Ghana's Supreme Court Strengthens Privacy Rights in Landmark SIM Registratin Case

In a groundbreaking judgment delivered on 25th February 2026, the Supreme Court of Ghana has affirmed that the unauthorised linking of a citizen’s Ghana Card to a mobile phone number constitutes a violation of the constitutional right to privacy under Article 18(2) of the 1992 Constitution.

How the Case Travelled Through the Courts

The journey began on 2nd May 2023, when Elorm Kwami Gorni, a customer of Vodafone Ghana, discovered that a phone number (0203618198) he did not know had been linked to his Ghana Card without his consent. Worse still, a Vodafone Cash account had been automatically provisioned in his name using the same unauthorised registration. On 22nd May 2023, he found that the number had been “delinked” — again without his knowledge.

High Court (16th November 2023): Gorni filed an application for redress under Article 33 of the Constitution at the Human Rights Court. The High Court dismissed his action, holding that it was “premature” because he had not exhausted the internal complaint resolution mechanisms of Vodafone and the National Communications Authority (NCA).

Court of Appeal (6th February 2025): Gorni appealed. The Court of Appeal unanimously overturned the High Court’s ruling on the prematurity issue, holding that a citizen seeking to enforce fundamental human rights need not wait on internal mechanisms — such delays could frustrate the vindication of constitutional rights. However, on the merits, the Court of Appeal dismissed the appeal, ruling that Gorni had failed to adduce sufficient evidence to prove a violation of his privacy rights.

Supreme Court (25th February 2026): By a majority of 4 to 1 (Amadu JSC, Prof. Mensa-Bonsu JSC, Kulendi JSC, Darko Asare JSC; Dzamefe JSC dissenting), the Supreme Court allowed the appeal, granting the declaration that Gorni’s privacy rights had been breached.

The Majority’s Reasoning
Writing the lead majority opinion, Prof. Mensa-Bonsu JSC (with whom three other justices concurred) held that the Court of Appeal had fundamentally misunderstood what amounted to “concurrent findings of fact.” The core issue — whether the appellant’s right to privacy had been breached — was a matter of law, not merely fact.

The Court found that Vodafone’s own affidavits admitted that prior to the SIM registration exercise, its salespersons had engaged in “pre-registering” SIM cards for commercial gain — a practice that undermined the integrity of the entire registration process. Yet Vodafone insisted that only someone with physical access to Gorni’s Ghana Card could have caused the unauthorised linking, subtly suggesting Gorni himself might be responsible.

The Supreme Court rejected this reasoning. Citing the Data Protection Act, 2012 (Act 843), the Court emphasised that data controllers and processors bear affirmative duties — under sections 17, 18, 20, 28 and 29 — to design systems that prevent unauthorised access and misuse. Vodafone’s two-stage registration process was not “foolproof” when its own agents had historically circumvented similar safeguards.

Justice Kulendi, in a concurring opinion, stressed that while individual items on a Ghana Card (name, age, height) may not be intrinsically private, their aggregation as a set of identifiers triggers a duty of confidentiality. He found that Vodafone’s failure to implement basic verification measures at Stage One created the conditions for the appellant’s personal data to be misused.

The majority also drew on comparative jurisprudence, including the Canadian Supreme Court’s decision in R. v. Bykovets (2024), which held that the internet has fundamentally altered privacy expectations, making the relationship between individuals, private third parties, and the state “tripartite.”

Reliefs Granted
The Supreme Court granted the following reliefs:

• Relief 1 (Declaratory relief): Granted — A declaration that the 1st and 3rd respondents breached the appellant’s privacy under Article 18 of the 1992 Constitution.
• Relief 2 (Order for records): Refused — The Court declined to order the respondents to furnish the appellant with call logs and Vodafone Cash statements.
• Relief 3 (Damages and costs): Granted against the 1st respondent only — General damages of GH₵10,000 and costs of GH₵10,000 were awarded to the appellant.

The Court characterised the damages as “nominal” because the case was largely one of public interest litigation, but emphasised that the award affirmed the principle that privacy violations have legal consequences.

The Dissenting Opinion
Justice Dzamefe dissented, arguing that the appellant failed to prove “interference with the privacy of property” as required by Article 18(2). He reasoned that a mobile phone number is not “property” in the constitutional sense but a licensed assignment subject to regulatory conditions. He also noted that Vodafone removed the number within 20 days of complaint — a reasonable “notice and takedown” response. The dissent, however, did not carry the day.

Significance of the Decision
This judgment sends a powerful signal to telecommunications companies and data controllers in Ghana: the right to privacy under Article 18(2) is not an empty promise. The Data Protection Act imposes affirmative systemic obligations, not merely prohibitions. Citizens need not exhaust internal complaint mechanisms before seeking judicial redress for constitutional violations. And the burden of proof, while resting on the claimant, must not be set “impossibly high” — especially when the critical records are in the hands of the respondent.

As the Court reminded us, quoting Shakespeare: “Good name in man and woman… is the immediate jewel of their souls.” In the digital age, that jewel now has constitutional armour.

   Comments0