Summary
This Third Circuit opinion addresses whether workplace computer-use policy violations by two former debt-collection employees constitute unauthorized access under the Computer Fraud and Abuse Act (CFAA) or misappropriation of trade secrets. Following the Supreme Court's guidance in Van Buren, the court held that violating internal IT policies does not create CFAA liability and determined that passwords protecting business information do not qualify as trade secrets. The court also addressed appellate jurisdiction over a Rule 54(b) certified partial judgment while staying related state-law employment claims. Affirming the district court's grant of summary judgment in favor of the employees, the opinion clarifies the scope of the CFAA and trade secret protections in the workplace context.
Topics
Practice areas
Questions Presented
- Whether the District Court properly certified its partial judgment under Federal Rule of Civil Procedure 54(b).
- Whether employees who accessed employer computer systems in violation of workplace computer-use policies nevertheless acted without authorization or exceeded authorized access under the Computer Fraud and Abuse Act.
- Whether passwords protecting proprietary business information constituted trade secrets under the federal Defend Trade Secrets Act and Pennsylvania Uniform Trade Secrets Act.
- Whether the employees' conduct supported Pennsylvania claims for civil conspiracy or breach of the common-law duty of loyalty.
- Whether Durenleau's alteration of account assignments supported a Pennsylvania fraud claim when she believed she was entitled to the resulting bonuses.
Holdings
- The District Court properly certified its judgment for the employees under Rule 54(b), and the Third Circuit had jurisdiction over the partial final judgment.
- The employees did not exceed authorized access under the CFAA because they accessed computer systems and information available to them as employees or through an employee's credentials; violating workplace computer-use policies did not by itself place the accessed information beyond their authorization.
- Absent evidence of code-based hacking, the CFAA does not permit claims against current employees based solely on breaches of workplace computer-use policies.
- The passwords in Durenleau's spreadsheet were not trade secrets under the Defend Trade Secrets Act or Pennsylvania Uniform Trade Secrets Act because they lacked independent economic value apart from the information they protected.
- NRA's civil-conspiracy claim failed because there was no viable underlying civil cause of action and the evidence did not establish the required malicious intent.
- The employees did not breach their Pennsylvania common-law duty of loyalty because NRA did not show that they competed with NRA, aided a competitor, misused employer property for their own or a third party's purposes, or otherwise failed to act for NRA's benefit.
- Durenleau was entitled to summary judgment on NRA's fraud claim because NRA did not produce evidence creating a genuine dispute that she knew her account transfers were false or acted with intent to deceive.
Key quotations
“We remain unpersuaded. Instead, we hold that, absent evidence of code-based hacking, the CFAA does not countenance claims premised on a breach of workplace computer-use policies by current employees.” (22)
“We agree with the District Court and hold that these passwords, which had no independent economic value, were not trade secrets under the DTSA and PUTSA.” (28)
“The CFAA does not reach these violations of workplace computer-use policies, the passwords were not trade secrets, and each of NRA’s state-law tort claims flunks a critical element.” (33-34)
Factual background
While Durenleau was absent from work due to COVID-19 and lacked remote computer access, she gave her credentials to coworker Jamie Badaczewski, who logged into NRA's systems, opened Durenleau's password spreadsheet, and emailed it to Durenleau so she could address an urgent licensing matter. Those actions violated NRA's internal computer-use policies, but neither employee hacked through code-based barriers or accessed a system area to which the employee lacked access. Separately, Durenleau moved collection accounts into her compliance workgroup and received or sought performance bonuses, maintaining that she believed she was eligible under the applicable rules. Both women also alleged persistent sexual harassment and retaliation at NRA, but those counterclaims were stayed and were not the merits of this appeal.
Procedural history
NRA filed suit in the United States District Court for the Middle District of Pennsylvania after Durenleau and Badaczewski accessed NRA's computer systems and transferred a spreadsheet containing passwords, and after Durenleau altered account assignments related to performance bonuses. The District Court granted the employees summary judgment on all claims asserted by NRA and granted them partial summary judgment on their employment-related counterclaims, leaving some counterclaims pending. The District Court certified its judgment for the employees under Federal Rule of Civil Procedure 54(b), and NRA timely appealed.