California gives the owner of a computer system or data a civil claim against someone who accesses and takes, copies or uses that data without permission. Eagan Law represents businesses pursuing these claims against former employees and insiders. Serving Los Angeles, Santa Monica, Beverly Hills and Malibu.
Section 502 reaches conduct that trade secret law may not. For a business whose value lives in its data, that can matter.
Penal Code § 502, California's Comprehensive Computer Data Access and Fraud Act, is a criminal statute that also gives the owner or lessee of a computer, system, network, program or data a civil action when it suffers damage or loss. Among the prohibited acts are knowingly accessing data without permission and taking, copying or using it; knowingly using computer services without permission; and knowingly accessing a computer, system or network without permission.
In employment disputes, section 502 claims typically arise when a departing employee, manager or contractor copies files to personal accounts or devices, continues to access company systems after resignation or termination, uses someone else's credentials, or deletes or alters company data. Eagan Law represents businesses evaluating and pursuing those claims, usually together with trade secret and confidentiality claims and other departing employee claims.
The statute's key phrase is "without permission," and courts have not always read it the same way. Whether conduct falls inside the statute depends on the permissions the employee actually had, the company's policies and the evidence of what was accessed, taken and used.
A civil action under section 502 must generally be filed within three years of the act or of the discovery of the damage, whichever is later.
Compensatory damages (including reasonable costs of verifying whether data was altered or damaged), injunctive relief, attorney's fees in the court's discretion and, for willful violations proved by clear and convincing evidence of oppression, fraud or malice, punitive damages.
In 2026 a California Court of Appeal held that the Uniform Trade Secrets Act does not displace section 502 claims (Guild Mortgage Co. LLC v. CrossCountry Mortgage LLC (2026) 120 Cal.App.5th 885, 901–904, reversing the trial court).
Copying, forwarding or downloading company data to personal accounts or devices before or at departure, and using it for a new employer or venture.
Continued use of credentials, shared accounts or system access after the right to access has ended.
Destroying, altering or withholding company data on the way out, including wiping devices or deleting accounts.
The statute is not limited to employees. Former partners, contractors, vendors and managers can also be defendants when they access and use data without permission.
The details vary by subdivision, but a civil claim generally requires each of the following. Disputes commonly center on the second and third.
The plaintiff owns or leases the computer, system, network, program or data at issue.
The defendant knowingly accessed the computer or data, or knowingly used computer services.
The conduct was without the owner's permission. What counts as permission, particularly for someone with legitimate access who then misuses it, has been a contested question.
The plaintiff suffered damage or loss as a result, which can include the cost of verifying whether data was altered, damaged or deleted.
Section 502 cases turn on permissions and proof. We examine both before we plead.
We review the access the employee actually had, the policies in place and the agreements signed, because "without permission" is the central issue.
System logs, device records and account histories can be lost quickly. We help you identify and preserve what exists before it changes.
Section 502 is usually one claim among several. We choose and sequence them so that the claims reinforce rather than undermine one another.
These matters often involve sensitive business information and departing personnel. We handle them with the confidentiality they require.
Subdivision (e) of Penal Code § 502 authorizes a civil action by the owner or lessee of the affected computer, system, network, program or data. It provides for compensatory damages, injunctive or other equitable relief, and, in the court's discretion, reasonable attorney's fees. Punitive damages are available for a willful violation where there is clear and convincing evidence of oppression, fraud or malice.
The Ninth Circuit has held that section 502(c)(2) does not require unauthorized access to a computer and reaches the unauthorized taking or use of data, even by someone who had permission to access the system (United States v. Christensen (9th Cir. 2015) 828 F.3d 763). Other courts have read "without permission" differently, so the outcome in a particular case depends on the facts and the court.
The federal Computer Fraud and Abuse Act (18 U.S.C. § 1030) is narrower in some respects after Van Buren v. United States (2021) 593 U.S. 374, which read "exceeds authorized access" to cover those who access areas of a system that are off-limits to them, not those who misuse information they were entitled to see. That makes the state statute a significant part of the analysis in California departure cases. In 2026 the California Court of Appeal held in Guild Mortgage Co. v. CrossCountry Mortgage LLC that CUTSA does not displace section 502 claims, the first California appellate decision to address the question.
Deadline: A civil action under section 502 must generally be commenced within three years of the date of the act complained of, or the date of discovery of the damage, whichever is later. Evidence tied to the access, such as logs and device records, may be retained for far shorter periods, so prompt action matters.
General information only: This page describes California law in general terms and is not legal advice. Whether a claim exists, and what it is worth, depends on the specific facts, the documents involved and the evidence available. Reviewing this page does not create an attorney-client relationship.
Published October 17, 2026. Last updated October 17, 2026.
Possibly. Having a login does not necessarily mean permission to take or use data in the way the employee did. The Ninth Circuit has held that section 502(c)(2) can reach the taking or use of data without permission even by someone who accessed the system with permission (United States v. Christensen), but courts have not all read the statute the same way, and the company's policies and the scope of the employee's authorization matter.
The civil remedy under Penal Code § 502 includes compensatory damages, which can cover the reasonable cost of verifying whether data was altered, damaged or deleted; injunctive or other equitable relief; and, in the court's discretion, reasonable attorney's fees. Punitive damages may be awarded for a willful violation where there is clear and convincing evidence of oppression, fraud or malice.
A civil action must generally be commenced within three years of the date of the act complained of, or the date of discovery of the damage, whichever is later. Because logs and device records can be overwritten or deleted, the practical window to preserve evidence is usually much shorter than the statute of limitations.
In Guild Mortgage Co. LLC v. CrossCountry Mortgage LLC (2026) 120 Cal.App.5th 885, 901–904, the court held that CUTSA does not displace claims under section 502, reasoning that the statutes protect different interests. The decision was the first California Court of Appeal ruling on the question. How it applies to a particular case depends on the facts.
Typically: system access logs, email and cloud-storage records, device and account histories, the company's access policies and the agreements the employee signed. Preserve these before anything is reissued, wiped or deleted, and involve counsel before contacting the employee.