Data Protection

Yes, when data protection focuses more on restricting access than enabling safe, accountable use, it can unintentionally slow solutions to societal problems, but the real challenge is designing governance that protects people while still allowing data to create public value.

@Benard Ondiek could you be more specific about the data and problems you want to address?

Data Protection is about the protection of Personally Identifiable Information (PII) for the safeguard of the individual privacy and freedom rights.

Data Protection does not prohibit using data for research, however that processing should be done in a lawful manner.

My submission is based on Ghana Data Protection Act, Act 843

One of the objective of the Act is to provide the framework within which PII could be processed without infringing on the privacy or freedom right of the individual (ref: Section 18(1)(a).

The individual has the right to be informed about the purposes of the processing, who will have access to the data, how it will be stored, and disposed off when it is no longer needed. (ref: Sections 20(1)-(3), 22, 23, 24(1)-(2)(c)-(3)

There is a real and growing tension between data protection and data utility, and the balance is not always struck optimally. Strong privacy laws, encryption practices, and strict governance frameworks are essential for preventing abuse, protecting individuals, and maintaining trust in digital systems. However, in some contexts, these protections can become so restrictive that they slow down or even block legitimate uses of data that could deliver meaningful societal value—such as public health research, climate modeling, fraud detection, and policy planning.

At the same time, the issue is not that we are “protecting data too much” in a universal sense, but rather that we often apply one-size-fits-all rules to very different types of data and use cases. Sensitive personal data clearly requires strong safeguards, but there are many situations where anonymization, aggregation, and controlled access frameworks could allow data to be used more effectively without compromising privacy. The real challenge is not choosing between protection and utility, but designing smarter systems that enable both—so that data can remain secure while still being responsibly leveraged to solve societal problems.

Benard raises the critical tension, and Tedy, Justice, and Odoyo each name part of the answer. The problem is not protection itself, but protection designed for restriction rather than for responsible use. Justice is correct - Data Protection Acts, including Ghana Act 843 and Rwanda law, do not prohibit research use; they require lawful, purposeful processing. Odoyo is correct that one-size-fits-all rules create artificial scarcity. From Purpose Rwanda work with highly sensitive adolescent mental health and substance use data, our position is clear: protection must enable trust, not just enforce compliance. The question should shift from how do we lock data to how do we build accountable pathways for public good - through tiered consent, anonymization by design, and community governance where young people understand purpose, access, storage, and disposal. Otherwise we protect data so well that we fail the very people the protection was meant to
serve.

ODOYO CORNELLIUS and Rhoda Nakhosi have named the real shift.