THE RIGHT TO KNOW AND THE DUTY TO PROTECT

The recent public controversy surrounding the reported GH¢49.7 million expenditure on the evacuation of Ghanaians from South Africa raises important questions about transparency, accountability and the protection of personal data. Following a Right to Information (RTI) request, records relating to the evacuation have become the subject of public scrutiny, with reported discrepancies in the documentation and expenditure. Personal information relating to individual evacuees, including names, dates of birth, passport numbers, signatures and professions, has also appeared in media coverage.

There can be little disagreement about the public’s legitimate interest in knowing how government resources are utilised. The Right to Information Act, 2019 (Act 989), provides an important legal framework for promoting transparency and holding public institutions accountable. Indeed, the reported discrepancies demonstrate why access to public information is essential in a democratic society. However, the exercise of this right raises an equally important question: must the personal information of citizens be publicly exposed for government to be held accountable?

The individuals evacuated were beneficiaries of a government intervention. They are not, merely by virtue of appearing in the evacuation records, persons under investigation.

Ghana’s Data Protection Act, 2012 (Act 843), provides a separate but complementary framework for protecting personal information. The question, therefore, is not whether the public’s right to information should prevail over the individual’s right to personal data protection, or vice versa, but how both rights can be exercised without unnecessarily undermining each other.

This article examines the interplay between Acts 989 and 843, considers whether public accountability necessarily requires unrestricted disclosure of personal information, and raises questions about the responsibilities of public institutions, the media and the Data Protection Commission in ensuring that transparency does not come at the unnecessary expense of citizens’ personal data rights.

THE RIGHT TO KNOW: TRANSPARENCY AND PUBLIC ACCOUNTABILITY

The right to information enables citizens to scrutinise the decisions, actions and expenditure of public institutions and hold those entrusted with public resources accountable. In Ghana, this right is constitutionally recognised under Article 21(1)(f) of the 1992 Constitution and given statutory effect through the Right to Information Act, 2019 (Act 989).

Section 1 establishes the right of access to information, subject to the provisions of the Act, while Section 2 requires government to make general information on governance available to the public without a specific application.

The reported expenditure on the evacuation of Ghanaians from South Africa presents a legitimate case for exercising this right. How many citizens were evacuated? What criteria determined their eligibility? What expenditure was incurred, and were the supporting records accurate? These are questions that government should be able to answer.

However, the right to information has statutory qualifications. Section 16(1) exempts information where its disclosure would be unreasonable concerning an individual’s personal affairs. At the same time, Section 16(3)(c) recognises disclosure as reasonable where necessary to subject government activities to public scrutiny. Section 17 provides for disclosure in specified public-interest circumstances where the benefits clearly outweigh the harm or danger that disclosure would cause.

These provisions demonstrate that Parliament recognised both the importance of accountability and the need to protect legitimate private interests. The right to know is therefore not necessarily an unrestricted right to every piece of information contained in government records.

THE RIGHT TO BE PROTECTED: CITIZENS AS DATA SUBJECTS

While the public has a legitimate right to scrutinise government activities, individuals whose personal information is held by public institutions are equally entitled to protection under Ghana’s Data Protection Act, 2012 (Act 843). The fact that a government institution holds personal information does not automatically make it available for unrestricted public disclosure.

Section 17 establishes fundamental data protection principles, including accountability, lawfulness of processing, specification of purpose, compatibility of further processing and data security safeguards. Section 18(1) requires personal data to be processed lawfully, reasonably and without infringing the privacy rights of the data subject. Of particular relevance is Section 19, which establishes minimality by requiring the purpose for processing to be necessary, relevant and not excessive.

These principles are relevant to the evacuation controversy. Names, dates of birth, passport numbers, telephone numbers and signatures may legitimately have been collected to identify evacuees, verify eligibility and facilitate the exercise. Section 22 requires collection for a specific, explicitly defined and lawful purpose related to the collector’s functions or activities, while Section 25 governs the compatibility of further processing with the original purpose.

Section 20 recognises circumstances in which personal data may be processed without prior consent, including where processing is authorised or required by law or necessary for the proper performance of a statutory duty. The absence of consent, therefore, does not automatically establish unlawful processing. Nevertheless, a lawful basis must be considered alongside other applicable data protection principles and statutory exemptions.

A related concern is function creep, where information collected for one purpose is subsequently used for another, potentially unrelated purpose. Publicly exposed details may be combined with other records, including photographs obtained through social media, to construct personal profiles, increasing the risks of identity theft, impersonation, fraud and harassment. These risks are foreseeable even where no actual misuse has been established.

Information relating to children warrants particular care. Section 37(1)(a) specifically restricts processing personal data relating to a child under parental control, subject to the exceptions provided by the Act. Public exposure is especially concerning because subsequent circulation and misuse may be difficult to control.

The legitimacy of collecting personal data for a public purpose should not be confused with an unrestricted entitlement to disclose it for every subsequent purpose.

THE INTERPLAY BETWEEN ACTS 989 AND 843: CONFLICT OR COMPLEMENTARITY?

The two Acts pursue distinct but complementary objectives. Act 989 facilitates public access to information, while Act 843 regulates personal data processing. Their intersection raises two separate questions: the justification for the original disclosure and the justification for subsequent publication.

The Original Disclosure: The Right to Information and Its Limits

Act 989 recognises that public scrutiny may require disclosure of personal information. Section 16(3)(c) treats disclosure as reasonable where necessary to subject government activities to public scrutiny, while Section 16(1) protects against unreasonable disclosure concerning an individual’s personal affairs. Section 17 further provides for disclosure in specified public-interest circumstances where the benefits clearly outweigh the harm or danger that disclosure would cause.

Section 18(6) provides a practical way to reconcile access with protection. Where a requested record contains exempt information, the information officer must release as much as can reasonably be separated without revealing the exempt part. In ordinary terms, protected details can be removed while the rest of the record is made available.

Act 843 also permits certain processing without consent under Section 20. Section 66 exempts personal data from non-disclosure provisions where disclosure is required by an enactment, rule of law or court order. This allows institutions to fulfil legal disclosure duties. The extent of the duty remains important: does it require the identifying details, or can it be fulfilled by releasing records with those details removed?

In the evacuation controversy, the assessment therefore concerns what information was necessary for meaningful scrutiny and whether any exempt details could reasonably have been separated. That requires examination of the circumstances of the original release under the applicable provisions of both Acts.

Subsequent Processing: Does Lawful Access Justify Unrestricted Publication?

Even where complete records are lawfully released under Act 989, examining them for verification and reproducing their identifying details in public reporting require separate consideration.

An investigator may need complete records to authenticate beneficiaries, identify duplicate entries or verify expenditure. That need does not itself establish why the general public must receive the same personal details to understand the findings.

Section 19 of Act 843 establishes minimality, while Section 25 governs compatibility of further processing. Even where information is publicly available, compatibility does not itself dispense with other applicable data protection requirements. Section 64(2) expressly preserves specified principles, including minimality, in the journalism context.

In the evacuation controversy, the central question is therefore whether publishing the evacuees’ identifying details was necessary to communicate the reported discrepancies and enable public scrutiny. The legitimacy of investigating the expenditure does not, by itself, settle that question.

ACCOUNTABILITY WITHOUT UNNECESSARY EXPOSURE: IS THERE ANOTHER WAY?

Public accountability can be achieved through mechanisms that allow meaningful scrutiny while limiting unnecessary exposure of personal information.

The evacuation controversy provides a practical illustration. If an examination establishes that some beneficiaries did not sign the required documentation, that finding can be reported without identifying them. Similarly, duplicate name entries can be demonstrated using consistently masked identifiers, allowing readers to see the repetition without revealing the actual names. The public can then assess the discrepancies and demand explanations about the accuracy of the records and the expenditure.

Independent verification or auditing provides another option. Investigators could examine complete documentation under appropriate data protection safeguards, reconcile expenditure and identify irregularities. Their methodology, supporting evidence and findings could then be published with identifying details redacted where unnecessary to understand or test the conclusions.

Redaction, consistent masking and controlled access therefore offer practical ways to preserve the evidential value of records while protecting the individuals whose information they contain.

These safeguards must not, however, become new barriers to accountability. Journalists and other legitimate investigators should retain access to identifiable records where the law justifies it. Above all, the duty to protect personal data must never become a pretext for withholding information on how public money was spent. Redaction is a tool for releasing records responsibly, not a reason for refusing to release them.

INVESTIGATIVE JOURNALISM AND PERSONAL DATA PROTECTION: STRIKING THE BALANCE

Media organisations play an indispensable role in holding public institutions accountable. Their scrutiny of the evacuation expenditure has brought reported discrepancies in official records to public attention and created an opportunity for government to explain how public resources were used. That role deserves protection, and Act 843 recognises it.

Section 64 of Act 843 gives journalism, literature and art special consideration, subject to specified conditions. These include a reasonable belief that publication is in the public interest and that compliance with particular provisions would be incompatible with those purposes. Even so, Subsection (2) preserves certain core principles, including lawful processing, minimality, further processing, information quality and security safeguards. The law therefore gives the press room to work, while asking that personal information be handled with care.

This is a responsibility shared by everyone who handles such records, from the institutions that release them to those who analyse and report on them. For journalists, the practical question is a familiar editorial one: how much identifying detail does a story need in order to be understood and believed? In reporting discrepancies such as those in the evacuation records, masked names, partial passport numbers or redacted signatures can often demonstrate the finding as effectively as the full details, while protecting evacuees who are not themselves the subjects of the investigation. Their personal details should not be exposed merely because they appear in the records under scrutiny.

Credibility does not depend on exposure. Consistently masked records, together with a clear account of the method used, can show readers exactly where the discrepancies lie, while the complete records remain available to the institutions and auditors that are entitled to test them.

The public interest in the investigation is clear. Serving that interest well means weighing the details displayed against their relevance to the findings and the foreseeable risks to the individuals concerned, particularly children. Guidance from the Data Protection Commission, developed with the Right to Information Commission and the National Media Commission, which is constitutionally mandated to maintain the highest journalistic standards in the mass media, would support the media in continuing its accountability work with confidence.

 

THE DATA PROTECTION COMMISSION: FROM REGULATORY REVIEW TO PRACTICAL PROTECTION

The evacuation controversy calls for Ghana’s Data Protection Commission (DPC) to exercise its mandate in reconciling public scrutiny with personal data protection. Appropriately, the DPC has announced a regulatory review of the disclosure of the evacuees’ personal information. In a statement issued on 20 October 2026, as reported by Citi Newsroom and the Ghana News Agency, the Commission said it would examine the legal basis for the disclosures, the safeguards applied and whether the affected individuals’ privacy rights had been protected. It also urged restriction or redaction of publicly accessible identifiers whose continued disclosure could not be legally justified.

This intervention gives practical expression to the Commission’s responsibilities under Sections 2 and 3 of Act 843. The review should clarify whether the original disclosure and subsequent publication complied with the applicable principles and exemptions, determine where responsibility lies if non-compliance is established, and give particular attention to information relating to children.

Protection should also address the continued availability of identifying details. The Commission should follow through on its call for protective measures so that information whose publication cannot be justified does not remain unnecessarily accessible while the review proceeds.

Beyond this incident, Section 86(1) requires the Commission to provide guidelines and promote good practice. Working with the Right to Information Commission, the DPC should translate the review’s findings into guidance on release, verification and publication, including practical standards for redaction, masking and controlled access.

The value of the intervention will ultimately lie in its findings, appropriate regulatory action and safeguards that preserve public scrutiny while protecting the individuals concerned.

CONCLUSION

The evacuation controversy illustrates why Ghana must uphold the public’s right to scrutinise government alongside the individual’s right to personal data protection, and why the Data Protection Commission’s review, and the guidance that should follow it, matter beyond this case.

The public is entitled to demand an account of the evacuation expenditure and the reported discrepancies. Access to complete records may assist that scrutiny, but it does not explain why the evacuees’ identifying details must accompany the published findings. Citizens should not be exposed to avoidable risks of identity theft, fraud and harassment simply because they benefited from a government intervention. The right to information carries with it a duty to protect. Those who obtain personal data in the pursuit of accountability also bear responsibility for how they use and disclose it.

Ultimately, the right to know how government conducts public affairs should not become an unrestricted right to expose the personal information of the citizens it serves. Ghanaians are entitled to transparency, accountability and personal data protection. Our institutions, and all who handle the information they release, must ensure that all three are upheld.