Employer Liability for an Employee's Unauthorized Email Access
Start a free AI-assisted chat and connect with an experienced California attorney, with no obligation.
Reviewed & verified by A. Jason Velez, Esq.*
Managing Attorney, 1LAW · Last reviewed March 19, 2025
Legal Inquiry
Consumer Legal Issue
I run a small education services business, and my employees and I are based in the United States. One of my part-time employees intentionally altered a student's application email without my permission. The student was locked out of the email account we provided, one email was deleted, and the password for an online application was changed, though the student has since recovered everything. The student is now demanding a large sum in compensation and threatening to sue my employee. My employee is very young and from a low-income family, and I do not want to hold them responsible. If I take full responsibility, what liability would I face?
Attorney Answer
Your exposure is real but narrower than the demand suggests — and before conceding anything, understand that who is even entitled to sue over this account is genuinely contestable, because your agency provided the email account in the first place.
California's computer-crime statute makes it unlawful to knowingly access a computer, computer system, network, or data without permission and to alter, damage, delete, or destroy data, or to access without permission in order to do those things. Deleting an email and changing a password to lock someone out falls squarely within that prohibition, and the statute creates civil liability separate from any criminal exposure.
But the civil action belongs to the owner or lessee of the computer, computer system, network, program, or data. The statute does not say "account holder." Because your agency provided and controlled the application email account, who owns that account and the data in it is a real question rather than an assumption — and it goes directly to how much leverage the demand actually carries. That the student recovered everything themselves also bears on what damages could be shown, since the civil remedy is compensatory.
On your own exposure: an employer can be responsible for an employee's wrongful acts committed within the scope of employment, even without authorizing the specific act. Whether this conduct falls inside that scope depends on facts like whether it was connected to the employee's actual job tasks or was a personal frolic. That distinction is worth pinning down before you volunteer to absorb the entire claim.
What you can do
1. Do not agree to any figure, or acknowledge responsibility in writing, before getting legal advice — a demand is an opening position, not a liability finding.
2. Get a written account from your employee of exactly what was done and why, while memories are fresh.
3. Confirm with the student in writing that access and content have been fully restored, and keep that confirmation.
4. Have a California attorney assess who the legal owner of the account and data is, and whether the conduct fell within the scope of employment.
5. Check whether your business carries liability or cyber coverage that could respond to a claim like this before you respond further.
*Attorney review is supported by AI-assisted drafting and legal research algorithms. Use of this Chat does not create an attorney-client relationship.
By using this service you agree to our Terms of Use and our Privacy Policy.
Courts & Legal Aid in California
- File or look up a case through the California Courts.
- Get free civil legal help from LawHelpCA.
- Use the LSC — Find Legal Aid to find a local legal-aid office by ZIP code.
- Use the LawHelp.org to browse free legal information and self-help resources.
- Use the ABA Lawyer Referral Directory to get matched with a local attorney through your state bar.
Frequently Asked Questions
What does California's computer crime statute prohibit?
Among other things, it prohibits knowingly accessing and without permission altering, damaging, deleting, destroying, or otherwise using data or a computer system; knowingly taking or copying data without permission; and accessing a system without permission in order to alter or delete data or programs.
Who can bring a civil claim under California's computer crime statute?
The statute gives the civil action to the owner or lessee of the computer, computer system, computer network, computer program, or data who suffers damage or loss. It does not use the word "account," which can make ownership a genuine question where an organization supplies the account an individual uses.
Can a California employer be liable for an employee's wrongful acts?
An employer can be responsible for an employee's wrongful acts committed within the scope of employment, even where the employer did not authorize the specific act. Whether particular conduct falls within that scope depends heavily on the facts, including how closely it was connected to the employee's actual duties.
