Contents

1. Summary
   1. Facts
   2. Holding
2. Comment
3. Further resources
4. The Decision

Summary

Brandon Omondi's law firm complained Truehost Cloud irregularly deleted business/personal email data after late payment. Truehost cited automatic termination per terms. ODPC found its mandate covered only personal data (one email). It ruled the right to access personal data was violated, ordering KES 250,000 compensation and data deletion.

Facts

The Complainant, Brandon Omondi T/A Protecti Brandon & Associates Advocates, lodged a complaint against Truehost Cloud, a company providing email hosting services. The Complainant alleged that the Respondent deleted his company and/or business email accounts irregularly, causing the loss of company and/or business data.

Specifically, the Complainant stated that in January 2023, he procured Email Hosting Services from the Respondent for a domain name, which included creating three email accounts: [email protected], [email protected], and [email protected]. The first two were used for firm business, while the third was used for correspondence with clients regarding legal fees. The Complainant claimed he had been in continuous use of the domain and accounts and had settled invoices. He stated he paid the invoice due on 3rd September 2023 on 4th September 2023.

On Saturday, 16th September 2023, the Complainant reported losing access to all email accounts. After resetting his password, he could access one account ([email protected]) but found all emails marked as 'undefined' and inaccessible. The other two accounts were disabled and inaccessible. The Complainant reported losing all data in the accounts, including emails and signatures, since January 2023. He contended that the Respondent's conduct was illegal and unlawful.

The Respondent, Truehost Cloud, responded via a Replying Affidavit. They confirmed providing email hosting services to the Complainant from January 2023. They stated that the Complainant purchased the service via their website and agreed to their terms and conditions. The salient terms included:

• Services are offered for specified periods and must be renewed before expiry.
• If not renewed by the expiry date, the service will be suspended.
• The Respondent is not responsible for the loss of any data hosted in a service not renewed.
• Services not renewed will be terminated permanently within 24 hours of expiry, including backups.
• The Respondent's total aggregate liability would not exceed the total amount paid by the Complainant for the particular services.

The Respondent stated that they sent an invoice due on 3rd September 2023. They averred that the Complainant did not pay by the due date, resulting in the service being automatically suspended and terminated within twenty-four hours. Consequently, they claimed the Complainant's assertion of having access until 16th September 2023 was false, as the suspension is automated immediately upon non-renewal. They confirmed the termination was communicated via email on 21st September 2023.