DPC probes potential data breach in MTN-related systems

Alarm raised over unauthorised access to personal data

The Data Protection Commission (DPC) has acknowledged a potential data breach involving MTN-related systems. While MTN Ghana has confirmed that its core network, billing platforms, and financial services infrastructure remain unaffected, concerns are mounting over possible unauthorised access to customer personal information.

DPC moves swiftly to monitor and investigate

In response to the incident, the Commission has launched an active investigation and is working closely with MTN Ghana, the National Communications Authority, and the Cybersecurity Authority. The DPC has emphasized that while the full extent of the breach is yet to be determined, protecting the privacy rights of individuals remains its top priority.

Possible enforcement actions on the horizon

The Commission has warned that should it find evidence of negligence on the part of MTN Ghana or its parent company, MTN Group, it will exercise its powers under Ghana’s Data Protection Act, 2012 (Act 843). These enforcement powers include administrative sanctions and penalties to ensure compliance and accountability.

Upholding the right to data privacy

Reaffirming its commitment to upholding citizens’ data rights, the DPC stressed that personal data protection is a fundamental human right. It reminded all Data Controllers and Processors operating in Ghana or handling Ghanaian data to adhere strictly to Act 843.

Public urged to check data licensing and stay vigilant

As part of ongoing efforts to build a culture of data protection, the Commission encouraged the public to verify whether institutions and service providers they interact with are registered under the DPC’s data protection register. This step, it noted, is crucial for ensuring that organisations are accountable for their handling of personal data.

Call for public vigilance and digital hygiene

Ghanaians have also been advised to adopt good digital hygiene practices and report any unusual or suspicious digital activity. The DPC has reassured the public that it will continue to provide updates as more information becomes available.

Contact and Further Information

For more information or to report concerns, the public is encouraged to contact the DPC’s Corporate Affairs team at info@dataprotection.org.gh or call 0256228269 / 0256301360.