COVID-19 Contact Tracing and Privacy Rights in Ghana: A Critical Analysis of the Establishment of Emergency Communications System Instrument, 2020 (EI 63)

Abstract

In December 2019, the world woke up to the news of a novel coronavirus (COVID-19). Since then, governments across the globe have deployed various measures to contain the spread of the disease. The government of Ghana, among other measures, issued the Establishment of Emergency Communications System Instrument, 2020 (EI 63) to establish an emergency communications system to aid contact tracing during public health emergencies. This executive instrument has been criticized for illegally “legalizing” the breach of the privacy rights of electronic communications network subscribers in Ghana. This article critically analyses EI 63 in relation to the right to privacy of communication enshrined in Ghana's 1992 Constitution. It argues against the constitutionality of EI 63, calls for its revocation and replacement with an act of Parliament enacted with due regard for Ghana's legislative framework on the protection of the right to privacy of communication.

INTRODUCTION

In December 2019, the world was hit by news of a novel coronavirus disease (COVID-19) that broke out in Wuhan, China.¹ On 30 January 2020, the World Health Organization (WHO) declared it to be a public health emergency of international concern.² Within a few months, the outbreak had travelled nearly everywhere across the globe,³ with Ghana recording its first two cases on 12 March 2020.⁴ By May 2020, COVID-19 was declared an endemic that had come to stay, at least for an unknown duration.⁵ Nations around the world have employed various technology-based interventions to facilitate their response to the pandemic.⁶ These have generally been used for quarantine enforcement, contact tracing, pattern and flow modelling, social distancing and movement monitoring, and symptom tracking.⁷ Like the governments of many other affected nations, the government of Ghana also deployed various public health and legal measures⁸ aimed at: limiting and stopping the importation of the virus; containing its spread; providing adequate care for the sick; limiting the impact of the virus on social and economic life; stimulating domestic production of basic necessities; as well as deepening self-reliance.⁹ Enhanced contact tracing and isolation¹⁰ is one such measure adopted by the government of Ghana. This was necessary because COVID-19 is reportedly spread from person to person through contact with small droplets expelled by an infected person during coughing, sneezing or talking.¹¹

On 23 March 2020, the government of Ghana issued the Establishment of Emergency Communications System Instrument, 2020 (EI 63) to establish an emergency communication system to aid contact tracing in public health emergencies. Among other things, EI 63 required all electronic communication network service providers operating in Ghana to furnish the government with the personal information of all subscribers.¹² The issuing of EI 63 generated public debate, with members of the public generally expressing dissent. Some likened EI 63 to the erstwhile Interception of Postal Packets and Telecommunication Messages Bill of 2016, introduced in Ghana's Parliament to give the government power to intercept postal and telecommunication messages as a crime fighting measure.¹³ The bill, nicknamed the “Spy Bill”, was later withdrawn following rigorous public criticism.¹⁴ Commentators have similarly called EI 63 a “dangerous illegality”¹⁵ and an attempt by the government to spy on Ghanaians.¹⁶ Some petitioned the president urging the revocation of EI 63,¹⁷ while others petitioned major stakeholders in a bid to persuade the electronic communication network service providers not to comply with the requirements of EI 63.¹⁸ A member of the public even instituted a court action, principally seeking an order of certiorari to quash the directive issued in EI 63, on account of the directive leading to the violation of fundamental human rights, particularly privacy rights. The applicant further sought an order directing the electronic network service providers to which he was subscribed not to divulge his personal information as directed under EI 63.¹⁹ MTN Ghana Ltd, one of the service providers, also challenged the government's action in court.²⁰ Meanwhile, according to a news report, the National Communication Authority is alleged to have confirmed that all electronic communication network service providers in Ghana had complied with the request made under EI 63.²¹

This has raised concerns about the breach of the right to privacy of communication guaranteed in article 18(2) of the 1992 Fourth Republican Constitution of Ghana (the Constitution). Although there is currently no specific and comprehensive legislation in Ghana to give effect to the right to privacy of communication, a number of statutes contain provisions that give effect to the protection of this right. Besides, Ghanaian courts have also demonstrated their commitment to protect the privacy of communication in Ghana through the few decided cases on the issue of privacy.²² The issuing of EI 63 is, therefore, a step backwards in the protection of the right to privacy of communication in Ghana.

This article critically analyses EI 63 in the light of the constitutionally guaranteed right to privacy of communication in Ghana. It also discusses the legal validity of EI 63. The article is divided into five parts. It first introduces the subject under discussion. It then gives an overview of EI 63, before presenting Ghana's legislative framework for the protection of the privacy of electronic communication. The next part critically analyses EI 63 with regard to the protection of the privacy of communication in Ghana. The article concludes by arguing that, although privacy rights are not absolute and may be interfered with in accordance with the law in the interest of public health and safety, EI 63 does not satisfy the exception contemplated under the Constitution. The article calls for the revocation of EI 63 and, if the government is so minded, for a new law to be enacted in its place to establish an emergency communication system for dealing with public health emergencies, with due regard for the protection of the right to privacy of communication in Ghana.

AN OVERVIEW OF THE ESTABLISHMENT OF EMERGENCY COMMUNICATIONS SYSTEM INSTRUMENT, 2020 (EI 63)

EI 63²³ was issued pursuant to section 100 of the Electronic Communications Act (Act 775) of 2008 (ECA). This section empowers the president of Ghana, by executive instrument, to make written requests or give orders to operators and providers of electronic communication networks or services requiring them to provide user information to aid law enforcement or national security.²⁴ According to its preamble, EI 63 was issued in response to the urgent need for an emergency communication system for tracing all contacts of persons suspected of being or actually affected by a public health emergency. It states further that the emergency communication system will be used to identify places visited by such persons.

The six-paragraph instrument contains provisions on emergency preparedness, which require electronic network operators to put their networks at the disposal of the state for mass dissemination of information,²⁵ the creation of a central subscriber identity module and equipment identity registers to hold the relevant information of subscribers,²⁶ and the hosting, connection and synchronization of the central subscriber identity and equipment identity registers.²⁷ Under EI 63, network operators and service providers are also, inter alia, to make available: the international mobile equipment identity codes and site location of all subscribers;²⁸ all caller and called numbers of subscribers;²⁹ merchant codes of mobile money operators;³⁰ and the roaming and location log files of all subscribers.³¹ The information provided under EI 63 is to be held in the custody of an institution to be designated by the minister responsible for communication.³²

From the wording of the preamble, the scope of EI 63 extends beyond COVID-19 to cover other emergencies, including public health emergencies that may occur in the future. As such, there is no time limit within which it is to remain in force. Also, the information required relates to all subscribers without limit and includes practically all information available to the electronic network service providers. Also of great concern is the fact that no specific institution is mentioned as the repository of all the information to be provided in compliance with EI 63, rather this is to be determined by the minister responsible for communication. Of greatest concern is the potential breach of privacy rights that EI 63 has occasioned and the fact that the legal validity of EI 63 under its intended parent act, the ECA, is questionable. This article discusses these concerns.

LEGISLATIVE FRAMEWORK FOR THE PROTECTION OF PRIVACY OF ELECTRONIC COMMUNICATION IN GHANA

Privacy is a broad term, comprising a bundle of rights.³³ Included in it is the right of a person to be “left alone to live his life free from unwanted intrusion, scrutiny and publicity. It is the right of a person to be secluded, secretive and anonymous in society and to have control of intrusions into the sphere of his private life”.³⁴ Privacy is one of the most widely demanded human rights in today's world simply because 21st century advancements in information and communication technology have made it extremely easy to interfere with privacy rights.³⁵ According to Lukacs, the protection of privacy is inseparable from technological development.³⁶ Privacy rights of persons are protected globally by the Universal Declaration of Human Rights.³⁷ Regional conventions, such as the European Convention on Human Rights,³⁸ also protect the right to privacy of the person, home and communication. Notably, the African Charter on Human and Peoples’ Rights does not contain an express provision on the protection of privacy, although a purposive interpretation of article 5 of the charter, which enjoins respect for human dignity, arguably encompasses the right to privacy.³⁹ Ghana is a member of the UN and African Union, and subscribes to the protection of human rights, including the right to privacy. The fundamental human rights of the people of Ghana are enshrined in chapter 5 of the Constitution. Article 18(2) provides: “[n]o person shall be subjected to interference with the privacy of his home, property, correspondence or communication except in accordance with law and as may be necessary in a free and democratic society for public safety or the economic well-being of the country, for the protection of health or morals, for the prevention of disorder or crime or for the protection of the rights or freedoms of others”.

Article 18(2) is an entrenched provision of the Constitution, hence the process to amend it is elaborate and involves, inter alia, a specific bill for the purpose as well as a referendum.⁴⁰ Consequently, the right to privacy cannot be interfered with except in accordance with the law and, until then, it is for the individual to decide whether his privacy should be interfered with and the extent of that interference. Of interest to the discussion in this article is the protection of privacy of communication. Although there is no specific legislation on the protection of the privacy of communication in Ghana, an analysis of various legislation and case law reveals the legislative framework.

Under the Security and Intelligence Agencies Act 1996, security and intelligence agencies in Ghana are permitted to intercept electronic communications for the purpose of crime investigation, but they can only do so with warrants.⁴¹ Such warrants must state the specific person or class of persons on whom they are to be executed, the place and the specific duration for their execution.⁴² Also, under the ECA, it is an offence to intercept or procure another person to intercept communications transmitted over an electronic communication network without the authorization of the network provider or user or a court.⁴³ Unfortunately, this provision does not place any safeguards on a situation where the electronic communication network provider itself mounts surveillance on its subscribers, as may appear to be the case under EI 63 where the information being transmitted to the government is being taken with the consent of the network service providers. It is also an offence to use or attempt to use the contents of an intercepted communication with the knowledge that it was procured by unlawful means.⁴⁴ The National Communication Regulations 2003 (LI 1719) also prohibit a third party from stealing, intercepting, diverting, altering, storing or disclosing transmitted messages or data.⁴⁵ They further enjoin network operators to employ international best practices to ensure the privacy, secrecy and security of communication.⁴⁶ The Electronic Communications Regulations, 2011 (LI 1991) also contains a similar provision to that in LI 1719.⁴⁷ Ghana has specific legislation with regard to the crime of terrorism: the Anti-Terrorism Act, 2008 (Anti-Terrorism Act).⁴⁸ Section 34 of this act requires police officers to obtain court orders before intercepting communications.⁴⁹ A warrant will not be issued unless reasonable grounds are established before a court. All this serves as a safeguard against interference with the right to privacy of communication, except upon the establishment of reasonable grounds.

The Supreme Court of Ghana has had very few opportunities to make pronouncements on the issue of privacy of communication and in each case the court delivered itself creditably, exhibiting a commitment to protect the privacy of electronic communication in Ghana. In Ackah v Agricultural Development Bank,⁵⁰ an employee's appointment was terminated following a secret recording of her telephone conversation with a journalist. In the recorded conversation, she allegedly divulged information that was injurious to her employers. The Supreme Court awarded damages to the plaintiff / appellant for the violation of her privacy rights occasioned by the secret taping of her telephone conversation. Also, in Cubagee v Asare,⁵¹ the Supreme Court of Ghana interpreted article 18(2) of the Constitution to afford protection against the secret recording of telephone calls by a party to the call. This, it is submitted, is a progressive extension to the protection of privacy recognized globally, since most prohibitions in this area of law relate to third parties rather than parties to the communication. The facts of Cubagee v Asare were that the plaintiff, in a bid to secure evidence to prove his case, recorded his telephone conversation with the defendant without notice to the latter. The plaintiff attempted to tender this piece of evidence in court, but was met with an objection from the defendant's lawyer based on the violation of the constitutionally guaranteed right of privacy. The Supreme Court unanimously held that the secret recording of the telephone conversation violated the right to privacy, which is guaranteed by article 18(2) of the Constitution, and went on to order the trial court not to admit the piece of illegally obtained evidence.

EI 63 AND PRIVACY OF ELECTRONIC COMMUNICATION IN GHANA

From the discussion so far, it may be observed that there is a formidable legislative framework to protect the privacy of communication in Ghana and a commitment on the part of the courts to dissuade people from violating the privacy rights of others. It therefore comes as a surprise that EI 63 so overtly seeks to infringe on the rights of the people of Ghana. Admittedly, privacy rights, like other human rights, are not absolute. Indeed, article 18(2) allows the limiting of the enjoyment of the right to privacy if this is done in accordance with the law and for the promotion of public health and safety. At a glance, it may appear that the issuing of EI 63 satisfies these conditions since, undeniably, the instrument was issued for the purpose of managing a public health emergency. However, on closer analysis of the wording of article 18(2), it becomes evident that the exercise of the power to limit the right to privacy must not only be in accordance with law but also be necessary in a free and democratic society. Two important questions arise as to whether EI 63 is a valid law and, assuming it is, whether such a law is necessary in a free and democratic society, such as Ghana's. The article now turns to these questions.

Is EI 63 valid?

As already stated, EI 63 professes to derive its source from section 100 of the ECA, which provides: “[t]he President may by executive instrument make written requests and issue orders to operators or providers of electronic communications networks or services requiring them to intercept communications, provide any user information or otherwise in aid of law enforcement or national security”.⁵² A careful reading of this provision reveals that the exercise of the president's power must conform to certain requirements: that the information requested must relate to specified and identifiable electronic communication network users and be for the purpose of aiding law enforcement or national security.

The use of the phrase “user information” suggests the legislators’ intention of achieving specificity in requests to intercept communication or provide access to information regarding an electronic communication network or service user. Thus, the information required must relate to specified user(s) and not the general public. Contrary to this understanding, the request made under EI 63 broadly relates to all subscribers of electronic communication networks and service providers.⁵³ Indeed, it is reported that the user information of all electronic communication network service subscribers has already been made available to the government of Ghana in compliance with EI 63.⁵⁴ It is submitted that this was not what the legislature contemplated under section 100 of the ECA, from which EI 63 claims to derive its existence.

Nevertheless, “national security” and “law enforcement” are not defined in the ECA. Since it is permissible to consult external aids for interpretation where there are no internal aids,⁵⁵ recourse will be had to other materials that may assist. Black's Law Dictionary defines law enforcement as “the detection and punishment of violations of the law …”.⁵⁶ This presupposes the enforcement of a pre-existing law. National security is defined by the Oxford Dictionary as “the safety of a nation against threats such as terrorism, war, or espionage”.⁵⁷ The phrase is also used in article 24(4) of the Constitution in a context that implies some form of physical threat rather than a public health emergency.⁵⁸ Clearly, EI 63 is for the establishment of an emergency communication system to deal with a public health emergency and not to enforce an existing law. Further, its purpose is not the safeguarding of the country from threats such as those mentioned above. A public health emergency cannot be encompassed by national security, particularly within the meaning of section 100 of the ECA. This is because, reading the ECA as a whole, one discovers that, throughout the act, the power of the president to request and obtain access to communication transmitted over electronic communication networks is specifically linked to a state of emergency,⁵⁹ for the purposes of national security⁶⁰ or the enforcement of law.⁶¹ Had the legislature intended a broader interpretation of these words and phrases, it would have been evident in the way they were used in the ECA and in the Constitution. In the circumstances, the canon of interpretation holds that expressio unius est exclusio alterius [the express mention of one thing excludes others not mentioned]. It is, therefore, not far-fetched to say that EI 63 was “smuggled” under section 100 of the ECA to bypass parliamentary scrutiny and judicial safeguards. By choosing to use the “backdoor”, the president has invoked non-existent powers, thereby making EI 63 ultra vires its supposed parent act. Consequently, EI 63 lacks a foundation to stand on and nothing can be built on it.

Under section 99 of the ECA, the president may access communication transmitted over electronic communication networks during a state of emergency. Having concluded that EI 63 is not supportable under section 100 of the ECA, can it be saved under section 99? The answer is no, because no state of emergency was declared by the president of Ghana in relation to COVID-19. Under articles 31 and 32 of the Constitution, the president of Ghana has the power to declare a state of emergency in circumstances that necessitate the securing of “public safety, the defence of Ghana and the maintenance of public order and of supplies and services essential to the life of the community”.⁶² The COVID-19 pandemic in no mean terms satisfies this condition. The government therefore had the option of declaring a state of emergency as a first step in response to the pandemic⁶³ since a state of emergency would have enabled the president to activate emergency powers, albeit under the watch of Parliament and with other safeguards.⁶⁴ In the government of Ghana's response to COVID-19, however, there has been no declaration of a state of emergency.⁶⁵ Rather, the Imposition of Restrictions Act, 2020 (Act 1012) was enacted and, under it, a number of executive instruments impose various restrictions.⁶⁶ As it is not required by law that executive instruments be laid before Parliament for approval, all the executive instruments that were issued in response to the COVID-19 pandemic passed smoothly into law without scrutiny: the good, not so good and the bad. Had there been the declaration of a state of emergency, all related laws and orders, including EI 63, would have been subjected to parliamentary scrutiny and judicial safeguards.⁶⁷ Section 99 of the ECA gives the president the power to invoke section 100 of the act during emergencies. The failure therefore to declare a state of emergency before the making of EI 63 renders it unconstitutional.⁶⁸ EI 63 can, therefore, not be supported either under section 99 or 100 of the ECA.

Furthermore, EI 63 stipulates no duration for its existence; in other words, it is permanent. Had there been the declaration of a state of emergency, any limitation of privacy rights by laws made pursuant to the state of emergency would have been governed by the duration of the state of emergency.⁶⁹ Had EI 63 even passed all the validity tests discussed above, it cannot be said that the framers of the Constitution intended or even envisioned a limitless executive instrument, not subject to any parliamentary scrutiny or judicial safeguards, to fetter the privacy rights of Ghanaians in perpetuity. Without doubt, EI 63 violates the Constitution and is consequently void.⁷⁰

Does EI 63 satisfy the “necessary” condition?

If EI 63 were deemed to be valid law, the next question is whether it satisfies the condition of necessity under article 18(2) of the Constitution. As already noted, the right to privacy of communication may be limited in accordance with law as is necessary for the protection of public health and safety, inter alia. EI 63 requires all electronic network communication service providers to put their networks at the disposal of the government and make available the personal user information of all subscribers for the purpose of tracing the contacts of persons affected by public health emergencies. For the purpose of contact tracing, what is necessary are the roaming files and location logs⁷¹ of the specified persons in order to trace where they have been, to determine whether they have come into contact with the virus or been in a position to transmit it to others. Any additional information, such as the caller and called numbers, merchant codes (of mobile money merchants), mobile station international subscriber directory number codes and mobile equipment identity codes are totally unnecessary for contact tracing in relation to a public health emergency.

Were it even to be that all the information required under EI 63 was necessary for the purpose that it was to serve, it is submitted that EI 63 cannot be applied generally to all electronic network subscribers but only to those suspected of being affected, or actually affected, by COVID-19. Failing that, there will be no benchmark for accountability for the information obtained and abuse is certain. Under the Anti-Terrorism Act, for example, there are specific requirements for mounting surveillance on suspected terrorists to tap electronic communication and other information transmitted through their electronic communication devices. One of these requirements is a court warrant.⁷² This accords with the practice in other jurisdictions, such as the USA where the Supreme Court in the case of Riley v California ⁷³ unanimously held that the search, without a warrant, of the digital contents of the cell-phone of an arrested person breached of the Fourth Amendment to the US Constitution, which guarantees the protection of privacy rights. As stated by Roberts CJ in the court's ruling “[m]odern cell phones are not just another technological convenience. With all they contain and all they may reveal, they hold … ‘the privacies of life’”.⁷⁴

CONCLUSION AND RECOMMENDATIONS

This article has critically analysed the Establishment of Emergency Communications System Instrument, 2020 with regard to the right to privacy of communication in Ghana. Through the discussion, it has been established that EI 63 violates privacy rights enshrined under article 18(2) of the Constitution and cannot be supported under its intended parent act, the Electronic Communications Act 2008. EI 63 is indeed a “dangerous illegality”, having deployed unlimited surveillance on all electronic communication network subscribers in Ghana, contrary to law. This article therefore recommends that EI 63 be revoked or, at the very least, amended in compliance with the court orders in Francis Kwarteng Arthur v Ghana Telecom.⁷⁵ For the purposes of COVID-19 contact tracing, the government of Ghana has the option of declaring a state of emergency and following through with the requirements of articles 31 and 32 of the Constitution in that regard. Any resulting law must have due regard for the right to privacy of communication by limiting the information requested and obtainable from electronic communication network and service providers, to what is reasonably necessary for contact tracing. It must also be applied strictly upon the issue of a court warrant that relates to identifiable persons for specified periods with the option of extension by a court order as is reasonably necessary.