Criminalization Chills Data Innovation

This provision criminalizes "obtaining" personal data with penalties up to 2 years imprisonment, creating severe barriers to legitimate digital innovation. The broad language captures routine business operations like data processors receiving data from controllers, AI companies accessing training datasets, and researchers conducting product development—all essential to modern tech services. Unlike GDPR's administrative fines, Ghana's criminal penalties for data "obtaining" (harsher than penalties for data "selling" in 108) will deter R&D investment, prevent AI/ML development, and disadvantage Ghanaian tech companies compared to international competitors operating under more proportionate regimes.