When people switch jobs, both sets of employers face known risks. The former employers risk their former employees decamping with their trade secrets. And the new employers risk inviting trade secret lawsuits.
But that's not all. A related risk lurks in the background, one that you might not know of and that could expose your company to criminal liability. Or, more likely, a risk that would be an additional arrow in a plaintiff's quiver.
The risk is computer fraud claims. Maybe your new employee never deleted her prior corporate email account from her phone, and the competitor never invalidated her access credentials (or delayed in doing so). That alone might be enough for a claim under the California Comprehensive Computer Data Access and Fraud Act.
New and former employers alike should try to cut off these claims before they arise. New employers should ensure that new employees remove their former employers' email accounts. And former employers should immediately void the former employees' access credentials.
But if it's too late for that, read on to learn how to bring and defend against these claims.
The California Comprehensive Computer Data Access and Fraud Act criminalizes wrongful "access," "use," or "disruption" of computers or networks. In addition to creating the crime, the Act grants a private right of action to anybody who suffers damage or loss.
The "access" element is broad. It's defined as a "means to gain entry to, instruct, cause input to, cause output from, cause data processing with, or communicate with, the logical, arithmetical, or memory function resources of a computer, computer system, or computer network."
The U.S. Court of Appeals for the Ninth Circuit in United States v. Christensen gave access even more breadth. It held that the term includes "logging into a database with a valid password and subsequently taking, copying, or using the information in the database improperly."
Former employers suing new employers should run with Christensen's breadth. New employees have the passwords to their former employers' email accounts, and those accounts are on their personal phones. The former employers didn't invalidate their access credentials, so the new employees still have valid passwords to log into the accounts. Then they use the information whenever they read any emails to that account.
The new employers need a different tack. Christensen dealt with databases, not email servers, so they should argue Christensen inapplicable and guide courts back to the statute.
Parsing the definition of "access" shows that it may not apply to email servers at all. Recall the italicized phrases in the access definition ("computer," "computer system," and "computer network"). Each of these phrases have their own definitions. And none of them include email servers.
Instead, email servers are included in a different defined term, "computer services." This defined term is used only for crimes based on wrongful use or disruption, not access.
Former employers facing this argument have two options. One, argue that email is implicitly included in the "computer," "computer system," or "computer network" definitions. And two, argue legislative intent and policy from cases on the act generally.
Assume the new employers win this fight, and courts find that "access" does not include the new employees using their former employers' email accounts. There's still the issue of whether the new employees committed wrongful "use" or "disruption" under the act.
Neither of these terms are defined. And a literal reading of "use" (plus Christensen's breadth) suggests that new employees are using the former employers' email accounts when they read emails to those accounts.
New employers' best rebuttal to this lies on a different front: attacking the existence of a private right of action. Recall that the competitor has a private right of action only if it suffered damage or loss. There are two conceivable types of damages here: one based on the use of the trade secrets, the other based on any investigation into the network.
To the extent the claim is based on the wrongful use of trade secrets, that could be preempted by the California Uniform Trade Secrets Act. One federal trial court appears to recognize this in dicta, though former employers could point to courts holding there is no preemption (albeit in different contexts, where this argument wasn't made).
And to the extent the claim is based on investigation into the network, that might not be recoverable. The act defines compensatory damages to include these network-investigation expenses only when they're related to "the access." The new employers should argue that the new employees did not "access" anything under the act's definition. And the former employers should attempt to argue that the private right of action's "access" should be defined differently than the rest of the act.
Without any damage or loss, there shouldn't be a private right of action and the claim under the act.
None of this definitive. Former and new employers alike will be litigating in an area where there's no published cases and asking a busy court to parse a nuanced statute. Whatever side you're on, it's worth taking the shot. The former employers get the possibility of legal fees and punitive damages. And the new employers get that leverage removed from the case at the outset.
One final point. You may have heard of a statute called the Computer Fraud and Abuse Act. That's the federal version of the act discussed here. And it's a whole different issue.
For one, a private right of action under the federal statute essentially requires that the plaintiff suffer a loss of at least $5,000 (as opposed to any loss under the California statute). For another, the two statutes have different language and different scopes. Key here: The federal statute lacks the definitional framework from the California statute that potentially excludes email servers.
This article originally appeared in The Recorder
Disclaimer: This Alert has been prepared and published for informational purposes only and is not offered, nor should be construed, as legal advice. For more information, please see the firm's full disclaimer.
