What is Data anonymization?
Data anonymization[1] is the erasing or stripping off all personal data from the data collected in a manner that makes the data subject[2] unidentifiable. The aim of data anonymization is to ensure that the data subject remains anonymous by removing personal information like names, addresses, etc from personal data.
Ghana’s Data Protection Act (DPA)[3] defines personal data as “data about an individual who can be identified either from the data, or from the data or other information in the possession of, or likely to come into the possession of the data controller.”
Is Data anonymization applicable in Ghana?
Yes. Even though the DPA does not specifically use the term data anonymization, it is applicable because the Act requires that a data controller[4] omits or deletes all identifying particulars of other individuals when communicating information to a data subject.[5] This requirement amounts to data anonymization although there is no specific requirement on the form it should take.
The DPA also provides that a data controller must destroy or delete a record of personal data or de-identify the record in a manner that prevents its reconstruction in an intelligible form at the end of the retention period of records (that is the period necessary to achieve the purpose for which the data was collected and processed).
It is not a legal requirement to explain to the data subject how the anonymization will be done. All that is required is consent to collect data and the duty to ensure that there is anonymity of the data subject.
[1] https://www.imperva.com/learn/data-security/anonymization/
[2] “data subject” means an individual who is the subject of personal data under Section 96 the Data Protection Act, 2012 (Act 843) (DPA)
[3] Section 96 of DPA
[4] “data controller” means a person who either alone, jointly with other persons or in common with other persons or as a statutory duty determines the purposes for and the manner in which personal data is processed or is to be processed (Section 96 of DPA)
[5] section 35(7) of DPA
