…The case of Arthur V National Communication Authority, Attorney General & others
The 1992 Constitution, envisages three arms of government, the Executive, Legislature and Judiciary with their respective powers, separated, dispersed and laid down in Articles 58, 93 (2) and 125 respectively. These arms of government are however expected to work in harmony in the governance of the State, counter-balancing their powers without necessarily interfering in each other’s role. A form of checks and balances so no one arm of government oversteps its limits. The challenges with this arrangement is often where the Executive is trying to overstep its boundaries and the will of the other arms to stop it.
There have been situations that the opportunity has arisen where the Judiciary was in a position to limit the powers of the Executive but did not have the will to do so as in the famous and celebrated case of Re Akoto and 7 others case. It is however heart-warming that we still have Judges who are bold spirits to interpret the law without fear or favour and not timorous by putting the Executive in check as shown in the recent case of Francis Kwarteng Arthur v National Communication Authourity, Attorney General & Others (Arthur case).
The Arthur case is a classic case where the powers of the Executive, the President, has been limited by the Judiciary to the extent of violating the right to privacy of subscribers/customers of the Telecommunication companies (Telcos), through the issuance of an Executive Instrument (E.I.63) in accordance with Section 100 of the Electronic Communication Act, 2008 (Act 775) during the Covid-19 Pandemic. This was to collect personal information from the Telcos to set up an emergency communication system.
I intend to review the Arthur case with respect to the issue of the violation of the Right to Privacy of citizens, customers of the Telcos, by the President of the Republic of Ghana. I will tease out the laws and legal principles on which the case was subjected to, that is the Constitution, the Electronic Communication Act, the Oakes test, and the Executive Instrument (E.I.63). I would take interest in the Data Protection Act and its Principles which the case did not really deal with but which in my opinion was most relevant. My approach will be to give summary of the issues of the case from each party’s perspective, look at the ruling and analysis of Her Ladyship Rebecca Sittie who boldly concluded that aspects of the President’s Executive Instrument and its implementation had violated the Human Rights of Right to Privacy of customers of the Telcos as enshrined in the 1992 Constitution. Finally, I will then give an opinion on its implications on the Executive, the Telcos and the customers of Telcos.
THE CONSTITUTION AND RIGHT TO PRIVACY
Under Article 18 (2) of the 1992 Constitution, “No person shall be subjected to interference with the privacy of his home, property, correspondence or communication except in accordance with law and as may be necessary in a free and democratic society for public safety or the economic well-being of the country, for the protection of the rights or freedoms of others”
THE CONSTITUTION AND POWERS OF THE PRESIDENT
Under Article 58 (1) of the 1992 Constitution, executive power resides in the President of the Republic of Ghana. The President therefore has power as the Head of State and Head of Government and Commander-in Chief of the Armed Forces of Ghana. The President also has certain extraordinary powers in emergency situations as prescribed under Article 31 of the Constitution. In all, these powers must be exercised in accordance with the provision of the Constitution, that is within the limits as prescribed with checks and balances by the Judiciary and the Legislature in ensuring that the democratic rights of the citizens are not compromised.
In that sense, the need to protect public health interest during a health emergency has to be balanced with the preservation of our democracy with respect to the fundamental human rights and freedoms as enshrined under the 1992 Constitution.
SECTION 100, ELECTRONIC COMMUNICATION ACT, 2008 (Act 775)
This reads “The President may, by executive instrument, make written requests and issue orders to operators or providers of electronic communications networks or service providers requiring them to intercept communications, provide any user information or otherwise in aid of law enforcement or national security”.
This was the law that was invoked by the President to issue Executive Instrument 63
THE OAKES TEST OR PERMISSIBLE LIMITATION TEST
The Oakes test is a legal test created by the Supreme Court of Canada in the case R v Oakes (1986). It is a three-way test for which all must be passed should the Executive, President, wish to limit the fundamental human rights of citizens in the interest of the public as enshrined in the Constitution. First, the process must be legal, pre-determined by law. Secondly, the purpose must be legitimate in a democracy and finally, the measure adopted for achieving the purpose must be proportionate to the ends to be achieved.
A breach of this test translates to losing the exceptions granted under Article 18 (2) of the Constitutions that allows the Executive to interfere with the Right to Privacy of the citizens.
Having highlighted the legal principles, let us delve into the case.
THE CASE OF THE EXECUTIVE UNDER EXECUTIVE INSTRUMENT (E.I.) 63
The President, committed in dealing with emergency situations, especially public health emergencies, and with the urgent need to establish an emergency communications system to trace all contacts of persons suspected of or actually affected by a public health emergency, and identify places visited by persons suspected of or actually affected by a public health emergency, in this instance COVID-19, ordered the Telcos to provide the following information to State agencies:
- All caller and called numbers;
- Merchant codes;
- Mobile Station International Subscriber Directory Number Codes (MSISDN);
- International Mobile Equipment Identity Codes (IMEI) and site location;
- Roaming files and location logs.
Basically the President was drawing his power under that part of Article 18(2) of the Constitution that reads “… except in accordance with law and as may be necessary in a free and democratic society for public safety or the economic well-being of the country, for the protection of the rights or freedoms of others” (emphasis mine).
THE CASE OF FRANCIS KWARTENG ARTHUR, ESQ
Arthur’s case with respect to his privacy is quite simple. The President’s directive under E.I. 63 which draws sustenance from Section 100 of Act 755 and its implementation has violated or is likely to violate his right to privacy under Article 18 of the Constitution and also are unreasonable and disproportionate.
Arthur was also basically drawing his power from the same Article 18(2) of the Constitution but the part that reads “No person shall be subjected to interference with the privacy of his home, property, correspondence or communication…”(emphasis mine).
So for the same Article 18 (2), both parties are in court. Lawyers “paaa”, they never cease to amaze me. Is it try your luck or what? Anyway,what did the judge say by way of ruling?
RULING/ORDERS OF THE COURT
The High Court gave the following ruling and orders:
- The request by the President for the Telcos to provide details of all subscribers’ information on international roaming constituted an interference with the right to privacy as protected by Article 18(2) of the 1992 Constitution. Consequently, the court ordered the Telcos not to continue to provide the President with details of caller and called numbers and details relating to all outbound roaming data. They were also to expunge data that has already been collected by the President.(emphasis mine).
- The court expunged the provision for details of caller and called numbers of subscribers and all details relating to same on all out bound roaming data from E.I.63 and the guidelines developed by the National Communication Authority, and ordered that E.I. 63 be amended to reflect same.
- On the Oakes test, with respect to legality, the court ruled that of course the process for passing E.I. 63 was in accordance with law, however the request and release of certain information failed the legitimacy test and as put by Her Ladyship Rebecca Sittie:
“…there is no way that a merchant code or the details of a mobile money operator can assist in contact-tracing, as such details cannot by the most basic scientific understanding aid the spread of the novel corona virus”.
Again the court found that the request and release of certain information failed the proportionality tests in that the request for subscriber’s international roaming details was beyond the purpose of E.I. 63 and that the President may need that information for other purposes but not a Public Health pandemic in Ghana. Her Ladyship Rebecca Sittie said:
“I am of the view that international roaming details have nothing to do with contract tracing in Ghana for managing the Covid-19 pandemic. This is clearly an infringement of the Applicant’s right to privacy as well as freedom of movement and association”
This in no uncertain terms is a bold ruling.
INFRINGEMENT OF DATA PROTECTION ACT, 2012 (ACT 843)
Data protection laws are, in general, an extension of the fundamental rights to communication and correspondence and the Telecommunication service providers, Telcos, including the Regulator, National Communication Authority, as data controllers must capture, store and use our information, data subjects, by following certain data protection principles. These principles have been introduced because of concerns about the impact of computerised data processing on privacy in the information society, right to respect for private and family life, home and correspondence. This was not really dealt with in the case but I find it most relevant and should have been addressed as an easier legal strategy in shooting down the request for information under E.I.63
Section 22 of Act 843 allows the data controllers to collect personal data for a purpose which is specific, explicitly defined and lawful and is related to their functions or activity. Section 19 of Act 843 requires that personal data is only processed if the purpose for which it is to be processed, is necessary, relevant and not excessive. (emphasis mine).
The object of the Data Protection Commission (DPC) in Act 843 is to (emphasis mine):
- protect the privacy of the individual and personal data by regulating the processing of personal information, and
- provide the process to obtain, hold, use or disclose personal information.
The General Data Protection Regulation (GDPR), that regulates data protection and privacy in the European Union has introduced a new requirement that data controllers must conduct Data Privacy Impact Assessment(DPIA) when processing is likely to result in a high risk to the rights and freedoms of Data Subjects. This is now part of international best practice and it is up to the Data Protection Commission to defend the abuse of data against the Act 843 and the related principles.
The Executive through the National Communication Authority was collecting our personal information from the Telcos for the purpose of the COVID-19 public health emergency. The content of the information being requested, its procession and use must pass the test of relevance, necessity and not excessive as needed for the intended purpose. The collection and use must also be specific, explicitly defined and of course lawful.
INACTION BY DATA PROTECTION COMMISSION (DPC)
Subjecting the data requirements per E.I.63 to data protection principles, the Data Protection Commission should have sought the intervention of the courts to declare the following data being requested under E.I.63 as against the Data Protection Act and Principles.
- Merchant Codes
The President requested for merchant codes and Kelni GVG Ltd , a private company acting as agent for NCA, by email requested for both the mobile money transactions details of subscribers as well as the un-hashed (fully disclosed) subscribers numbers without any privacy protection. This request by email was also not specifically and explicitly defined under E.I. 63 and therefore not even lawful.
What has merchant codes and mobile money transactions details of purchases made by subscribers got to do with possible transmission of the virus? I have the virus and sit in my home, order pizza and pay using the merchant code of the restaurant. How is this connected to the spread of the virus? This data request tested against section 19 of Act 843, falls foul of all the principles as not necessary, not relevant and excessive.
- All Called numbers
What has phone numbers called by an infected person got to do with contact tracing? I am infected with the virus, I call my brother, what has this got to do with contact tracing? Can the virus be electronically transmitted through the phone, e-COVID? This data request tested against section 19 of Act 843, violates all the principles as not necessary, not relevant and excessive.
- Roaming files
Roaming files relate to data of subscribers using the network outside the country. Was it intended to notify other countries of infected people who have left the country? Was it even possible to leave the country having tested positive to trigger a location tracker? This of course was not necessary, not relevant and excessive, an infringement on Act 843 on the for which the DPC is the custodian.
As intimated by Arthur, if E.I. 63 is to help contact tracing in Ghana for the purpose of a Public Health Emergency in Ghana, then why the need for receiving information of all subscribers when they are outside the country, if it is not for the President and his agencies to spy on subscribers to the network or service providers.
In her ruling the Ladyship Rebecca Sittie, rightfully said:
“ I am of the view that international roaming details have nothing to do with contact tracing in Ghana for managing Covid-19 pandemic. This is clearly an infringement of the Applicant’s right to privacy as well as freedom of movement and association”
In my opinion, the above data was not being obtained fairly in accordance with the rights of data subjects, there was no specific, explicit and legitimate purpose for contact tracing of possible infected people. The Data Protection Commissioner, if indeed independent, should have been interested in this case or by themselves gone to court to stop the collection of the above data as requested by the President under E.I.63
There would not have been the need for Arthur to go to court if the DPC stood up to its mandate to protect data subjects, Telco subscribers for that matter, from abuse of their data by the President. This was a case the DPC should have joined as an applicant or Arthur should have sued the DPC as well, for failing to protect the collection of data that violates the data protection principles.
All is not however lost for the DPC since they still have a role to play if they did not have the will to prevent the abuse of data on data subjects by data controllers. Although the court ordered National Communication Authority (NCA) to certify that the orders of the courts have been fully complied with, NCA is unfortunately also a party and perpetrator to the abuse. The order falls under data protection and the DPC must rise up to the occasion to supervise the expunging, clearing and deletions of the data both manual and electronic as already given to the President, the Government, NCA and other agents of the President as directed by the court. DPC must then give a certification of assurance to the general public that this has been done and our information is safe.
INACTION BY GHANA BAR ASSOCIATION/LEGAL FRATERNITY
Remedies of Certiorari and prohibition as per the Supreme Court ruling in case of Ex Parte Nana Diawuo Bediako II & Others, are not restricted to a notion of locus standi and the court can be invited by every citizen to prevent some abuse of power. In such situations the person making the invitation will not be deemed to be a meddlesome busy body but a public benefactor.
I find the Ghana Bar Association (GBA) more placed to be making such interventions for public good in the courts since they are in a better position to know if the Executive has or is about to abuse its powers against not only an individual but the whole citizenry. I guess they also have a role in defending the Constitution as officers of the court. The GBA in the case of GBA v Attorney General once made an intervention to the court that Chief Justice Abban was not fit for appointment as Chief Justice since he was not a person of high moral character and proven integrity. The outcome of the intervention is not so much as important as the fact the GBA has a role to play and in fact in the past played the role as the collective voice of the legal profession to defend the Constitution of the country. The GBA in this instance could have lived up to their expectation as the voice for the voiceless.
INACTION BY THE ATTORNEY GENERAL
The Ghana Law School has been organizing the “Re-Akoto Memorial Lecture” since April 2006 annually to remind us of abuse of Executive powers on Baffour Osei Akoto and seven others, when a duly enacted law by Parliament, the Preventive Detective Act 1958, was used to arrest and detain without trial in what is currently deemed an abuse of their human rights despite the decision of the Supreme Court.
The Attorney-General per Article 88 of the Constitution, is the principal legal adviser to the Government, the President for that matter. The Attorney-General & Minister for Justice, Godfred Yeboah Dame, giving his remarks during the 16th edition of the lectures in 2021 said:
“One lesson to be drawn from the facts of the Akoto case, is that ordinary people or the masses are largely at the receiving end of the laws that we make and are most affected by the adverse consequences thereof. It becomes self-evident that in building a society anchored on the rule of law, we must be guided by the effect of laws and systems we put in place on the ordinary people and not only the high and mighty or a specific class that we target. In quite an irresistibly powerful way, Re Akoto teaches us to be mindful of the collective good of the laws that we enact as a nation as all facets of society will be affected by the application of the law” (emphasis mine).
The Attorney General, who made such profound statement on the Re Akoto case which I agree with, is in this Arthur case strangely defending the same legal effect of the E.I.63 as the Preventive Detective Act did and was then also defended. Ironically, the Attorney General, the legal adviser to the Executive, did not see in his own words the potential adverse consequences on the ordinary people or masses who will be at the receiving end of the law, E.I. 63 and was not guided by the effect of laws and systems that was being put in place on the ordinary people.
Is it that, the Attorney General taking a cue from his opinion on the Re Akoto case, advised the President on the adverse consequences on the ordinary people or masses of E.I.63 but was ignored, hence had no option to defend the Executive’s position anyway in court? It would be interesting to know.
The difference in the ruling between the Re Akoto and Arthur cases is the will and courage of the Judiciary to stand up to the Executive and surprisingly, the former was a Supreme Court ruling and the latter, rather, a High Court ruling. We need more of Her Ladyship Rebecca Sittie to defend the Constitution and thanks to Francis Kwarteng Arthur,Esq for standing up for the millions of customers of the Telcos.
IMPLICATIONS OF RULING TO THE JUDICIARY
Kpegah JSC, in his opinion in the of case Tsatsu Tsikata (No 1) v Attorney-General (No 1) asserted that judicial independence implies that judges must be bold and fearless, and as he put it:
“The saying that justice must be done even if the Heavens fall will be meaningless unless it is linked up with an equally important saying that the Bench is not for timorous souls.”
Date-Bah JSC, as he then was, stated in the case of Adofo v Attorney-General:
“the Constitution expects judges to protect individuals and minorities from the power of the majority”
I doff my hat to Her Ladyship Rebecca Sittie for not being a timorous soul. She has in her own small way contributed to the expectation of good governance, constitutionalism, of the Executive by making sure the powers of the President given to it by the Constitution did not get out of hand but needs to be limited.
The National Communication Authority appealed against the award of damages against them by the High Court but the Court of Appeal, presided over by Justice Senyo Dzamefe upheld the award in another bold decision by the Judiciary in making sure that the legality and irrationality of administrative actions of government institutions and its agents are put in check.
This case has put meaning to the concept of separation of powers, checks and balances, and lived up to the expectations of Kpegah JSC and Date-Bah JSC as expected of the Judiciary. I pray the Judiciary is able to remain steadfast in the role given to it to defend the Constitution.
IMPLICATIONS OF RULING TO THE EXECUTIVE ARM OF GOVERNMENT
The Executive must in future balance what is in the interest of the public against the rights and freedoms of the same public it is attempting to protect. We cannot solve a problem by creating another one. All rights of the citizens from whom power emanates must be protected based on the balance of risks to the same citizens. In this case, solving a public health issue whilst exposing the same people to privacy and information security risk in this new digital world was not the best of approaches. The impact analysis of Executive Instruments must be holistically done and not just look at the immediate problem it is intended to cure. There would have been undesired consequences unless as Arthur put it in this case, Government was knowingly collection information for other reasons such as surveillance, aside the fight against COVID-19.
The information already collected needs to be destroyed by all the government agents involved in this exercise as directed by the courts.
IMPLICATIONS OF RULING TO THE TELCOS
It behoves on the Telcos as data controllers to put in placed information risk management governance systems, physically, virtually and legally to protect our personal data, sensitive data such as biometrics, clickstream data, as well as mobile money transaction data that when put together make up our digital persona.
From this case, it is clear that it is only MTN that can be trusted as long as legally protecting our data and privacy rights is concerned. Kudos to MTN and its legal team that understood the laws under which they operate and questioned the legitimacy of the President’s demand under E.I.63. The laws must work.
Kelni GVG Ltd, a private company, still has explanations to give to us the citizens for the intended purpose of the mobile money transactions of subscribers as requested by their email to the Telcos. What was it going to be used for? What has this got to do with E.I. 63 and contact tracing? Also, on what server was the data collected saved and where was it located? Does this call for transborder dataflow issues with respect to data protection?
The Telcos must know that the MoMo business, with its associated accounts, is a banking related business and they must subject themselves to strict duty of secrecy as expected of the banks. The release of the MoMo transactions of their customers on the orders of Kelni GVG Ltd by email was not by compulsion of law, since it was not even a request under E.I.63 I wonder what Bank of Ghana has to say on this since that aspect of the business of the Telcos fall under payment system providers per the Payment Systems Act (Act 987), hence are licensed and regulated by Bank of Ghana. Has there been a breach of any duty of secrecy? I guess it depends on how far we want to push this and who is independent enough to take action.
Ignorance of the law as they say is no excuse, especially for corporate bodies and the rest of the Telcos must bow their heads in shame. The Data Protection Commission must take advantage of this serious data protection lapse to improve its supervisory role in the telecommunication industry.
IMPLICATIONS OF RULING TO CUSTOMERS OF TELCOS
As it stands, from the Arthur case, only MTN Ghana, has been able to legally stand up to not only the Regulator, NCA, but the Executive Arm of Government to protect the information of its customers. MTN refused to unlawfully disclose non-relevant, non-necessary, excessive private personal information in the guise of fighting COVID-19 to protect our constitutional right to be privacy. It seems we can only be safe with MTN when it comes to protection of our information.
In choosing which Telco to deal with in this digital world, we all need to be mindful of our digital persona with respect to the protection, physically, virtually and legally of our personal information. This should be paramount in our decision making process of choosing which Telco to do business with, aside of course the actual service quality delivery. MTN stands tall here.
- I. 63 AND THE DANGER OF FUNCTION CREEPING
Aside the legal implications of personal information sharing, which the Judiciary has dealt with, my concern with E.I. 63 is with function creep of the actual technology being used. Function creep is where a technology, an emergency communication system for that matter, is introduced to do one popular cool thing (function: Covid-19 tracing) but later used to do other things which may be unpopular un-cool things (function: mass surveillance). This means, the original function has “crept” into another unrelated function whether planned or unplanned. The reason we should be worried of function creep is for example the use of IMEI codes under the Central Equipment Identity Register that was to be set up under E.I. 63
Every mobile phone or device has a unique 15 digits number called the IMEI code that identifies the location of the device at any time. Of course this means the location of the holder of the device can be tracked in real time and this would of course, in no doubt aid in tracking someone who has been infected by Covid-19.
However, collecting all IMEI codes on the telecommunications networks into a national register is not only dangerous in terms of other “un-cool” things it can be used for, function creep, but an invasion of privacy of the citizens. Why does a President want to know the whereabouts of its citizens? Yes, there is a public health issue, find a way to deal with those affected and not make us all suspects.
If crime is increasing for example, it is up to the security agencies to use their intelligence to stop suspects of crime and not subject every car and every person on the streets to daily checks and questioning of their activities. Citizens have a constitutional right to be left alone in as much as the State has the obligation to protects its citizens but not at an untold hardship, inconvenience and potential danger to the same people that the State is trying to protect.
The good thing about this ruling is, E.I.63 was not only for public health emergencies but was supposed to deal with emergency situations in general. Without this ruling one can imagine how our information with the Telcos may be used, as long as a President feels there is an emergency and invokes E.I.63
There is a technological solution to this contact tracing. The use of GPS monitoring via an ankle monitor on those infected to make sure they isolate. Also, it could have been easier making it compulsory for those testing positive to the virus to sign a consent form for their whereabouts to be tracked using their EMEI for the 21 days isolation period, if that is what we wanted to do. The rest of us could have then be left alone to enjoy our freedom of movement and association as well as our right to privacy. The E.I. 63 in the form issued was needless for this purpose.
CONCLUSION
As a check on the Executive for excessive use of power granted by the Constitution, aspects of E.I. 63 that deals with the collection of mobile money merchant codes and transaction details, call numbers, roaming files has now been deemed to be an invasion of the privacy of customers of the Telcos by the President. Constitutionally the collection though was in accordance with law, was not necessary in a free and democratic society for public safety or the economic well-being of the country, for the protection of the rights or freedoms of others as it relates to the fight against COVID-19.
This should not have been a case for Francis Kwarteng Arthur who happens to be a lawyer to fight on his own behalf for the benefit of the citizenry. So what if he did not take action? An ordinary citizen would have had to pay a lawyer to prevent this abuse of our privacy rights that even affected lawyers themselves. A body or institution especially the Ghana Bar Association or the Data Protection Commission should have taken it up instead of an individual. Lawyer Arthur we are grateful but there is also an issue of receiving unsolicited messages on our phones from the Telcos which is also an invasion of our privacy. To MTN we hope we can continue to count on you with respect to protecting our information and to Kelni GVG Ltd, you still have an explanation to give for even attempting to collect by email our MoMo transaction details.
Finally, the Judiciary, in this case, have lived up to the expectation of putting checks and balances on the Executive as enshrined in the Constitution and it is heart-warming to know that there exist some bold and fearless judges ready to deepen our democracy. Lord Denning classified judges as either “bold spirits” and “timorous souls” and he being part of the former. I daresay that Her Ladyship Rebecca Sittie and the Court of Appeal Justices, presided by Justice Senyo Dzamefe have joined Lord Denning as bold spirits. There is hope for our democracy.
The author is a Chartered Banker, holds an EMBA (IT Management), an LLB and LLM (IT & Telecommunication) (visit : Kofianokye.blogspot.com; Kofidarko2.blogspot.com) contact: [email protected])
