Recent Disqualification Precedent Raises Interesting Questions About Computer Access and Data Rights

• Jurisdiction: California,United States
• Citation: Vol. 48 No. 3
• Publication year: 2023
• Author: Robert Uriarte
• topic: Contracts,Intellectual Property,Corporate / Commercial,Criminal Law,Civil Procedure,Technology

RECENT DISQUALIFICATION PRECEDENT RAISES INTERESTING QUESTIONS ABOUT COMPUTER ACCESS AND DATA RIGHTS

Robert Uriarte

The California Court of Appeal's March decision in Militello v. VFARM 1509, 89 Cal. App. 5th 602 (2023) holds that if a client "improperly obtained (or maintained) possession of written or digital copies of an adverse party's confidential information and provided them to counsel for use in litigation," the attorney may be disqualified from serving as trial counsel if they "read purloined documents any more closely than is necessary to determine" that they should not be used.¹ Militello involved company emails protected by the spousal communications privilege that one co-owner used as evidence against another in litigation over their jointly owned business. Militello is a significant development in California's disqualification jurisprudence, as it resolves an apparent conflict between prior Court of Appeals decisions on the question of whether disqualification is ever appropriate where a lawyer receives the adverse party's privileged communications from their own client."²

But Militello also raises a bunch of other interesting questions.

To what extent are email communications protected by the spousal communication privilege if the communications constitute the conduct of the corporation's affairs? Might disqualification have been proper if the subject materials were merely confidential, rather than privileged? In a dispute between joint owners of a corporation, who has the authority to grant or deny permission to use corporate systems and data?

The latter question is the most interesting to longtime fans of digital trespass jurisprudence, as it implicates the meaning of an important statutory phrase that has not yet been construed by any California court of appeal: "without permission" as used in California Penal Code § 502. Although it does not squarely address the issue, Militello provides insight into how California courts are likely to construe the notion of "permission" under § 502 and brings into focus several practical issues regarding computer and data access that practitioners should keep in mind.

[Page 75]

THE FACTS

The fact pattern in Militello reads like a great law school exam. Militello (a lawyer), Lawrence (also a lawyer) and Manek co-owned and operated Cannaco Research Corporation (CRC), a licensed manufacturer and distributor of Cannabis products. Militello, Lawrence, and Manek also owned or operated a number of other cannabis-related businesses that had relationships with CRC to varying degrees. In September 2020, with her co-owners' consent, Militello migrated CRC's email system from Microsoft to Google's G-Suite platform. As the person who set up the company G-Suite account for CRC, Militello had "super-administrator" rights enabled by login credentials that gave her control over all the email accounts in CRC's G-Suite environment. The G-Suite account Militello set up for CRC also included email accounts for other CRC-related business, including one owned solely by Militello.

A few months after CRC's G-Suite migration, the parties' business relationship became very uncool, resulting in Militello's ouster as an officer and director of CRC by March 2021. Militello nevertheless remained a co-owner of CRC. After removing Militello from her positions, Militello's co-owners (through CRC) sued Militello alleging, among other claims, violation of the California Comprehensive Computer Data Access and Fraud Act, Cal. Pen. Code, § 502. These § 502 claims were based on allegations that Militello used her super-administrator rights to search for emails, delete entire email accounts, divert CRC emails to alias accounts, and block her business partners' access to various electronic systems necessary for CRC to conduct its business.

In response, Militello filed her own lawsuit, in her personal capacity and derivatively on behalf of CRC, alleging breach of contract, breach of fiduciary duty, and fraud against Lawrence, Manek, and Lawrence's husband Athey. In the course of prosecuting that lawsuit, Militello provided to her attorney emails that Militello downloaded from the CRC G-Suite account using her super-administrator powers. Among the emails Militello provided to her counsel were private communications between Lawrence (wife) and Athey (husband). Oh, did I mention that Athey (also a lawyer) allegedly served as Militello's counsel in "difficult contract negotiations" with Lawrence and Manek? This case was always destined to make its mark on California law. Which brings us to the fun part.

The Court of Appeal did not have an occasion to pass on the merits of the § 502 claims against Militello in resolving the parties' privilege dispute, but the Court's reasoning and conclusion indicate that California's concept of "permission" to access computers and data may be broad—far broader than the concept of "authorization" under the federal computer crimes statute, the Computer Fraud and Abuse Act ("CFAA").

CFAA AND CAL. PENAL CODE § 502

The CFAA is a computer trespass statute that imposes civil and criminal liability on a person who accesses a computer "without authorization" or "exceeding authorized access."³ The CFAA does not define "without authorization," but it does define "exceeding authorized access" to mean "to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter."⁴

For several years, there was a circuit split over whether the concepts of "without authorization" or "exceeding authorized access" under the CFAA incorporate purpose-based limits on...