It can be. California’s computer crime law, Penal Code section 502, punishes knowingly accessing a computer system “without permission,” and its employment exemption covers only acts within the scope of a job you still hold. A password that still works does not by itself show that you had permission, and copying or using data after logging in is a more serious offense than the login alone.

Logging in versus taking data

Penal Code section 502 treats getting into a system and taking something from it as separate offenses:

  • Access alone. Subdivision (c)(7) covers anyone who “knowingly and without permission accesses or causes to be accessed any computer, computer system, or computer network.” Checking an old inbox or shared calendar falls here. Under section 502(d)(3), a first violation that causes no injury to data or systems is an infraction with a fine of up to $1,000. The exposure grows with the employer’s reasonable cost of checking whether anything was altered or damaged: up to $5,000 in such costs, or a repeat violation, allows up to a year in county jail, a fine of up to $5,000, or both, and more than $5,000 allows a felony or misdemeanor charge.
  • Taking or using data. Subdivision (c)(2) reaches anyone who “knowingly accesses and without permission takes, copies, or makes use of any data” from a computer, system, or network. Downloading a client list or forwarding files to a personal account fits that description. Even a first violation can be filed either way (section 502(d)(1)). As a felony, the sentence is 16 months or two or three years under Penal Code section 1170(h), plus a fine that can reach $10,000. As a misdemeanor, it is county jail for no more than a year, a fine that can reach $5,000, or both.

Why the employment exemption does not cover you after termination

Section 502(h)(1) says subdivision (c) does not punish acts “committed by a person within the scope of lawful employment,” which it defines as acts “reasonably necessary to the performance of their work assignment.” After a termination there is no work assignment left for a login to serve, so this exemption does not fit access after your job has ended.

A second, narrower exemption is easy to misread. Section 502(h)(2) excuses unauthorized use of computer services under paragraph (3) by “a person acting outside of their lawful employment” if the activity causes no injury or the services used total $250 or less, and section 502(i) bars prosecuting that exempt activity under paragraphs (2), (4), or (7) when it only incidentally violates them. Both provisions speak of “the employee’s activities,” and neither says whether it reaches someone whose employment has already ended.

The statute defines “access” but not “without permission.” Whether you had permission turns on the facts: what the employer told you, what you signed, and whether any account was deliberately left open to you.

Federal law can apply too

The federal Computer Fraud and Abuse Act punishes anyone who “intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains” information, including information from a protected computer, a term that covers a computer “used in or affecting interstate or foreign commerce or communication” (18 U.S.C. section 1030(a)(2), (e)(2)). Section 1030(a)(4) covers accessing a protected computer the same ways, knowingly and with intent to defraud, when the access furthers the fraud and obtains anything of value (with an exception when the only thing obtained is use of the computer worth $5,000 or less in a year). Section 1030(e)(6) defines exceeding authorized access as using authorized access to obtain or alter information “that the accesser is not entitled so to obtain or alter.”

In Van Buren v. United States (2021), a police sergeant used his own valid credentials on his patrol-car computer to run a license-plate search for money, against department policy. The Supreme Court held that he did not exceed authorized access: the clause covers people who obtain information from areas of a computer, “such as files, folders, or databases,” that are off limits to them, not people who “have improper motives for obtaining information that is otherwise available to them.” The Court reversed the ruling against him and sent the case back.

The Court read both clauses as a “gates-up-or-down inquiry,” but it expressly left open whether that inquiry depends only on technological, code-based limits on access or also on “limits contained in contracts or policies” (footnote 8). That open question can matter for a fired employee whose password still works, so Van Buren does not settle that situation either way.

If this applies to you

  • Stop logging in, and do not use, forward, or share anything you took. Deleting it is not the answer either; ask a lawyer how to preserve and return it.
  • Write down when your job ended, what you were told about your access, and whether any account was left open to you on purpose.
  • The employer can also sue. Section 502(e) lets an owner who suffers damage or loss bring a civil action, with attorney’s fees possible, within three years after the act or after the damage is discovered, whichever is later.
  • Trade secrets or confidential client information can raise separate legal issues beyond section 502.

Get advice before you decide what to do next

Before you respond to your former employer or to investigators, the Law Offices of David S. Chesley can go over what you accessed, when, and on what understanding, under both state and federal law. Call (800) 755-5174 to talk through your situation.