When The Pen Cuts Deeper Than Intended: Journalists, Data Protection and The Law In Ghana

A Professional Analysis for Data Protection Officers and Media Practitioners

On 23 April 2026, several Ghanaian media outlets, including GhanaWeb and Starr FM, reported that Christopher Arthur, a Relationship Manager at a private bank, had been arraigned before the Circuit Court for allegedly stealing GH¢12 million from a client and spending GH¢600,000 of the proceeds on sports betting. The case is significant not only for its criminal dimension but for what it unwittingly demonstrates about a pervasive, largely unexamined problem in Ghanaian journalism: the routine publication of personal data in court reporting without any apparent awareness that such publication may violate the Data Protection Act, 2012 (Act 843). This article uses the specific facts of that report as a teaching instrument, examining three discrete data protection issues that it raises — the publication of bank account numbers, the naming of uncharged third parties, and the photographing of an unidentified woman in the court — and applies the provisions of Act 843 with precision.

I. The Foundation: Personal Data and the Duty of Protection

Before examining the specific breaches, it is necessary to establish the conceptual foundation. Section 96 of Act 843 defines personal data as "data about an individual who can be identified (a) from the data, or (b) from the data or other information in the possession of, or likely to come into the possession of the data controller." A bank account number directly identifies its holder in any financial system. A facial image identifies a person by sight. A person's full name, linked to an alleged criminal act, identifies both the individual and the nature of the allegation against them. All three categories of data appeared in the GhanaWeb report. All three are personal data within the meaning of the Act.

Section 17 of Act 843 places every person who processes data under a positive obligation to protect the privacy of the individual by applying eight principles, including accountability, lawfulness of processing, specification of purpose, minimality, openness and data security safeguards. A media organisation publishing a news article is processing personal data. It is, for the purposes of the Act, a data controller. The question is whether it complied with these principles — or whether it sheltered behind the journalism exemption without appreciating its legal limits.

II. The Account Numbers: A Clear and Unnecessary Breach

The most striking data protection failing in the GhanaWeb article is the verbatim publication of multiple bank account numbers. The article published, in full: three account numbers belonging to the complainant-victim (3225001012288, 3225001014107, 3225001029512); a UBA account number allegedly used to siphon funds (01638808901552); a Stanbic Bank account number (9040001246182); and an Access Bank account number (1032000002023) attributed to a named third party, Adafia Caeser Shadrack.

Journalists who publish such material routinely assume that because the information originated from open court proceedings it is freely publishable without legal consequence. This assumption is legally unsound under Act 843.

Section 64(1) provides the journalism exemption but qualifies it stringently: a data controller may only rely on it where "the data controller reasonably believes that publication would be in the public interest" and "the data controller reasonably believes that, in all the circumstances, compliance with the provision is incompatible with the special purposes." Critically, section 64(2) expressly preserves full compliance obligations in respect of four principles even when the exemption is claimed, namely: "(a) lawful processing, (b) minimality, (c) further processing, and (d) information quality." The journalism exemption does not — and Parliament has expressly stated that it does not — release journalists from the duty of minimality.

Section 19 of Act 843 is unambiguous: "Personal data may only be processed if the purpose for which it is to be processed, is necessary, relevant and not excessive." The publication of the account numbers fails every limb of this test. The public interest purpose — reporting a criminal prosecution — is entirely achievable without printing the account numbers. Stating that "the accused managed three accounts belonging to the complainant" conveys the same journalism. The actual numbers add no informational value to public understanding of the case. They are, by any reasonable assessment, excessive in relation to the journalistic purpose. They fail the minimality test on the face of the statute.

The position is made worse by the fact that the accounts numbered 3225001012288, 3225001014107 and 3225001029512 belong to the victim of the alleged crime — a businessman who was not named, who did not consent to the publication of his financial identifiers, and who is now more exposed to secondary fraud risk by virtue of having his account details published in a widely read national online platform. Section 88(1)(c) of Act 843 prohibits any person from disclosing "to another person the information contained in personal data" without lawful authority. The journalist and the media house, as data controllers, bear the burden of demonstrating lawful authority for this disclosure. That burden cannot be discharged by pointing to section 64 when section 64(2) expressly retains the minimality obligation.

III. The Unnamed Accomplices and The Uncharged Third Party

The article names two alleged accomplices — Gyamfua Obaayaa and Abigail Thelma, described as based in Kumasi — and also names Adafia Caeser Shadrack as the holder of the Access Bank account allegedly used to withdraw GH¢7.5 million. As of publication, none of these individuals had been arrested, charged, or appeared before any court.

Section 37(1)(f) of Act 843 designates as special personal data information relating to "the commission or alleged commission of an offence by the individual" and section 37(1)(g) extends this to "proceedings for an offence committed or alleged to have been committed by the individual." Special personal data attracts the highest level of protection under the Act. Section 37(2) permits processing of special personal data only where "processing is necessary, or the data subject consents to the processing." Neither condition is met in respect of Obaayaa, Thelma and Shadrack. They are persons merely named in prosecutorial narration, not parties to proceedings, and they have demonstrably not consented.

Furthermore, section 26 — the quality of information principle, which is also expressly preserved by section 64(2) — requires that "a data controller who processes personal data shall ensure that the data is complete, accurate, up to date and not misleading." Publishing the name and account details of Adafia Caeser Shadrack in the context of a GH¢12 million theft, without establishing or stating whether Shadrack was a knowing participant, an identity fraud victim, or a bystander, is potentially misleading processing of special personal data — a double violation of Act 843.

IV. The Woman In The Photograph: The Forgotten Data Subject

The article's accompanying image — drawn from a tweet by GHOne TV — shows Christopher Arthur in the courtroom. A second, unidentified woman is visible behind him. Her face is captured, published, and now permanently indexed across search engines. She is not a party to any proceedings. She has not been identified by name. She may be a family member, a court officer, or an entirely unconnected bystander.

Her facial image is personal data within section 96 of Act 843. Its publication constitutes processing. The journalism exemption under section 64 cannot extend to her image because her inclusion in the photograph serves no journalistic purpose. She is not the story. Section 19's necessity requirement is not met. Section 18(1)(a) requires that personal data be processed "without infringing the privacy rights of the data subject." Publishing the image of an identifiable, uncharged, unnamed individual who happens to be standing near an accused person in a courtroom plainly fails this test. Her right to privacy under Article 18(2) of the 1992 Constitution reinforces this conclusion.

Best journalistic practice — codified in media ethics frameworks globally — requires that individuals who are not parties to a reported proceeding be excluded from photographs, or that their images be pixelated. The fact that this was a court proceeding open to the public does not dissolve the obligation. Consent to physical presence in a public space is not consent to photographic capture and mass online publication.

V. The Lesson for Journalists And Their Organisations

None of the foregoing analysis suggests that the Christopher Arthur case should not have been reported. Court proceedings are public. Criminal accountability is a matter of genuine public interest. The reporting serves a legitimate purpose. The problem is not the journalism — it is the execution. Journalists in Ghana are, with few exceptions, unaware that they are data controllers when they process personal data in the course of reporting. They are unaware that the journalism exemption under section 64 is qualified, not absolute, and does not release them from the minimality, lawfulness, quality and further processing obligations under the Act. They are unaware that section 43 of Act 843 entitles any person who "suffers damage or distress through the contravention by a data controller" to compensation.

Section 86(3) of Act 843 assigns to the Data Protection Commission the responsibility to "conduct public education and awareness campaigns to the public on the rights of data subjects and the obligations of data controllers." This provision should serve as the basis for a structured media sector programme, delivering Act 843 literacy to editors, reporters, court correspondents and digital publishers. The Commission's enforcement powers under sections 75 and 78 — including the power to issue enforcement notices and make formal determinations against data controllers who process in a manner inconsistent with the Act — are available where media organisations fail to comply.

The Christopher Arthur story is a teachable moment. The account numbers should not have been printed. The third parties should not have been named without formal charge. The woman's face should have been blurred. Each of these omissions was an editorial choice. With proper data protection training, they would have been different choices.