Employee Theft of Company Data in California — Liability and the Effect on a Wrongful Termination Claim

Employees facing a workplace dispute sometimes believe that taking copies of emails, personnel files, financial records, or other company data before they are terminated — or immediately after — will help "prove" their case. Under California law, this belief is largely a myth, and acting on it can significantly damage an otherwise valid claim. Understanding the criminal exposure, civil liability, and the effect on wrongful termination damages is essential before taking any company data.

What Counts as "Data Theft" Under California Law

California addresses unauthorized access to and use of computer data primarily through the Comprehensive Computer Data Access and Fraud Act, codified at Penal Code Section 502 (Current as of 2026. Laws are subject to legislative change.). The statute prohibits knowingly accessing, copying, using, or taking data, computer systems, or computer networks without permission. This includes conduct as simple as forwarding company files to a personal email account, downloading customer lists to a personal device, or continuing to access company systems after access has been revoked.

If the data at issue qualifies as a trade secret — client lists, pricing models, proprietary processes, or other confidential business information that derives value from not being generally known — the employee may also face liability under the California Uniform Trade Secrets Act (CUTSA), Civil Code Section 3426 et seq.

Separately, every California employee owes an underlying duty of loyalty to their employer during employment. Labor Code Section 2860 provides that everything an employee acquires by virtue of employment — with the exception of the employee's own compensation — belongs to the employer, "whether acquired lawfully or unlawfully."

Criminal Exposure Under Penal Code Section 502

Unauthorized access, copying, or use of computer data under Penal Code Section 502 can be charged as a misdemeanor or a felony, depending on the extent of harm and financial loss involved. Prosecution is not limited to outside hackers — Penal Code Section 502 has repeatedly been applied to employees and former employees who accessed or copied employer data without, or in excess of, authorization.

Civil Liability — What the Employer Can Recover

Separate from any criminal exposure, Penal Code Section 502(e) creates a civil cause of action allowing an employer to recover:

• Compensatory damages, including the reasonable cost of investigating whether data was accessed, altered, or deleted;
• Reasonable attorney's fees for a prevailing plaintiff under Penal Code Section 502(e)(2); and
• Punitive damages under Penal Code Section 502(e)(4) for a willful violation, where oppression, fraud, or malice is shown by clear and convincing evidence under Civil Code Section 3294(c).

If the data qualifies as a trade secret, CUTSA separately allows recovery of actual damages, unjust enrichment, a reasonable royalty where damages cannot be proven, and — for willful and malicious misappropriation — exemplary damages of up to twice the compensatory award, plus attorney's fees, under Civil Code Section 3426.3.

The Myth That You Can Take Company Documents to "Prove Your Case"

A persistent and mistaken belief among employees is that they have a right to copy or remove confidential company documents to support a future discrimination, harassment, or wrongful termination claim. California courts have rejected this. In Pillsbury, Madison & Sutro v. Schectman (1997) 55 Cal.App.4th 1279, the California Court of Appeal condemned "self-help" evidence gathering that violates an employer's ownership or privacy interests in its records, ordering an attorney who had received employer personnel files taken without authorization to return them and barring their use.

The Effect on a Wrongful Termination Claim — After-Acquired Evidence

Taking company data does not just create independent liability — it can also significantly limit the value of an employee's own wrongful termination or discrimination claim.

Under the after-acquired evidence doctrine established in McKennon v. Nashville Banner Publishing Co. (1995) 513 U.S. 352, if an employer later discovers, after an allegedly unlawful termination, that the employee engaged in misconduct — such as unauthorized taking of company data — serious enough that the employer would have terminated the employee for that reason alone, the underlying termination claim is not eliminated, but back pay is capped: it runs only from the date of discharge to the date the employer discovered the misconduct. The employer bears the burden of proving both the severity of the misconduct and that termination on that basis was consistent with the employer's actual, settled practice.

If the data theft is instead discovered before termination and cited as one of the reasons for the decision, California applies a related but distinct framework: the "same-decision" or mixed-motive defense recognized in Harris v. City of Santa Monica (2013) 56 Cal.4th 203. If the employer proves that legitimate, independent grounds — including discovered data theft — would have resulted in the same termination decision regardless of any unlawful motive, a court may not award damages, back pay, or reinstatement, leaving only declaratory relief, injunctive relief, and attorney's fees available.

In practical terms: an employee who has a strong, otherwise valid wrongful termination or discrimination claim can substantially undercut its financial value — even to the point of eliminating damages — by taking company data during the course of the dispute.

No Reinstatement or Front Pay Under FEHA — Salas v. Sierra Chemical Co.

The after-acquired evidence doctrine does more than cap back pay — it also forecloses forward-looking equitable remedies. Because the employer would have legitimately terminated the employee upon learning of severe misconduct such as data theft, courts consider it inequitable and pointless to order the employer to reinstate that employee, or to award front pay for a job the employee would no longer lawfully hold.

The California Supreme Court squarely adopted this rule under state law in Salas v. Sierra Chemical Co. (2014) 59 Cal.4th 407. Salas involved an employee who had used another person's Social Security number to obtain his job; after he sued for disability discrimination and retaliation under the Fair Employment and Housing Act (FEHA), the employer discovered the misrepresentation in discovery. The Court held that after-acquired evidence and the related doctrine of unclean hands do not operate as a complete defense to a FEHA claim — the claim itself survives, and liability for the underlying discrimination or retaliation is not erased. But the Court expressly imported the McKennon framework into California law, holding that an employee's recovery is generally limited to lost pay and benefits "from the date of the wrongful discharge to the date the employer acquired information of the employee's wrongdoing," and that remedies extending beyond that point — including reinstatement, promotion, and front pay — are inappropriate because they would grant relief for a period during which the employee had no right to continued employment in the first place.

Applied to a data theft scenario, this means that even where an employee proves a FEHA violation — discrimination, harassment, or retaliation — a California court will generally decline to order reinstatement or award front pay if the employer later discovers the employee took company data without authorization, and can show it would have terminated the employee for that reason alone as a matter of settled policy. The employee's remedy narrows to back pay through the date of discovery, along with any emotional distress damages, punitive damages, and attorney's fees not foreclosed by the after-acquired evidence rule, and the case proceeds without the possibility of getting the job back.

Practical Guidance If You Believe You Have a Claim

1. Do not copy, forward, download, print, or remove company data or devices. This includes emails, personnel files, financial records, client lists, internal messages, and any data stored on company systems or devices — even if you believe it supports your case.
2. Use lawful channels to obtain evidence. A personnel file request under Labor Code Section 1198.5, formal litigation discovery once a case is filed, and administrative processes through the California Civil Rights Department are the proper avenues to obtain company records.
3. Document what you remember without removing originals. Contemporaneous notes describing what you observed — dates, individuals present, and the substance of events — are appropriate and do not implicate data theft statutes.
4. Preserve only what you already lawfully possess. Documents you were independently and properly provided, such as your own offer letter, performance reviews you received, or your own pay stubs, are generally safe to retain.
5. Consult an employment attorney before taking any self-directed action. What feels like reasonable self-protection can create independent legal exposure and materially weaken your own claim.