Background:
In Brandon Omondi t/a Brandon & Associates Advocates v True-host Cloud, the Complainant lodged a complaint alleging that the Respondent, a company that provides email hosting services, deleted data from three email accounts created by the Complainant for his law firm – Brandon Associates & Advocates. In particular, the Complainant averred that he procured email hosting services from the Respondent for a period of one (1) year, which included, inter alia, an email domain, DNS Management, Email Forwarding and ID Protection services.
Upon registration of the domain, the Complainant created 2 email accounts for the purpose of carrying out his business and practice as an Advocate of the High Court of Kenya. The Complainant further stated that he subsequently created a third email account which he had been using since July 2023 for the purposes of sending and receiving communications in respect of payment of legal fees by his clients.
In September 2023, the Complainant lost access to all three e-mail accounts. He reached out to the Respondent’s customer care department and was directed to reset his password. A password reset link that was sent to him via his recovery email address. In accordance with the Respondent’s directions, he reset his password and was able to access one of the email accounts. However, he discovered that all the emails that he had hitherto sent and received were marked as “undefined” and he could not access any of them. He also discovered the other two email accounts were disabled and/or inaccessible.
The Complainant alleged that the Respondent’s conduct in deleting his e-mail accounts and the data held therein was unlawful and in breach of his rights under the Data Protection Act, 2019 (“the Act”).
Respondent’s Response
The Respondent stated as follows:-
- The Complainant purchased the email service through the Respondent’s website and agreed to be bound by the terms and conditions of service, which provided as follows:
- Services are offered for specified periods of time depending on the subscription and should be renewed before the period lapses.
- If not renewed by the expiry date, the Complainant’s service will then be suspended.
- The Respondent will not be held responsible for loss of any data hosted in a service not renewed.
- Services not renewed will be terminated permanently within 24 hours of expiry.
- The Complainant specifically acknowledges and agrees that in no event shall the Respondent’s total aggregate liability exceed the total amount paid by the Complainant for the particular services that are the subject of the cause of action.
- On 3rd August 2023, the Respondent forwarded to the Complainant an invoice of even date for payment of the subscription fee for the month of September 2023, which was due and payable on 3rd September, 2023.
- In breach of the terms of the service agreement, the Complainant did not pay the subscription fee on the due date. As a result, the service was automatically suspended and terminated within twentyfour hours.
- It was a clear term of the agreement between the parties that in the event the Complainant failed to renew the services by payment of the subscription fee on the due date, the services would be suspended and the Respondent would not be liable for any resulting loss of hosted data.
- Data held on the Complainant’s email accounts was permanently lost and could not be retrieved.
- The Complainant’s domain name was deregistered from the Respondent’s system upon expiry of the services.
Determination
The Data Commissioner held as follows:
- Section 2 of the Act defines Personal data to mean ‘any information relating to an identified or identifiable natural person.’ A data subject is defined as, “an identified or identifiable natural person who is the subject of personal data. In addition, an identifiable natural person under the Act is defined to mean a person who can be identified directly or indirectly, by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental economic, cultural or social or social identify.”
- Section 56 of the Act further provides for the persons who may lodge a complaint with the Data Commissioner. It reads as follows: (1)A data subject who is aggrieved by a decision of any person under this Act may lodge a complaint with the Data Commissioner in accordance with this Act. [Emphasis]
- In addition, Section 27(c) of the Act is instructive on the exercise of rights under the Act by data subjects and provides that a right conferred on a data subject may be exercised by a person duly authorized by the data subject.
- Consequently, incorporated, unincorporated or other juristic persons cannot complain about personal data infringements under the Act since they are not regarded as data subjects.
- The Complainant created three email addresses: info@brandonlaw.co.ke, accounts@brandlaw.co.ke and brandon@brandonlaw.co.ke. The first two accounts were used for carrying out the firm’s business while the last one brandon@brandonlaw.co.ke was used for correspondence with his clients.
- No evidence was produced to show that the first two email addresses contained personal data. Consequently, as the law firm was a juristic person, the Data Commissioner had no mandate to determine any matter relating to its business data.
- The data contained in brandon@brandonlaw.co.ke constituted personal data and was well within the ambit of the Act. The email contained personally identifiable data, including the Complainant’s e-signature, which contained his name and qualifications and thereby identified him.
- Section 26(b) of the Act grants a data subject the right to access their personal data held in the custody of a data controller or data processor.
- The Complainant, a data subject, tried to access his email address brandon@brandonlaw.co.ke only to find that it had been disabled/removed. When he reported the matter to the Respondent, he was informed that the service expired on 3rd September 2023.
- Through its independent investigation, the Office of the Data Commissioner established that the email info@brandonlaw.co.ke was available until 13th September 2023 and not 3rd September 2023 as alleged by the Respondent. Since the email brandon@brandonlaw.co.ke was also hosted on the same domain, it ought to have been accessible as of 13th September 2023.
- Consequently, the Data Commissioner held that the Complainant’s right to access his personal data contained in the email account brandon@brandonlaw.co.ke had been violated and directed the Respondent to compensate the Complainant Kes. 250,000/- for the violation.
- In addition, the Data Commissioner directed the Respondent to comply with the Complainant’s request to deactivate and de-register his email account from its system within seven (7) days from the date of the Determination.
