An employer whose departing employee copied files may have a civil claim under California Penal Code section 502, which lets the owner of data that “suffers damage or loss” sue for damages and an injunction. The federal Computer Fraud and Abuse Act is narrower after Van Buren v. United States (2021). It reaches access to off-limits areas of a system, not misuse of data the employee was allowed to see. Revoking access promptly, and having clear written limits on what each role can open, makes either claim stronger.
What does Penal Code 502 prohibit?
Many kinds of unauthorized computer conduct. The statute is mainly criminal, but its civil remedy is what employers use. Under Penal Code section 502(c)(2), it’s an offense to “Knowingly accesses and without permission takes, copies, or makes use of any data from a computer, computer system, or computer network.” Other paragraphs cover deleting or altering data, using computer services without permission, and accessing a system without permission at all.
The civil remedy is in subdivision (e)(1). The owner of the data or system “who suffers damage or loss by reason of a violation of any of the provisions of subdivision (c) may bring a civil action against the violator for compensatory damages and injunctive relief or other equitable relief.” Compensatory damages include “any expenditure reasonably and necessarily incurred by the owner or lessee to verify that a computer system, computer network, computer program, or data was or was not altered, damaged, or deleted by the access.”
That last clause matters in practice. The cost of a forensic examination to find out what an employee took can itself be the damages, even before the employer proves how the data was used.
The same subdivision allows the court to “award reasonable attorney’s fees,” and permits punitive damages for willful violations when oppression, fraud, or malice is proved by clear and convincing evidence.
What’s the “without permission” problem for employer claims?
Employees usually had permission. A current employee who downloads the customer list they use every day accessed it with permission. The statute addresses this directly. Section 502(h)(1) states that subdivision (c) “does not apply to punish any acts which are committed by a person within the scope of lawful employment,” and defines that scope as acts “reasonably necessary to the performance of their work assignment.”
That’s the line a section 502 claim against an employee has to cross. Copying a client file to work on it is within the scope of employment. Forwarding the whole client database to a personal email account the week before resigning, with no work reason, is harder to defend as reasonably necessary to any assignment. Courts look at what the employee did and the reason for it, including the timing.
Former employees are a cleaner case. Once access is revoked, any later login, whether through a saved password, a shared account, or a device that wasn’t returned, is far easier to describe as access without permission.
What did Van Buren change for federal claims?
It narrowed the CFAA for insiders. The federal statute’s civil remedy, 18 U.S.C. section 1030(g), lets “Any person who suffers damage or loss by reason of a violation of this section” sue for compensatory damages and injunctive relief, but only if the conduct involves one of the statute’s listed harms, most often a loss of at least $5,000 in a year.
In Van Buren v. United States (2021) 593 U.S. 374, the Supreme Court held that the “exceeds authorized access” clause covers those who obtain information from particular areas in the computer “to which their computer access does not extend.” The Court added: “It does not cover those who, like Van Buren, have improper motives for obtaining information that is otherwise available to them.”
For employers, that means a CFAA claim against a current employee who took files they were allowed to open is weak after Van Buren. The claim is stronger when the employee reached into folders or systems their role didn’t permit, or when a former employee got back in after access ended. The Court described the test as “a gates-up-or-down inquiry,” which is why role-based access controls make such a difference.
| Conduct | Penal Code 502 | CFAA after Van Buren |
|---|---|---|
| Current employee copies files they use for work | Weak; scope-of-employment exception | Generally not covered |
| Current employee mass-downloads with no work purpose | Possible, fact-dependent | Weak if the files were within their access |
| Employee opens folders their role can’t access | Stronger | Possible |
| Former employee logs in after access ends | Strong | Strong, if the loss threshold is met |
| Deleting or wiping company data before leaving | Strong under the alteration and deletion paragraphs | Possible, depending on damage |
What should the exit process look like?
Fast and documented. The single most useful step is to cut off access the moment an employee gives notice or is told of termination, or as soon after as the business can manage. That means company email, VPN, cloud storage, CRM and file-sharing accounts, and any shared credentials the employee knew. A written exit checklist, signed and dated, shows when each system was shut off.
The second step is retrieving devices. Laptops and phones should be collected and set aside without being wiped or reissued, because the evidence on them is often the only proof of what was copied. Many employers routinely reimage returned laptops for the next hire. In a departure that raises any concern, that routine should stop.
The third step is a reminder, in writing, of the employee’s confidentiality and return-of-property obligations. A short letter at exit, or a signed certification that all company data has been returned and deleted from personal devices, gives the employer a document to point to if the certification turns out to be false.
How do these claims fit with trade secret claims?
As companions. Most departing-employee cases lead with trade secret misappropriation and breach of contract claims, and computer access claims are added when the facts support them. Section 502 and the CFAA have one practical advantage: they don’t require proof that the data was a trade secret. They focus on how the employee got it.
California’s trade secret statute can displace some other claims based on the same misappropriation, so the complaint should be built with care. The firm’s post on trade secret claims against departing employees covers that side.
Employers should also be careful not to overreach. A computer access claim filed against a departing employee who later shows the files were within their normal duties invites a fee fight and, in some cases, a retaliation counterclaim. And section 502(f) says the statute doesn’t “make illegal any employee labor relations activities that are within the scope and protection of state or federal labor laws.”
When a resigning employee may have taken company data
- Preserve the employee’s devices and accounts as they are, including system logs and cloud storage activity, under a litigation hold, and don’t reissue or wipe the devices.
- Calendar the dates of resignation and the last day of access, any deadlines in a demand or lawsuit, and check for an arbitration agreement, confidentiality agreement, and EPLI or cyber policy with notice requirements.
- Identify who had access to what, who approved the employee’s access level, and stop any action toward the employee that could look like retaliation for protected activity.
- Pull the access-control records, the confidentiality and return-of-property agreements, and the exit checklist.
- Have counsel retain a forensic examiner and decide on a demand letter or a temporary restraining order before contacting the employee or the new employer.
Departing-employee disputes often involve both offense and defense. The firm’s page on employment litigation defense in California describes how those cases are handled.
Computer access claim questions
Can we sue if the employee only emailed files to themselves?
Possibly, under section 502, depending on whether the forwarding was reasonably necessary to the employee’s work. A forensic review that shows bulk forwarding right before resignation, with no matching work assignment, supports the claim. The CFAA is a harder fit if the employee was allowed to open those files. Most employers pair these facts with trade secret and contract claims.
Do we need a forensic examination before filing?
It’s usually worth it. The examination shows what was taken and when, and its cost can count as damages under section 502(e)(1). Courts considering a restraining order want specific evidence of what was copied. An exam done by a qualified examiner, with a documented chain of custody, also protects the employer against claims it altered the evidence.
Can we recover attorney’s fees?
Section 502(e)(2) lets the court award reasonable attorney’s fees in a civil action under that subdivision. It’s discretionary. The CFAA’s civil remedy doesn’t contain a similar fee provision. A fee award can cut both ways in practice, so employers should weigh the strength of the claim before relying on it.
Does locking a former employee out of personal accounts on a company device create risk?
It can. Employees sometimes use company devices for personal email or photos, and an employer that accesses or deletes personal accounts can face its own privacy claims. The safer course is to preserve the device intact, have a forensic examiner review it under an agreed protocol, and return personal data through counsel.
If an employee left with your company’s data
If your company believes a departing employee took confidential data, or has been sued by a former employee over a data dispute, the access records and the timeline usually decide which claims are available. Rosenberger + Kawabata represents employers defending employment lawsuits and claims through its business litigation practice, including claims involving departing employees and company data. Contact Rosenberger + Kawabata online for a confidential consultation, or call (310) 894-6921.
Sources
The statutes are Penal Code section 502 and 18 U.S.C. section 1030. The case is Van Buren v. United States (2021) 593 U.S. 374.
This post is general information about California and federal employment law as of November 7, 2026. It is not legal advice, and reading it does not create an attorney-client relationship. Employment statutes, regulations, and court decisions change often, and the outcome of any claim depends on its facts. Past results do not guarantee future outcomes.