THE INTERNET OF THINGS AND DATA PRIVACY IN GHANA: ASSESSING THE ADEQUACY OF THE DATA PROTECTION ACT, 2012 (ACT 843).

The rampant development and use of the Internet of Things (IoT) has inherently impacted the way individuals interact with contemporary technology and has resulted in a new era of legal challenges. Previously, technology required direct human action to operate, but IoT devices, such as smart home devices and wearable health monitors, can automatically collect, share, and process personal data. This change has raised new questions, such as ‘Who owns the data collected by IoT?’ that the law must answer, particularly in developing jurisdictions such as Ghana. This Article addresses whether Ghana’s Data Protection Act, 2012 (Act 843) — the country’s primary legislative instrument concerning data protection — is sufficient to address the novel privacy risks posed by the IoTs The enactment of Act 843 in 2012 was a praiseworthy attempt to create a regime that embraces technology, data collection and data protection. Nevertheless, times have changed and newer and more advanced innovations such as IoT devices are now readily available and there is a need for legislative reform.This Article proceeds as follows: Part II concerns IoT and its data privacy implications, and provides an overview of the Data Protection Act; Part III addresses the shortcomings of the Data Protection Act, 2012 (Act 843), in the context of IoT, Part IV talks about recommendations for legislative reform; and Part V is the conclusion.

Part II: Internet of Things and Its Data Privacy Implications

The Internet of Things refers to a network of physical devices embedded with sensors, software, and connectivity tools that enable them to collect and exchange data over the internet with little to no human intervention[1].  The term ‘Internet of Things’ was coined by Kevin Ashton in 1999, who envisioned IoT as a system in which computers could gather information without relying on human input, reasoning that individuals have limited time, attention, and accuracy, and thus are not good at capturing data about the real world.[2] IoT is used almost everywhere, such as in agriculture and security (cameras). IoT has versatile privacy ramifications. First, IoT devices engage in continuous, pervasive, and often invisible data collection by constantly logging intimate physical baselines and environmental data in non-healthcare contexts [3]. Unlike conventional gadgets that demand a user to consciously log on, IoT devices such as fitness trackers and connected home appliances automatically collect, record and share personal data including habits. The data collected is intimate in nature, especially those that are collected by smart home appliances. Under the Terms of Service agreement, the manufacturers may be allowed to share the data gathered with law enforcement and advertisers. Second, the amount of data collected creates an avenue for data breaches, unauthorized access, as well as the use of personal data in a manner contrary to the reason it was collected.[4]

The above risks affect the right to privacy entrenched in the 1992 Constitution of Ghana negatively. Article 18(2) of the 1992 Constitution of Ghana which provides that “No person shall be subjected to interference with the privacy of his home, property, correspondence or communication except in accordance with law and as maybe necessary in a free and democratic society for public safety or the economic well-being of the country, for the protection of health or morals, for the prevention of disorder or crime or for the protection of the rights or freedom of others”,  grants every Ghanaian the right to privacy in their home, correspondence, and communications. Though this was drafted way before the introduction of advanced technology, it has been interpreted to include them. It can be seen that Article 18(2) of the 1992 Constitution of Ghana, on which other data privacy legislation must be built, is undermined by IoT’s continuous and pervasive nature, which weakens the constitutional guarantee.

Description of the Data Protection Act, 2012 (Act 843)

Ghana’s Data Protection Act, 2012 (Act 843) was enacted to regulate the collection and processing of personal data to ensure the protection of the privacy of individuals. The Act establishes the Data Protection Commission (DPC) as the regulatory authority responsible for overseeing compliance with its provisions, protecting individuals’ privacy, handling complaints, and issuing enforcement notices. The DPC has the authority to maintain a register of data controllers, and any person or entity processing personal data must register with the Commission[5].

The Act provides data protection principles drawn from international laws and regulations, such as the requirement that personal data be collected for a specified, explicit, and legitimate purpose; that data be adequate, relevant, and not excessive; and that data be kept accurate and up to date. [6]Act 843 also requires data controllers to obtain the consent of data subjects before processing their personal data, with limited exceptions. The Act also grants rights to data subjects, including the right of access to their data and the right to object to processing, amongst others.

These provisions reflect internationally accepted data protection principles encompassed in instruments such as the European Union’s now-superseded Data Protection Directive and the foundational 1981 Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108), from which Act 843 is drawn. This legislative framework (Act 843) was definitely a viable enactment at the time. However, the question of its adequacy must now be evaluated against the specific demands of IoT technology, which in 2012 was not yet fully developed.

Part III Shortcomings of Act 843 Falls in the IoT Context

The Issue of Consent.

Act 843 is built on the principle of informed consent. Under Section 20 of Act 843, a data controller must obtain the data subject’s consent before processing personal data unless the purpose for processing is required or authorized by law. This shows that the law presupposes that there was a time when a person received notice of the data collection, understood it, and actively agreed to it. This consent model does not fit or align with the reality of IoT technology.

IoT devices barely convey clear consent mechanisms. For instance, a smartwatch may collect location data, phone data, and usage data daily, with consent to the collection buried in long, often incomprehensible Terms of Service agreements that most users genuinely accept without reading. In the landmark case of Vidal-Hall v Google Inc, the English Court of Appeal recognized that privacy violations arising from covert online data collection could ground tortious claims without needing to prove financial loss[7]. This ruling by the Court of Appeal underscores the inadequacy of standard consent models in the digital environment. While this decision does not bind Ghanaian courts, it exposes the inadequacy of passive consent frameworks in data-intensive technological environments, meaning that assuming a user has consented to data collection through lengthy terms of service agreements is not enough in an era where large volumes of data are being collected and processed.

In the traditional setting, a user gives consent to a single organization for the processing of data; however, in the IoT ecosystem, many organizations may be involved in the collection and processing of the same data. Act 843 does not address this multi-party consent challenge, in which data may pass through device manufacturers, cloud service providers, and third-party analytics firms, each processing the same personal data under distinct conditions.

Ambiguity Regarding Data Controllers in IoT Ecosystems

Act 843 assigns the primary data protection obligations to “data controllers,” defined by the same Act as “a person who either alone, jointly with other persons or in common with other persons or as a statutory duty determines the purposes for and the manner in which personal data is processed or is to be processed”[8]. With regards to IoT devices, the determination of who constitutes the “data controller” is opaque in certain instances, such as when the manufacturer of a smart device, the telecommunications company providing it with connectivity, the cloud platform storing the data, and the third-party application may all exercise concurrent access and authority over personal data.

The lack of clear provisions in Act 843 regarding the obligations and responsibilities of data processors in the IoT ecosystem results in implementation loopholes. Courts in the European Union have addressed the question of ‘Who is a data controller?’; for instance, in Google Spain SL v Agencia Española de Protección de Datos[9], the Court of Justice of the European Union held that an organization acts as a search engine, processes data thus a data controller as referred to the EU data protection law and are subject to the obligations stated in the legislation including respecting the data subjects’ right to be forgotten. Ghana’s jurisprudence lacks such a development, and Act 843 provides no examples of data controllers.

Security Obligations and IoT Vulnerabilities

Section 28(1) of Act 843 requires data controllers to take appropriate technical and organizational measures to protect personal data. However, the Act does not elaborate on what “appropriate” measures mean in the context of IoT devices, which are very likely to be targets of cyberattacks due to the vast amount of data they process and their limited ability to receive security patches.

The 2016 Mirai Botnet attack — in which cybercriminals hacked poorly secured IoT devices to launch one of the largest Distributed Denial of Service attacks  — demonstrated the catastrophic consequences of inadequate IoT security.[10] The security obligation under Act 843 is insufficient to compel manufacturers to include security-by-design in IoT products before they reach Ghanaian consumers.

Constitutional Dimensions and Judicial Interpretation

The 1992 Constitution of Ghana is the supreme law of the land, and any legislation inconsistent with it is void to the extent of the inconsistency as provided for in Article 1(2) of the same. Article 18(2) of the 1992 Constitution of Ghana, as stated before, provides the constitutional anchor for data privacy. In the context of IoT, a purposive interpretation of Article 18(2) of the 1992 Constitution of Ghana would likely extend constitutional privacy protection to personal data collected by IoT devices, since such data frequently reveals information about a person’s home, communications, and personal associations — the very interests the provision was designed to protect. However, there has been no direct judicial pronouncement in Ghana on the intersection of IoT technology and constitutional privacy rights, leaving a significant jurisprudential void.

Internationally, the Indian Supreme Court’s decision in Justice K.S. Puttaswamy (Retd.) v Union of India [11], where the Court ruled that the right to privacy was a fundamental constitutional right that encompasses three distinct dimensions: bodily privacy, autonomy, and informational privacy, provides a more cogent authority. The court’s reasoning shows how purposive interpretation of Statutes helps identify the lawmakers’ intention as well as the legislation’s purpose.  This case also emphasizes that the State cannot ‘weaponize’ personal data against individuals, a concern that also applies to IoT devices. The Ghanaian legal system has no such interpretation. It is important to note that, in assessing Act 843, jurisprudential insistence on substantive adequacy is directly relevant to ensuring that the mechanisms put in place are actually followed.

Part IV – Recommendations for Legislative Reform

From the above analysis, it can be concluded that Act 843 requires substantive legislative reform to govern IoT devices and the data they process properly.

First, the government should consider amending Act 843 to include specific rules on the Internet of Things (IoT) or create new regulations to directly address data collection from IoT devices. It should provide clear rules for obtaining consent appropriate to the context of ambient data collection. Additionally, Manufacturers should be obliged to follow the principles of privacy-by-design in relation to all IoT devices sold or distributed in Ghana.

Secondly, the Act must include a strong data minimization principle. This means it should clearly state that collecting personal data beyond what is necessary for a specific purpose is prohibited and constitutes a crime. Additionally, the legislative organ should establish joint liability rules that clearly define who is responsible for data protection across the IoT supply chain. This includes everyone from device manufacturers to cloud service providers and app developers. This approach should be based on the model in the EU’s General Data Protection Regulation (GDPR) 2016/679, specifically Article 26, which provides for joint controllers, and Article 28, which addresses data being processed on behalf of a data controller.

Finally, Ghana should invest in judicial education on digital privacy and data protection, equipping courts with knowledge to adjudicate IoT-related privacy claims confidently and to engage with comparative jurisprudence, such as that of Kenya, in a principled and informed manner.

Part V – Conclusion

Ghana’s Data Protection Act, 2012 (Act 843), stands as a foundational and praiseworthy instrument of data governance. However, as this Article has demonstrated, the Act was conceived in an era before the IoT had attained its current scale and sophistication, and its provisions are not calibrated to address the unique challenges that IoT technology presents. The inadequacy of the consent model, the ambiguity surrounding data controllership in IoT ecosystems, and the insufficiency of security requirements collectively reveal significant legislative gaps that raise the question: ‘Is our right to privacy under Article 18(2) of the 1992 Constitution of Ghana really protected?’  Ghana must make an effort to adjust its laws to encompass the proliferation of IoT.

Reference(S):

Legislation

Constitution of the Republic of Ghana,1992

Data Protection Act 2012(Act 843)

Cases

Vidal- Hal v Google Inc[ 2015] EWCA Civ 311,[2016] QB 1003

Google Spain SL v Agencia Española de Protección de Datos  (Case C-131/12) EU:2014:317

Justice K.S. Puttaswamy (Retd.) v Union of India (2017) 10 SCC1

Secondary Sources

De Hert P and Papakonstantinou V, ‘The New General Data Protection Regulation: Still a Sound System for the Protection of Individuals?’ (2016) 32(2) Computer Law & Security Review 179

Wattsense, ‘What is IoT? : Definition’ (Wattsense, 5 February 2026) https://www.wattsense.com/resources/glossary/iot/ accessed 17 June 2026

Ashton K, ‘That “Internet of Things” Thing’ (RFID Journal, 22 June 2009) https://www.rfidjournal.com/expert-views/that-internet-of-things-thing/73881/ accessed 20 June 2026

Sella-Villa D, ‘How Internet of Things devices affect your privacy’ (University of South Carolina, 25 June 2025) sc.edu accessed 20 June 2026

Cybersecurity and Infrastructure Security Agency, ‘Heightened DDoS Threat Posed by Mirai and Other Botnets’ (CISA, 14 October 2016) cisa.gov accessed 20 June 2026

[1] Wattsense, ‘What is IoT? : Definition’ (Wattsense, 5 February 2026) <www.wattsense.com/resources/glossary/iot/> accessed 17 June 2026.

[2] Kevin Ashton, ’That “Internet of Things” Thing’ (RFID Journal,22^nd June 2009)

[3]David Sella-Villa, ‘How Internet of Things Devices Affect Your Privacy’ (University of South Carolina, 25 June 2025)

[4] Paul De Hert and Vagelis Papakonstantinou, ‘The New General Data Protection Regulation: Still a Sound System for the Protection of Individuals?’ (2016)

[5]Data Protection Act 2012 (Act 843) (Ghana), s3

[6]Ibid ss 17-19 .

[7] [2015] EWCA Civ 311,[2016] QB 1003

[8]Data Protection Act 2012, s 96

[9] Case C-131/12 EU: C: 2014 :317

[10]Cybersecurity and Infrastructure Security Agency, ‘Heightened DDoS Threat Posed by Mirai and Other Botnets’ (CISA, 14 October 2016) cisa.gov accessed 20 June 2026

[11](2017) 10 SCC 1 (India)