Wilmar Africa, De Heus, other food processing companies face CID action over data breaches 

Four food processing companies in Tema have been referred to the Criminal Investigations Department (CID) of the Ghana Police Service over alleged breaches of the Data Protection Act, 2012 (Act 843).

The companies are Barry Callebaut, TF Commodities, Wilmar Africa Limited and De Heus, which were cited for operating without valid data protection certificates, using expired certificates or failing to produce their certificates during compliance checks.

The Data Protection Commission (DPC) identified the breaches during inspections at the Free Zones Enclave on Tuesday as part of a week-long enforcement exercise to ensure organisations handling personal data complied with the law.

Mr Quintin Akrobotu, Director of Regulatory and Compliance at the DPC, told the media that Barry Callebaut had no valid certificate, while TF Commodities' certificate had expired in 2020.

Wilmar Africa Limited was also unable to produce a valid certificate and confirmed that its previous certificate had expired, although it was taking steps to renew it.

De Heus had registered with the Commission but could not produce its certificate during the inspection.

The Commission's records showed that the company had collected the certificate, which was due for renewal next year.

Mr Akrobotu said Barry Callebaut had been directed to report to the CID headquarters in Accra by Wednesday, October 14, to explain its failure to renew its certification.

TF Commodities and Wilmar Africa Limited had also been invited to provide statements on their compliance failures.

He said registration and certification were mandatory for organisations collecting and processing personal information, adding that certificates had to be renewed every two years under Section 50 of Act 843.

“If a certificate is expired, it's as good as you are not registered,” he said, urging organisations to maintain valid certification and adopt appropriate safeguards for personal information.

Mr Akrobotu commended Cargill Ghana Limited and Imperial Health Sciences, also known as DP World, for demonstrating compliance.

He said Cargill had renewed its certificate and appointed a Data Protection Supervisor in accordance with Section 58 of the Act. The company was, however, required to submit a report on the supervisor's training and compliance activities by October 31.

DP World had also renewed its certification, appointed and trained a data protection supervisor, and demonstrated measures to protect customers' and employees' personal information.

Mr Akrobotu urged institutions to train more data protection supervisors and equip employees with the knowledge to handle personal information responsibly.

He also condemned alleged attacks on journalists covering the exercise, saying they were reporting the Commission's findings and should not be targeted for doing their work.

He urged institutions dissatisfied with reports arising from the inspections to seek clarification from the Commission rather than attack journalists or media houses.

Mr Akrobotu said the enforcement exercise would continue until organisations processing personal information complied with the law.

GNA