as a constitutional violation without any demonstrated interference with property, correspondence, or communication. This, in my view, is not an adaptation of an existing right—as in the extension of “communication” to digital forms—but the creation of a new protection not grounded in the text. It is on this basis that I align with the dissenting opinion. That interpretive question becomes particularly concrete when applied to the specific issue of whether a telephone number can constitute “property” within the meaning of Article 18(2).

TELEPHONE NUMBERS AND THE QUESTION OF OWNERSHIP

(A) International Position – ITU Framework

Globally, under the regulatory framework of the International Telecommunication Union (ITU), telephone numbers are not treated as private property but as national and public resources subject to regulatory control.

The ITU’s numbering principles make it clear that:

• numbering resources are finite public resources administered in the public interest;
• they are allocated by national regulators, not owned by end-users; and
• subscribers are granted only a right of use, which is non-transferable and revocable.

This framework is reflected across jurisdictions and forms the basis of modern telecommunications regulation. The legal consequence is straightforward and decisive:

A subscriber does not acquire any proprietary interest in a telephone number. The number remains part of a regulated national resource pool.

There is therefore no legal basis, within ITU-aligned systems, for treating a telephone number as private property capable of constitutional protection.

(B) Ghana Position

The position in Ghana is entirely consistent with the international framework. Under the Electronic Communications Act, 2008 (Act 775) and the regulatory authority of the National Communications Authority (NCA):

•numbering resources are owned and controlled by the State;
•they are allocated to network operators for management and assignment; and
• their use is subject to regulatory oversight in the public interest.

Specifically, Section 65 of Act 775 provides that:

“The Authority shall establish, control, and manage a National Electronic Communication Numbering Plan for network and applications services.”

This provision establishes that numbering resources constitute state property under the exclusive control of the NCA, not assets capable of private ownership.

The statutory framework further provides that:

• network operators receive number allocations under license conditions specified in Section 4(2)(u) of Act 775, which governs “the allocation to and use by the licensee of numbers”;
• subscribers possess usage rights protected by the Mobile Number Portability Regulations, 2011 (L.I. 1994), which permit portability between operators while maintaining state ownership of the underlying numbering resource; and
• Section 6(1)(n) of Act 775 mandates that operators “provide number portability when required to do so,” reinforcing that numbers are regulatory instruments, not proprietary assets.

Critically, the legal regime makes it clear that the assignment of a number does not confer any proprietary interest on the end-user.

Further:

• subscribers cannot sell, transfer or commercially exploit telephone numbers as property;
• operators merely assign numbers for use, subject to regulatory conditions;
• and such assignments may be withdrawn, reassigned or modified in accordance with regulatory directives.

The legal position, both internationally and domestically, is therefore settled. A telephone number is not property, but a regulated public resource, the use of which is granted to subscribers on a conditional and revocable basis.

Accordingly, a claim grounded in the “privacy of property” under Article 18(2) of the Constitution, in respect of a telephone number, is fundamentally misplaced. The appellant had no proprietary interest in the disputed number 0203618193, which was linked to his Ghana Card without his knowledge or consent, and was subsequently de-linked.

While subscribers possess protected usage rights—indeed, usufructuary rights (rights to use but not own)—under L.I. 1994 and regulatory conditions, these do not constitute “property” within the meaning of Article 18(2). Moreover, on the facts before the Court, the appellant never actively used the disputed number, suffered no disruption to any service, and exercised no usage rights in respect of it.

The absence of any proprietary interest is therefore fatal to this limb of the claim, as it fails to satisfy a necessary constitutional precondition. It also reinforces the appropriateness of the dissenting approach.

This position is not merely doctrinal; it exposes a deeper interpretive divide in the Court’s reasoning. The majority’s approach reflects what may properly be described as an expansive or free-form purposivism, in which constitutional rights are extended beyond their explicit textual categories in response to evolving societal concerns.

The dissent, however, embodies a controlled or textually disciplined purposivism, which recognises that while the Constitution is a living organism, its interpretation must remain anchored within its language and structure.

Under Article 18(2), “privacy” is not a free-standing, abstract right, but one expressly tied to property, communication and correspondence. To detach privacy from these constitutionally defined categories is to transform interpretation into reconstruction.

The dissent’s rejection of a generalised privacy claim is therefore not a denial of constitutional evolution, but an insistence that such evolution must occur within the limits of the constitutional text itself. Even if the proprietary argument fails, the question of liability still turns on how the alleged linkage occurred in practice.

THE STAGE ONE REGISTRATION PROBLEM

A critical factual issue, which appears to have been insufficiently addressed by the majority, relates to the two-stage SIM registration process.

The evidence before the Court showed that:

• Stage One involves merely linking a Ghana Card number to a SIM number;
• this stage can be completed by any person with access to the Ghana Card or its number;
• it does not require access to any internal database of the service provider.

Indeed, the respondents made it clear that:

• the process could be initiated without interaction with secure telecom systems;
• no biometric verification occurs at that stage.

This has significant legal implications. If the initial linkage can be carried out by any person with access to the Ghana Card, then the act complained of does not necessarily involve any misuse of data within the respondents’ controlled systems.

This raises a fundamental evidential question: on what basis can liability be attributed to the respondents for a process that does not require access to their internal data infrastructure? In such circumstances, the chain of attribution and causation becomes legally uncertain, and the burden of establishing responsibility on the part of the respondents is correspondingly difficult to sustain.

However, Vodafone’s admission that its system automatically creates Vodafone Cash accounts upon Stage One completion, without verification or biometric confirmation, calls into question system design and the adequacy of safeguards against identity misuse within the respondents’ controlled infrastructure. This is more appropriately addressed through data protection and regulatory frameworks. These evidential uncertainties further underscore the difficulty of sustaining the claim within the framework of Article 18(2).

MISPLACED RELIANCE ON ARTICLE 18(2) OF THE CONSTITUTION

When the facts are tested against Article 18(2), the difficulties become clear.

(a) Privacy of Property

• The appellant had no proprietary interest in the number;
• this limb fails to satisfy a necessary constitutional requirement.

(b) Privacy of Communication or Correspondence

• No evidence of any interception;
• no evidence of monitoring of calls or messages;
• this limb also fails for lack of any evidential basis.

The core problem is that the majority avoided the real constitutional inquiry and instead relied on a generalised notion of privacy not expressly grounded in Article 18(2). In doing so, the Court applied a constitutional standard not grounded in Article 18(2) and expanded the right beyond its textual limits. The question therefore remains: even at its strongest, what right was in fact breached?

WHAT RIGHT WAS ACTUALLY BREACHED?

At best, the appellant’s complaint may be framed as a data protection concern. However, even this is not straightforward. Under the Data Protection Act, 2012 (Act 843), sections 17–20 impose obligations relating to transparency (section 17), lawful and fair processing (section 18), data minimality (section 19), and the requirement for a lawful basis for processing, including consent (section 20).

However, the application of these provisions to the present facts is not straightforward. The data used at the initial stage of registration consists of:

• name;
• date of birth.

These details are visible on the face of the Ghana Card and do not require access to any protected database. As acknowledged by the respondents, no access to internal subscriber data or biometric systems is required at Stage One, raising no obvious issue of excess under section 19.

More fundamentally, the evidence suggests that Stage One registration can be undertaken without access to the respondents’ systems, thereby creating uncertainty as to whether any “processing” can properly be attributed to them within the meaning of sections 17 and 18.

The question of consent under section 20 is equally complex. The appellant’s complaint appears to extend to both the linking and subsequent de-linking of the number. However, if the initial linkage was not undertaken at his instance, the subsequent de-linking may plausibly be characterised as a corrective or remedial step, rather than an independent act requiring separate consent. In such circumstances, the absence of consent does not operate in a straightforward manner, and its attribution to the respondents becomes legally uncertain.

Accordingly, any alleged breach of data protection principles is, at best, contestable. This reinforces the point that no clear constitutional right under Article 18(2) was established, even when the appellant’s case is considered at its strongest formulation. It is in this context that the broader implications of the majority’s reasoning become apparent.

THE DANGER OF CONSTITUTIONAL OVERREACH

The broader implication of the majority’s reasoning is significant. By elevating the risk of identity misuse—absent any demonstrable interference with property, communication, or correspondence—into a constitutional violation, the Court effectively expands Article 18(2) beyond its defined limits.

If such an approach is sustained, it risks blurring the distinction between constitutional rights and statutory or regulatory obligations, particularly in areas such as data protection. Courts may increasingly be drawn into adjudicating matters more appropriately addressed within specialised regulatory frameworks, thereby altering the nature of constitutional adjudication itself.

More fundamentally, a risk-based conception of privacy that is not grounded in the specific categories protected under Article 18(2) creates uncertainty about the scope of constitutional rights. Without clear limiting principles, the boundaries of constitutional protection become difficult to define, and the coherence of constitutional interpretation correspondingly weakened.

IMPLICATIONS

For the Judiciary: This decision underscores the role of courts in bridging the gap between existing legal frameworks and rapidly evolving technological realities. As the law often lags behind technological change, courts may extend constitutional provisions to new contexts, as seen in the recognition of digital forms such as emails and WhatsApp messages as “communication.” However, such adaptation must remain anchored in the constitutional text. Where this balance is not carefully maintained, there is a risk of creating parallel and inconsistent standards between traditional and digital contexts, leading to doctrinal uncertainty.

For Telecommunications Operators: Liability may arise without proof of causation, control, or system involvement, extending responsibility to processes outside operational systems and reflecting a risk-based model of liability that leaves little room to distinguish between operational fault and external misuse.

For the Legal System: There is a blurring of lines between:

• constitutional law
• data protection law
• regulatory enforcement

creating confusion about both the applicable legal framework and the roles of the institutions responsible for enforcing it.

For Policy Makers and Regulators: The majority decision, in effect, adopts a zero-tolerance posture toward the risk of wrongful identity linkage within the SIM registration framework. Where liability may arise even in the absence of proven misuse, causation, or system control, regulators are compelled to ensure that registration processes are structured in a manner that does not permit such linkages to occur at all, particularly at the initial stages. This places a heightened obligation on system design and oversight, and underscores the need for robust SIM registration reform and strengthened data governance frameworks that eliminate vulnerabilities capable of enabling unauthorised identity linkage.

These concerns are not merely theoretical; they carry significant institutional and regulatory consequences.

CONCLUSION

The decision of the Supreme Court in Gorni v Vodafone reflects a legitimate and commendable concern for the protection of personal identity in an increasingly digital and interconnected environment. There is no doubt that the misuse of identity documents, particularly in the context of SIM registration and mobile money services, presents real and potentially serious risks. However, constitutional adjudication must remain anchored in the text, structure, and intent of the Constitution.

Article 18(2) does not establish a free-standing, open-ended right to privacy. It protects specific interests—the privacy of property, communication, and correspondence. The appellant’s claim, as framed, required him to demonstrate an interference within one or more of these constitutionally defined categories. On the facts, that burden was not discharged.

A telephone number is not property. There was no evidence of interference with communication or correspondence. The linking of the number at the preliminary stage of registration, which could be undertaken by any person with access to the Ghana Card and without recourse to any internal database of the service provider, further weakens the attribution of liability to the respondents. Even when viewed through the lens of data protection, the alleged breach is not as straightforward as presented.

In these circumstances, the majority’s approach—though well-intentioned—effectively broadened the constitutional right beyond its textual limits, substituting a generalised notion of privacy for the specific guarantees under Article 18(2). In doing so, the Court asked a broader question than the Constitution required and, unsurprisingly, arrived at a correspondingly broader answer. This reflects, in effect, a shift toward a risk-based and informational conception of privacy under Article 18(2)—one that, while responsive to modern concerns, remains difficult to reconcile with the constitutional text and structure.

The dissenting opinion of Dzamefe JSC, in contrast, remains firmly grounded in constitutional principle. It recognises that not every irregularity in a regulatory process, nor every perceived misuse of identity, rises to the level of a constitutional violation. It insists, correctly, that claims brought under Article 18(2) must be tested against the actual rights protected by that provision.

Ultimately, the protection of personal data is vital and must be robustly enforced. But that enforcement must occur through the proper legal framework. Where the facts disclose, at best, a contestable issue of data protection compliance, it is to the statutory regime—not the Constitution—that recourse should properly be had, including frameworks such as the Data Protection Act, 2012 (Act 843).

In that regard, the dissent does not diminish the importance of privacy. Rather, it preserves the integrity of constitutional adjudication by ensuring that the right questions are asked before answers are given. As a digital rights advocate, I fully recognise the importance of robust privacy protections in an increasingly digital society. However, the majority’s decision, in my respectful view, does not advance that objective. By extending constitutional protection beyond its textual limits and on facts that do not disclose a cognisable violation under Article 18(2), the Court not only risks doctrinal uncertainty but, more fundamentally, reaches a conclusion that is difficult to sustain on the facts of the case. In that sense, while well-intentioned, the decision ultimately falls short.