Computer Fraud and Abuse Act No Longer Applies to Employee Data Theft

A recent Ninth Circuit Court of Appeals decision that the Computer Fraud and Abuse Act does not apply to the theft of data by an employee might leave business owners and HR managers scratching their heads.

In US v. Nosal, the Ninth Circuit ruled that David Nosal could not be prosecuted under the CFAA for stealing proprietary information because he was authorized to access the data in the first place.

What does the decision mean for employers trying to protect sensitive data? For your reference, three takeaways from US v. Nosal:

1. Using the CFAA to combat employee data theft just got harder:

“… the 9th Circuit Court of Appeals issued an opinion holding that limiting an employee’s access to the company computers solely for business purposes, i.e. not stealing the data for a competitor, cannot be the predicate for a violation of the federal computer crime statute, the Computer Fraud and Abuse Act.” (The 9th Circuit: Employees Are Free to Steal from the Company Computers by Nick Akerman)

2. Employers should consider increasing limits on access to sensitive data:

“Recognizing the distinction between authorized access and authorized use, the Ninth Circuit has now clarified that the CFAA is not triggered where there is merely unauthorized use of information from a computer—the access itself must have been without or in excess of authorization. Thus, under Nosal, if a business wants to protect its sensitive information, it must either limit access to that information, or, rely on legal remedies other than the CFAA.” (En Banc Ninth Circuit Limits Scope of Computer Fraud and Abuse Act – Terms of Use Do Not Restrict Authorized Access by Fenwick & West LLP)

3. This isn’t likely to be the final word US v. Nosal:

“One has to wonder, if the justices of the Ninth Circuit cannot agree among themselves whether to agree or disagree with other federal circuits, how long will it be before the U.S. Supreme Court has to weigh in on the matter?” (CFAA Does Not Apply to Employee Data Theft According to Ninth Circuit by Fisher & Phillips LLP)

Related Reading:

Find additional Labor & Employment Law updates on JD Supra>>