Filed 9/4/26 Sillman v. Newnham CA4/1
NOT TO BE PUBLISHED IN OFFICIAL REPORTS California Rules of Court, rule 8.1115(a), prohibits courts and parties from citing or relying on opinions not certified for publication or ordered published, except as specified by rule 8.1115(b). This opinion has not been certified for publication or ordered published for purposes of rule 8.1115.
COURT OF APPEAL, FOURTH APPELLATE DISTRICT
DIVISION ONE
STATE OF CALIFORNIA
STEVEN SILLMAN, D083732, D084394
Plaintiff and Respondent,
v. (Super. Ct. No.
37-2021-00021625-CU-BT-CTL)
M. KATHRYN NEWNHAM, as Personal Representative, etc., et al.,
Appellants.
CONSOLIDATED APPEALS from a judgment and postjudgment orders of the Superior Court of San Diego County, Joel R. Wohlfeil, Judge. Judgment reversed in part; postjudgment orders reversed and remanded with directions.
Niddrie Addams Fuller Singh and John S. Addams; Pinnacle Legal and Vincent Renda; Law Office of John A. Simpson and John A. Simpson, for Appellants Atlas Storage, LLC and M. Kathryn Newnham, as personal representative of the estate of Defendant Dixie J. Reynolds.
Niddrie Addams Fuller Singh and John S. Addams; Law Office of R.
Anthony Mahavier and R. Anthony Mahavier, for Defendant and Appellant, Evelyn Steuermann.
No appearance for Plaintiff and Respondent.
Appellants M. Kathryn Newnham, as personal representative of the estate of Dixie J. Reynolds, and Atlas Storage, LLC (Atlas) appeal a judgment following a special jury verdict on plaintiff and respondent Steven Sillman’s
claim that Atlas and Reynolds violated Penal Code section 5021 of California’s Comprehensive Computer Data Access and Fraud Act (CDAFA or the Act). The jury found Atlas and Reynolds had knowingly accessed Sillman’s e-mail account without his permission, awarding Sillman $1 in damages against Reynolds and $40,000 against Atlas. While the jury found Atlas’s bookkeeper and comptroller, appellant Evelyn Steuermann, had also accessed Sillman’s e-mail account, it further found she did so while acting within the scope of her employment. Because the Act creates an exception for persons acting within the scope of employment (§ 502, subd. (h)(1)), the court entered judgment in Steuermann’s favor. The court later awarded Sillman $93,808 in attorney fees under the Act, but denied Steuermann attorney fees, finding Sillman’s claim against her was not frivolous or abusive.
Newnham and Atlas contend the Act does not apply because defendants did not “knowingly access” or “use” the e-mail account within the meaning of the Act, and Sillman was not the sole owner of the account. They
1 Undesignated statutory references are to the Penal Code. While these appeals were pending, Reynolds’s counsel notified us that Dixie J. Reynolds had passed away. Counsel has since substituted M. Kathryn Newnham, the personal representative of Reynolds’s estate, as the appellant. At times, we refer to Reynolds and Atlas collectively as defendants.
3
argue Sillman’s remedy was to sue for negligence or claim his e-mails’ destruction supported his complaint’s other claim of an ownership interest in Atlas, his former employer. Newnham and Atlas further contend Sillman failed to prove the market value of his e-mails, thus the jury’s damages awards are unsupported by substantial evidence.
Newnham and Atlas also appeal from the court’s postjudgment order awarding Sillman $98,808 in attorney fees under the Act. Their sole argument is if we reverse the judgment, we must reverse the attorney fee award as well. Steuermann appeals the order denying her attorney fees, contending the court abused its discretion by conditioning the award on a finding of whether Sillman’s claim was frivolous or abusive. She asks us to reverse the order and direct the court to reconsider her attorney fees motion, exercising its broad discretion to award a prevailing defendant fees “under
the plain language of [section 502] with no conditions.”2 We agree Sillman did not prove Reynolds or Atlas violated section 502, and that the jury’s damages award—based solely on the section 502 claim—is unsupported by the evidence. Accordingly, we reverse the judgment against them as well as the court’s attorney fees award to Sillman, which falls with the reversal. As for the issues raised by Steuermann’s attorney fee appeal, we resolved them in Hay v. Marinkovich (2025) 108 Cal.App.5th 707, which held a prevailing defendant on a section 502 claim is entitled to attorney fees under that statute, but only if he or she demonstrates the plaintiff’s claim was objectively without foundation when brought, or the plaintiff continued
2 Sillman also filed an appeal but this court dismissed it after he failed to file an opening brief. Sillman has not filed a respondent’s brief. We do not treat that failure as a default or admission of error, but independently examine the record and reverse only if we find prejudicial error. (Kennedy v. Eldridge (2011) 201 Cal.App.4th 1197, 1203; see In re Bryce C. (1995) 12 Cal.4th 226, 233.)
4
to litigate after it clearly became so. (Id. at p. 713.) We reverse the order denying Steuermann attorney fees and direct the trial court on remand to address her request for attorney fees under those standards.
FACTUAL AND PROCEDURAL BACKGROUND Sillman, Reynolds’s son-in-law, was hired as an Atlas employee by Reynolds’s husband. As of 2018, Sillman helped run various Atlas entities and properties with Steuermann. After her husband’s death, Reynolds became part of Atlas’s daily operation and hired a management company for it. Reynolds fired Sillman in 2021.
In May 2021, Sillman sued Reynolds, Atlas and related entities, in part alleging that in 2015, he and Reynolds’s husband orally agreed he would be provided a specified ownership interest in Atlas.
In October 2021, Steuermann contacted representatives at GoDaddy.com (GoDaddy) because Reynolds’s e-mail address, which she used for both business and personal purposes, had stopped working. Steuermann told the representative that she was just trying to recover that one e-mail address. The GoDaddy representative instructed Steuermann to provide documentation at a secure site to prove Reynolds’s identification, and after Steuermann did so, the GoDaddy representative told her the account had been suspended for nonpayment. Steuermann looked at Atlas’ credit card statements and discovered that Atlas had been paying for the account, which stopped working in May 2021 because Sillman’s company credit card, eliminated after his termination, had been declined. GoDaddy then assisted Steuermann in getting the credit card working again, including by resetting the password so that she could change it. In doing so, Steuermann saw there were other e-mail addresses unaffiliated with Atlas in the account, and became concerned that Sillman could see Reynolds’s e-mails. Steuermann
5
moved Reynolds’s e-mails to a separate GoDaddy account. She could see the rest of the accounts, but did not know what happened with them. Steuermann changed the log-in information and password to protect Reynolds’s e-mails. She did not delete anything.
Sillman eventually filed supplemental pleadings adding Steuermann as a party and including a cause of action for a violation of section 502. In that cause of action, Sillman alleged he was the owner of a GoDaddy internet service provider account (hereafter the account or the GoDaddy account) containing e-mail accounts, websites, domains and electronically stored information. He alleged that Atlas, Reynolds and Steuermann knowingly
accessed that account without his permission.3 According to Sillman, they then changed its ownership from him to Reynolds; reset his password to prevent him from accessing the account; changed the names of certain of his e-mail accounts; and used, read, downloaded, took, lost and/or destroyed thousands of his private and privileged e-mails, documents, communications and electronically stored information. He sought injunctive relief, statutory treble damages, interest, as well as attorney fees and costs.
The matter proceeded to a jury trial. At trial, Sillman’s counsel read from Steuermann’s recorded interactions with GoDaddy representatives. One GoDaddy representative sent Steuermann an e-mail with a customer number and a password reset. Steuermann responded by telling the representative, “Now I really want to . . . recover one e-mail out of there. The rest of the account, I don’t need any of the e-mails that are on there.” Steuermann asked the representative to identify the other e-mails, and he did, telling her that some were Microsoft e-mails and listing them. The
3 The supplemental complaint alleges that the access occurred in October 2022, but Steuermann testified she contacted GoDaddy in October 2021.
6
GoDaddy representative explained that he had to set up a workspace five-e- mail plan, even though Steuermann only wanted to restore one e-mail. In response to Steuermann’s questions, he said the e-mails had officially left the account on October 17, 2021, which meant they had expired in late September 2021. Steuermann and the representative went over some of Sillman’s e-mail domains, with the representative explaining that some of them had already been moved to Microsoft and others the representative had moved over. In the process, Steuermann said, “So the—[¶] . . . [¶] . . . only one that needs to be in this is just [Reynolds’s e-mail address] . . . [¶] . . . [¶] . . . “I just wanted—I’m not really clear on how all of this is set up and works.” She also said, “So under this account, now it still has all of those either [sic] e-mails, but they really aren’t active, correct?” The GoDaddy representative responded, “Correct. Yeah.”
Later, Steuermann called back frustrated that she had not been able to get the new e-mail account to work. The GoDaddy representative explained that “when things go past due, sometimes . . . the stuff will get stuck in the server . . . .” He asked whether she was going to keep the e-mail in the workspace e-mail server or move it to Microsoft. Steuermann responded: “Well, you know, here’s the thing. This account was set up by an exemployee . He’s got all kinds of domains in there, and we really just want this one. I want to get rid of everything else because it’s not affiliated with the company.” The representative instructed Steuermann to open another account by clicking on a domain transfer button, and said: “Then what we would do as far as the e-mail, is it would cancel the e-mail, it would cancel the e-mail renewal from the other day, and we’d rebuy the e-mail plan in the other account, and we’d have a little system move-over that we would do. It
7
shouldn’t take more than, like, [10] or 15 minutes to get everything organized.”
Steuermann then activated the new account, but saw the other e-mail domains. She asked what was going to happen with the other account. The representative told her: “The other account will just stay with all those other products in there, but the card that you used yesterday is no longer going to be in there. So I would tell whoever that employee is, if you still have contact with them at least, tell them that . . . they would want to go through and update that account to being underneath his or her own name and then update . . . the payment method (indiscernible) stuff. Otherwise, like, these things are all going to basically not be able to be renewed.”
Steuermann testified that she did not tell Sillman she would be contacting GoDaddy or get his permission to do so. After speaking with the GoDaddy representative, she did not notify anyone they would need to renew their GoDaddy e-mail accounts or they would no longer be renewable. Specifically, she did not tell Sillman that she had contacted GoDaddy. She did not know if any of Sillman’s GoDaddy accounts were reinstated. On cross examination, Steuermann testified that her sole intent was to restore Reynolds’s e-mail, and nothing else. By the time she communicated with GoDaddy, Sillman had already sued the company, which had an impact on whether she could contact him and tell him what had transpired.
Sillman testified that he used his personal credit card when he set up Reynolds’s GoDaddy e-mail account, and that was his practice when paying for those accounts. He never gave Steuermann permission in October 2021 to contact GoDaddy and have his account deleted; he found out that Steuermann had contacted GoDaddy when all of his e-mails went missing. Sillman had his accounts restored, but not the e-mails. When asked what
8
kind of information was within them, he stated: “A lot of personal stuff that was irreplaceable, letters from—e-mails from my dad who passed, both grandfathers. I coached my kids’ soccer, so we had like, you know, that kind of stuff, the—just more personal-type stuff, and a lot of business stuff. It was over a 15-year time frame. . . . Something like that. [¶] . . . So it was all the tax stuff. All the business agreements, and that includes with clients. There’s a lot of stuff there. Just stuff you can’t replace. A lot of stuff in this case. We don’t know what we’re missing here.” Sillman estimated the number of important e-mails on the GoDaddy servers to be “maybe 20,000 or so.” He stated generally that the attachments to them included “[a] lot of photos” and “[a] lot of kid stuff that you can’t replace.” Sillman did not produce a GoDaddy employee, technology expert or computer expert for trial.
In closing arguments, Sillman’s counsel explained that Sillman paid for and created the GoDaddy accounts and put Reynolds’s and her husband’s personal e-mail accounts under that umbrella, but defendants directed Steuermann to move Reynolds’s account out and delete Sillman’s e-mails because they were afraid Sillman would find information helpful to his legal case against them. Counsel asserted that Steuermann authorized GoDaddy “over and over again . . . to delete the other accounts.” He pointed out that Steuermann did not contact Sillman about his e-mail accounts because they “didn’t want him to know” but rather “wanted these accounts to become permanently deleted . . . .” Counsel argued: “And they did it with total disregard for the value of his account. He said he had 20,000 e-mails on there. He had photographs of his children and his relatives that he’ll never get back. He had banking information and company information, basically his whole life on those accounts and they—like going into a house and
9
burning it down to hide the evidence, did the exact same thing.” Counsel told the jury they would “be asked to come up with a value for those e-mails.”
Reynolds’s counsel argued that the entire phone call with GoDaddy happened only because Reynolds’s e-mail did not work, so not knowing who to call, she asked Steuermann to handle it. Counsel stated that Reynolds did not tell Steuermann to also “dump all [Sillman’s] e-mails.” He pointed out that someone had already transferred some of the e-mail accounts to Microsoft and that it was probably Sillman, but that Sillman had not mentioned or recalled any e-mails supporting his claim of an ownership interest in Atlas. Steuermann’s counsel argued that GoDaddy deleted Sillman’s data, not Steuermann, and that the evidence was that Steuermann was not looking for Sillman’s account, only Reynolds’s e-mail and nothing else.
On the section 502 claim, the trial court instructed the jury that Sillman had to prove: (1) he is the owner of the GoDaddy.com, LLC Internet Service Provider account; (2) defendants knowingly accessed his account; (3) defendants’ use of the account was without his permission; (4) he was harmed; and (5) defendants’ conduct was a substantial factor in causing his harm.
The jury found Sillman was the owner of the GoDaddy account, and that Reynolds and Atlas knowingly accessed that account without Sillman’s
permission.4 It found that as a result of those actions, Sillman sustained $1 in damages from Reynolds, $20,000 from Atlas in past economic loss, and
4 The jury found that Steuermann accessed Sillman’s e-mail account but did so while acting in the scope of her employment. The court thus entered judgment in Steuermann’s favor under the exception contained in section 502, subdivision (h)(1). (See People v. Childs (2013) 220 Cal.App.4th 1079, 1100.)
10
$20,000 from Atlas in future economic loss. The jury rejected Sillman’s claims pertaining to any ownership interest in Atlas. The court entered judgment accordingly.
Reynolds and Atlas then moved for judgment notwithstanding the verdict as to the section 502 claim on grounds Sillman had not presented evidence that any of his e-mails or the deleted data had market value. They asked the court to strike the damages award. Reynolds and Atlas argued in the alternative that Sillman had not produced evidence of intentional or malicious conduct. They pointed out that in all the evidence from Steuermann herself or the calls to GoDaddy representatives, Steuermann never directed GoDaddy to delete anything and GoDaddy did not state it intended to do so. They argued Sillman “never introduced evidence, documentary or otherwise, to show when the [GoDaddy] accounts were deleted or by whom, much less how any defendant caused that deletion, intentionally, willfully, or even inadvertently.” The trial court denied the motion, finding “a rational foundation in the evidence to support the jury verdict.”
DISCUSSION
I. Appeal of Judgment Against Reynolds and Atlas for Violating Section 502 A. The Act The Act “is essentially an anti-computer hacking statute that was enacted to prohibit the unauthorized use of any computer system for an improper purpose.” (Hay v. Marinkovich, supra, 108 Cal.App.5th at p. 717; see Chrisman v. City of Los Angeles (2007) 155 Cal.App.4th 29, 34 [“Section 502 defines ‘access’ in terms redolent of ‘hacking’ or breaking into a computer”]; People v. Gentry (1991) 234 Cal.App.3d 131, 141, fn. 8 [discussing legislative purposes of section 502].) “Section 502 was first created in 1979
11
because ‘no statute specifically proscribes fraud committed by means of computer, or prohibits the alteration or destruction of computers or computer programs.’ [Citation.] There was concern that ‘[s]abotage of a computer could seriously disrupt business or government operations.’ [Citation.] The stated goal of this new legislation was to tackle computer ‘misuse,’ like the ‘manipulation resulting in the payment of money not owed’ or the ‘concealment of embezzlement.’ [Citation.] When the original statute was repealed and replaced in 1987, that concern remained at the forefront. The law was changed in order ‘to provide for increased penalties for computer “hackers” and to provide standardized definitions of terms.’ ” (Teran v.
Superior Court (2025) 112 Cal.App.5th 371, 381-382 (Teran).)5 The Act subjects a party to criminal liability for various actions, many of which require the person “knowingly access” computers or data without permission. (§ 502, subd. (c)(1), (2), (4), (5), (7), (11).) A person is liable if he or she “[k]nowingly accesses and without permission alters, damages, deletes, destroys, or otherwise uses any data . . . in order to either (A) devise or
5 In 1987, lawmakers added a statement of legislative intent (Teran, supra, 112 Cal.App.5th at p. 382): “It is the intent of the Legislature in enacting this section to expand the degree of protection afforded to individuals, businesses, and governmental agencies from tampering, interference, damage, and unauthorized access to lawfully created computer data and computer systems. The Legislature finds and declares that the proliferation of computer technology has resulted in a concomitant proliferation of computer crime and other forms of unauthorized access to computers, computer systems, and computer data. [¶] The Legislature further finds and declares that protection of the integrity of all types and forms of lawfully created computers, computer systems, and computer data is vital to the protection of the privacy of individuals as well as to the well-being of financial institutions, business concerns, governmental agencies, and others within this state that lawfully utilize those computers, computer systems, and data.” (See also People v. Childs, supra, 229 Cal.App.4th at pp. 1099-1100.)
12
execute any scheme or artifice to defraud, deceive, or extort, or (B) wrongfully control or obtain money, property, or data.” (§ 502, subd. (c)(1).) A person is liable if he or she “[k]nowingly accesses and without permission takes, copies, or makes use of any data from a computer, computer system, or computer network, or takes or copies any supporting documentation, whether existing or residing internal or external to a computer, computer system, or computer network.” (§ 502, subd. (c)(2).) Liability attaches to one who “knowingly and without permission uses or causes to be used computer services” (§ 502, subd. (c)(3)), which the Act defines as including “electronic mail services.” (§ 502, subd. (b)(4).) It also attaches to a person who “[k]nowingly and without permission disrupts or causes the disruption of computer services or causes the denial of computer services to an authorized user of a computer, computer system or computer network.” (§ 502, subd. (c)(5).) The Act imposes liability on a person who “[k]nowingly accesses and without permission . . . deletes[ ] or destroys any data . . . which reside or exist internal or external to a
computer, computer system, or computer network.” (§ 502, subd. (c)(4).)6 “ ‘Access’ means to gain entry to, instruct, cause input to, cause output from, cause data processing with, or communicate with, the logical, arithmetical, or memory function resources of a computer, computer system, or computer network.” (§ 502, subd. (b)(1).) “ ‘Data’ means a representation of information, knowledge, facts, concepts, computer software, or computer
6 The Act sets out fourteen categories of activity that constitute an offense. (§ 502, subd. (c)(1)-(14); see People v. Hawkins (2002) 98 Cal.App.4th 1428, 1440 [“the statute describes a number of computer crimes in somewhat overlapping language”].) Sillman’s complaint did not specify which sections defendants assertedly violated. Some categories involve government computers or public safety infrastructure (§ 502, subd. (c)(10)-(12), (14)) or knowingly introducing a computer “contaminant” (§ 502, subd. (8)). Those provisions are inapplicable to these facts.
13
programs or instructions. Data may be in any form, in storage media, or as stored in the memory of the computer or in transit or presented on a display device.” (§ 502, subd. (b)(8).)
The Act “authorizes ‘the owner or lessee of the . . . data who suffers damage or loss by reason of a violation of [the statute]’ to bring a civil suit.” (Garrabrants v. Erhart (2023) 98 Cal.App.5th 486, 507; § 502, subd. (e)(1); see also Erhart v. Bofl Holding, Inc. (2019) 387 F.Supp.3d 1046, 1057 [the Act “grants a private right of action for compensatory damages and other relief to ‘the owner . . . of the computer . . . or data who suffers damages or loss by reason of a violation’ ”]; see also NovelPoster v. Javitch Canfield Group (N.D.Cal. 2014) 140 F.Supp.3d 954, 964.) Under the statute, that owner “may bring a civil action against the violator for compensatory damages and injunctive or other equitable relief. Compensatory damages shall include any expenditure reasonably and necessarily incurred by the owner . . . to verify that a computer system . . . or data was or was not altered, damaged, or deleted by the access.” (§ 502, subd. (e)(1).) B. Contentions and Standard of Review Appellants contend section 502 does not apply to Sillman’s claims.
Relying on Sunbelt Rentals, Inc. v. Victor (N.D.Cal. 2014) 43 F.Supp.3d 1026 and Chrisman v. City of Los Angeles, supra, 155 Cal.App.4th 29, they argue Reynolds and Atlas did not “knowingly access” the GoDaddy account within the Act’s meaning of that phrase, stating “[t]his was not a case of ‘hacking’ or even akin to hacking, for an improper or illegitimate purpose.” Comparing the facts to those in Sunbelt Rentals, they argue Reynolds and Atlas “did not circumvent barriers intended to protect access to the GoDaddy account” but instead, “Steuermann contacted GoDaddy, explained the circumstances, provided the requested documentation, and only after GoDaddy verified it,
14
was given access to the account.” As part of this contention, Newnham and Atlas argue that Sillman did not present evidence he was the sole owner of the GoDaddy account. They argue that because Reynolds and Atlas had “some level of ownership rights to the account, Sillman could not claim a section 502 violation as a matter of law.”
Appellants further contend Reynolds and Atlas did not “use” the account within the Act’s meaning in that there was “no evidence that they took, looked at, or used the other e-mails in the account.” They argue that to the extent “use” includes deletion of data, Reynolds and Atlas did not delete Sillman’s e-mails, rather, GoDaddy did because Sillman failed to update the account’s payment information after he left Atlas. According to appellants, the transcripts of Steuermann’s interactions with GoDaddy reflect that all Sillman had to do was contact GoDaddy to place the account under his name and update the payment information.
Finally, appellants argue that even assuming the Act applies, the judgment must be reversed for the absence of evidence of the market value of Sillman’s deleted e-mails. They argue that “Sillman may have offered sufficient evidence to show a sentimental value on the deleted e-mails, [but] he did not offer substantial evidence establishing that it had a ‘market value,’ ” meaning “what a buyer would pay for the e-mails or the data they contained.” They rely on authority applying the definition to the theft of electronic data such as stolen access card information (People v. Liu (2019) 8 Cal.5th 253, 257), browsing history (Brown v. Google LLC (N.D.Cal. 2023) 685 F.Supp.3d 909, 940) and misappropriated data (Marshall & Swift/Boeckh, LLC v. URS Corporation (C.D.Cal., Feb. 22, 2012, No. CV 08- 04375) 2012 WL 12964282, at p. *2). Appellants argue that personal value is
15
irrelevant to market value, citing Civil Code section 3355’s definition of peculiar value and McMahon v. Craig (2009) 176 Cal.App.4th 1502.
Here, the jury made factual findings in Sillman’s favor in its special verdicts, including as to damages. In that instance, we apply the substantial evidence standard of review to decide whether the evidence supports the jury’s verdict. (See, People v. Gentry, supra, 234 Cal.App.3d at p. 140; see generally Conservatorship of O.B. (2020) 9 Cal.5th 989, 1005-1006; Padideh v. Moradi (2023) 89 Cal.App.5th 418, 438 [when a jury decides the facts and the ensuing appeal raises the sufficiency of the evidence to support the jury’s verdict, we would apply substantial evidence review on appeal].) Where defendants’ claims rest on the meaning of the Act, we exercise de novo review. (Accord, Teran, supra, 112 Cal.App.5th at p. 378.) “Our fundamental task in interpreting a statute is to determine and effectuate the intended purpose of the Legislature. [Citation.] To do that, we first look to the statutory language, which usually provides the best indicator of the statute’s purpose. [Citation.] If it is unambiguous, then its plain meaning controls, and that is the end of the analysis. [Citation.] If, however, the language is ambiguous, then we look to extrinsic aids, including the legislative history.” (Hay v. Marinkovich, supra, 108 Cal.App.5th at p. 719; see also Teran, at pp. 378-379.) C. The Evidence Fails to Support The Jury’s Findings Under the Act The evidence summarized above shows that Steuermann contacted GoDaddy for one purpose: to recover or reinstate Reynolds’s e-mail address so that Reynolds’s could again use it. With GoDaddy’s assistance, she changed the password and gained entry to the account, which contained both Sillman’s and Reynolds’s e-mail addresses, and ultimately created a new account only for Reynolds’s e-mail. In the course of doing so, the GoDaddy
16
representative informed Steuermann that the other e-mail addresses within the account had become disabled the prior month due to nonpayment.
As stated above, the Act permits a civil action only by one who is the “owner or lessee of the computer, computer system, computer network, computer program, or data who suffers damage or loss by reason of a violation . . . .” Even if we assume arguendo Sillman owned or at least partly owned the GoDaddy e-mail account to the extent of his personal e-mail
addresses and the data within those,7 there is no evidence Sillman owned or leased any “computer, computer system, or computer network” involved in this matter. This eliminates defendants’ liability under various subsections of the Act prohibiting knowing and unauthorized access of, or damage to a computer (§ 502, subd. (c)(6), (7), (8)) or “provid[ing] or assist[ing] in providing a means of accessing a computer [or] computer system . . . .” (§ 502,
7 We query whether Sillman continued to “own” his e-mail addresses and accounts, as well as the data within them, once GoDaddy disabled the accounts due to nonpayment. “[T]he concept of ‘ownership’ has particular meaning in the law. The Civil Code defines ‘ownership’ as ‘the right of one or more persons to possess and use [a thing] to the exclusion of others.’ (Civ. Code, § 654.) Black’s Law Dictionary similarly defines an ‘owner’ as ‘[s]omeone who has the right to possess, use, and convey something; a person in whom one or more interests are vested.’ (Black’s Law Dict. (11th ed. 2019).)” (Garrabrants v. Erhart, supra, 98 Cal.App.5th at p. 508.) In the context of an instructional error claim, this court in Garrabrants rejected the proposition that an individual who stores his personal and confidential data with a third party has an ownership interest in that data for purposes of a private right of action under section 502. (Id. at p. 509.) There is no need to address the question, because we conclude Steuermann’s conduct on Reynolds or Atlas’s behalf did not subject defendants to liability under any of the relevant prohibited acts set forth in section 502, subdivision (c).
17
subd. (c)(13)). We limit our assessment of the evidence to those prohibited
acts involving data8 or computer services, i.e. e-mail services.
While the evidence shows Steuermann on Reynolds’s behalf accessed the GoDaddy account and could see Sillman’s e-mail addresses, there is no evidence—either direct or from which the jury could infer—that Steuermann saw their contents or used them so as to execute a “scheme . . . to defraud, deceive or extort” (§ 502, subd. (c)(1)(A)) or take control over or obtain the e- mails (§ 502, subd. (c)(1)(B)). (See People v. Tillotson (2007) 157 Cal.App.4th 517, 528 [third necessary element of section 502, subdivision (c)(1) is that the defendant have the specified purposes].) No such evidence exists as to Reynolds or Atlas. (Compare Mintz v. Mark Bartelstein and Associates Inc. (C.D. Cal. 2012) 906 F.Supp.2d 1017, 1032 [finding on summary judgment section 502, subdivision (c)(1) violation (knowingly and without permission using a computer to wrongfully obtain data) where company employee
8 “[T]he plain language of section 502 includes an extremely broad definition of ‘data.’ The statutory definition does not include any express requirements limiting the reach of the overall statute to non-public, confidential, or proprietary information; it does not limit data to information that is unique and possessed only by a single entity, but extends to information that is duplicative of that possessed by other entities; and it does not require that the entity whose computer is at issue have some legal ownership interest in the data itself. The breadth of this definition of data makes sense within the context of the overall statute: section 502 criminalizes a diverse range of conduct involving computer systems and data, prohibiting, among other things, altering, damaging, deleting, or destroying data without permission.” (Teran, supra, 112 Cal.App.5th at pp. 371, 380- 381, citing § 502, subd. (c)(1), (4).) In Teran, the court analyzed section 502, subdivision (c)(2), concerning the use of data without permission. (Id. at p. 374.) There, an individual shared information containing writ decisions arising out of civil service proceedings involving sheriff’s deputies. (Id. at p. 376.) The court held that the statute did not apply and criminal liability did not attach to the sharing of “purely public court records.” (Id. at p. 386.)
18
accessed plaintiff’s gmail account without permission and viewed the contents of several e-mails].)
Nor is there evidence Steuermann otherwise took, copied or “made use of” Sillman’s e-mail addresses (§ 502, subd. (c)(2), (3) [violation for knowingly and without permission “us[ing] or caus[ing] to be used computer services”]). “Principles of statutory interpretation obligate us to give different meanings to the words ‘use’ and ‘access’ in order to avoid rendering either word redundant.” (Chrisman v. City of Los Angeles, supra, 155 Cal.App.4th at p. 34.) The statute does not define the term “use” or “include any language to explain the permission necessary for a given use of data. But the requirement that an individual obtain permission for the use of data that resides on an entity’s computer can only be reasonably understood to apply to situations where the entity has some dominion over, or right to control, the uses made of that data.” (Teran, supra, 112 Cal.App.5th at p. 381.)
Here, the evidence and sole inference the jury could draw from it was that Sillman had lost access to his GoDaddy e-mail accounts for nonpayment a month before Steuermann accessed the account; thus, he had no “dominion over, or right to control, the uses made of that data” (Teran, supra, 112 Cal.App.5th at p. 381) even assuming Steuermann’s actions constituted use.
Subsection (c)(5) of the Act requires proof that defendants “knowingly and without permission . . . causes the disruption” or “denial” of computer services, but those services must be “to an authorized user of a computer, computer system, or computer network.” (§ 502, subd. (c)(5).) By the time Steuermann contacted GoDaddy in October 2021, Sillman was no longer an authorized user of any Atlas computer, nor was he even an authorized user of the data, having failed to pay GoDaddy to maintain the account and its e- mail addresses.
19
Subsection (c)(4) of section 502 makes it a violation to knowingly access and without permission “delete[ ] or destroy any data . . . which reside or exist internal or external to a computer, computer system or computer network.” Notably, this subsection does not use the phrases “assists in,” or “causes” as the Act does in its other subdivisions. (§ 502, subd. (c)(3) [“causes to be used computer services”], (5) [“causes the disruption”], (6) [“assists in providing a means of accessing”], (7) [“causes to be accessed”].) “When one part of a statute contains a term or provision, the omission of that term or provision from another part of the statute indicates the Legislature intended to convey a different meaning.” (Cornette v. Department of Transportation (2001) 26 Cal.4th 63, 73, 109; see People v. Childs, supra, 220 Cal.App.4th at p. 1102 [“When different words are used in adjoining subdivisions of a statute that were enacted at the same time, that fact raises a compelling inference that a different meaning was intended”]; accord, California Capital Ins. Co. v. Hoehn (2024) 17 Cal.5th 207, 221 [“ ‘ “In interpreting statutory language, a court must not ‘insert what has been omitted, or . . . omit what has been inserted’ ” ’ ”].) We must treat the omission as meaningful, requiring that to impose liability under subdivision (c)(4), the party must themselves directly destroy or delete the data, and not somehow facilitate or “cause” its deletion. Here, the record contains no evidence that Steuermann herself deleted or destroyed Sillman’s data.
Our conclusions are consistent with the Legislature’s intent in drafting section 502, which at bottom is to protect against “tampering, interference, damage, and unauthorized access to lawfully created computer data . . . .” (§ 502, subd. (a).) The protection is broad (see, e.g., People v. Hawkins, supra, 98 Cal.App.4th 1428, 1441 [“Subdivision (c)(3) [of section 502] is a broad prohibition against unauthorized use of a computer”]; People v. Lawton (1996)
20
48 Cal.App.4th Supp. 11, 15 [“Subdivision (c) of [section 502] is a laundry list of illegal activity ranging from use of a computer to defraud or extort, to infecting a computer with a virus”]) and not limited to just “browsers” and “hacking” (Mahru v. Superior Court (1987) 191 Cal.App.3d 545, 549 [rejecting idea that legislative declaration regarding the need to deter “unauthorized intrusions into computer systems” is conclusive of a “legislative intent to deter and punish only browsers and hackers”; concluding instead that the court “cannot be confident . . . that this brief declaration of purpose was intended to summarize every act covered by the statute”].) But “it is less than clear that the statute is meant to subject individuals or entities to liability who took no active role in tampering with, or in gaining unauthorized access to computer systems. Indeed, the relatively few cases interpreting the statute largely seek to impose liability against individuals or entities who are alleged to have actually participated in unauthorized ‘hacking’ or the unlawful disclosure of information.” (Claridge v. RockYou, Inc. (N.D.Cal. 2011) 785 F.Supp.2d 855, 863 [plaintiff could not allege liability against a defendant under section 502, subdivision (c)(6) on the theory it failed to provide a sufficiently secure system against third party hackers]; compare Galderma Laboratories, L.P. v. Revance Therapeutics, Inc. (C.D.Cal., Mar. 29, 2024, No. 2:23-CV-02879-FLA (SKX)) 2024 WL 3008860, at p. *6 [section 502 violation stated by allegations that former employee deleted information from his former employer’s laptop and accessed and took its data using that laptop after his employment had ended, and that new employer made false statements to the former company about it].)
We need not further analyze the various theories, because even if Sillman had presented evidence of a violation to support the jury’s verdict, we
21
conclude below that Sillman did not present evidence of damage or loss within the meaning of the Act. D. Economic Damages Award Section 502’s provision for a civil action extends to one who “suffers damage or loss by reason of a violation” of any of the Act’s subdivision (c) provisions. (§ 502, subd. (e)(1).) The Act does not define the terms damage or loss, but it specifies that the party “may bring a civil action against the violator for compensatory damages,” which “shall include any expenditure reasonably and necessarily incurred by the owner . . . to verify that . . . data was or was not altered, damaged, or deleted by the access.” (§ 502, subd.
(e)(1).)9 Here, the court instructed the jury on economic damages, and specifically that to recover damages for the “unique value of [his] GoDaddy.com, LLC e-mail account,” Sillman must prove: (1) the e-mail
9 The Act’s federal counterpart, the Computer Fraud and Abuse Act (CFAA), similarly provides a civil remedy for “[a]ny person who suffers damage or loss by reason of a violation of this section.” (18 U.S.C. § 1030(g); Ticketmaster L.L.C. v. Prestige Ent. W., Inc. (C.D.Cal. 2018) 315 F.Supp.3d 1147, 1174 [“The CDAFA is California’s state-law analogue to the CFAA”]).) Unlike California’s Act, the CFAA specifically defines the terms damage and loss: “Damage” is “any impairment to the integrity or availability of data, a program, a system, or information.” (18 U.S.C. § 1030(e)(8).) A “loss” is “any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service.” (18 U.S.C. § 1030(e)(11).) Additionally, the CFAA authorizes a civil action only if the conduct caused a “loss to one or more persons during any one-year period aggregating at least $5,000 in value.” (LVRC Holdings LLC v. Brekka (9th Cir. 2009) 581 F.3d 1127, 1132; 18 U.S.C. § 1030(c)(4)(A)(i)(I).) The Ninth Circuit has held that “any theory of loss must conform to the limited parameters of the CFAA’s definition” such that “ ‘revenue lost,’ . . . refers only to losses that occurred ‘because of interruption of service.’ ” (Andrews v. Sirius XM Radio Inc. (9th Cir. 2019) 932 F.3d 1253, 1263.)
22
account had some market value; (2) the e-mail account had unique value to him; and (3) Atlas’ or Reynolds’s “conduct was intentional and wrongful.” It instructed: “No fixed standard exists for deciding the amount of this value. You must use your judgment to decide a reasonable amount based on the
evidence and your common sense.”10 “ ‘ “Damages” are monetary compensation for loss or harm suffered by a person, or certain to be suffered in the future, as the result of the unlawful act or omission of another.’ ” (DeLisi v. Lam (2019) 39 Cal.App.5th 663, 681, quoting Civ. Code, §§ 3281-3283.) “Compensatory damages ‘are intended to redress the concrete loss that the plaintiff has suffered by reason of the defendant’s wrongful conduct.’ ” (Los Angeles Unified School Dist. v. Superior Court (2021) 64 Cal.App.5th 549, 555.) Compensatory damages are synonymous with actual damages. (DeLisi, at p. 681.) “ ‘ “Actual” is defined as “existing in fact or reality,” as contrasted with “potential” or “hypothetical,” and as distinguished from “apparent” or “nominal.” (Webster’s Third New Internat. Dict. (1964) p. 22.) It follows that “actual damages” are those which compensate someone for the harm from which he or she has been proven to currently suffer or from which the evidence shows he or she is certain to suffer in the future. They are to be distinguished from those which are nominal rather than substantial, exemplary or punitive rather than compensatory, and speculative rather than existing or certain.’ ” (DeLisi, at p. 681.)
The jury was asked to award a damages amount based on the e-mails’
unique or peculiar value to Sillman. “Where certain property has a peculiar value to a person recovering damages for deprivation thereof, or injury
10 Noneconomic damages, on the other hand, “compensate an injured plaintiff for nonpecuniary injuries” including emotional distress. (Burchell v. Faculty Physicians & Surgeons etc. (2020) 54 Cal.App.5th 515, 526.)
23
thereto, that may be deemed to be its value against one who had notice thereof before incurring a liability to damages in respect thereof, or against a willful wrongdoer.” (Civ. Code, § 3355.) But that provision refers to “unique economic value, not its sentimental or emotional value.” (McMahon v. Craig, supra, 176 Cal.App.4th at p. 1518, italics added.) “Compensatory damages are not given for emotional distress caused merely by the loss of . . . things . . . .” (Id. at p. 237, quoting Rest.2nd Torts, § 911.) Here, there is no evidence from which the jury could reach a reasonably certain, unspeculative, amount of damage suffered by Sillman for the loss of his e-mail data. (Piscitelli v. Friedenberg (2001) 87 Cal.App.4th 953, 989 [“Whatever its measure in a given case, it is fundamental that ‘damages which are speculative, remote, imaginary, contingent, or merely possible cannot serve as a legal basis for recovery’ ”].) Sillman’s testimony was that there were about 20,000 important e-mails in his GoDaddy e-mail accounts, but he did not attempt to place a monetary value on them. Their sentimental value was not relevant to the compensatory economic damages analysis.
II. Attorney Fees
Following entry of judgment, both Sillman and Steuermann sought awards of attorney fees as prevailing parties under section 502, which provides simply that “[i]n any action brought pursuant to this subdivision the court may award reasonable attorney’s fees.” (§ 502, subd. (e)(2).) Sillman sought to recover $375,231 in attorney fees and $36,205.62 in costs under not only section 502, but also Code of Civil Procedure section 1021.5, arguing the award would result in the enforcement of an important right affecting the public interest and conferring a significant benefit on the general public.
Steuermann sought an award of $129,956 in attorney fees and $5,000 in costs under section 502. She pointed out that Sillman only added the
24
claim against her in a supplemental complaint and presented no evidence to support his argument that she acted outside the course and scope of her employment. She pointed to the jury’s unanimous verdict in her favor, as well as the fact Sillman elected to reject a pretrial settlement offer she had made. Steuermann argued section 502 broadly authorized the court to award reasonable attorney fees, stating “[n]othing about the plain language of section [502, subdivision] (e)(2) or its discernable legislative history supports denying fees . . . .”
Sillman opposed Steuermann’s motion on grounds the Legislature in 2000 amended section 502 to limit an award of attorney fees to a prevailing plaintiff. He pointed out that federal district courts had reached this conclusion. Sillman further argued that even if Steuermann were entitled to an attorney fee award, her claim was not substantiated by billing statements or detailed records.
The trial court awarded Sillman $93,808 in reasonable attorney fees, and denied him costs. It denied Steuermann attorney fees. The court pointed to federal district case law holding the Legislature sought to limit section 502 attorney fee awards to prevailing plaintiffs, but noted contrary authority in an unpublished California Court of Appeal decision. The court quoted from Physician’s Surrogacy, Inc. v. German (S.D.Cal. 2018) 311 F.Supp.3d 1190: “ ‘If recovery of attorney’s fees is limited to prevailing plaintiffs under . . . [section] 502[, subdivision] (e), defendants are not permitted to recover their attorneys’ fees as defendants . . . . If the decision to award fees remains within the trial court’s discretion, the court finds it would be unreasonable to award fees because the court did not determine that plaintiff’s section 502 claim was either frivolous or abusive . . . . Accordingly, the court declines to award defendants attorneys’ fees under
25
section 502[, subdivision ](e).’ ” The trial court ruled Steuermann “is not entitled to an award of statutory attorney fees as a prevailing party. Further, the court finds that [Sillman’s] claim against [Steuermann] was not frivolous or abusive.” A. Award of Attorney Fees to Sillman Against Reynolds and Atlas Given we have reversed the judgment on Sillman’s section 502 claim, we reverse the award of attorney fees to Sillman. An order awarding attorney fees “ ‘falls with a reversal of the judgment on which it is based.’ ” (Gunther v. Alaska Airlines, Inc. (2021) 72 Cal.App.5th 334, 358.) B. Denial of Attorney Fees to Steuermann Steuermann contends section 502’s plain language—“[i]n any action brought pursuant to this subdivision the court may award reasonable attorney’s fees”—allows for a discretionary award of attorney fees to a prevailing defendant without any condition. She argues the statute requires only that Sillman’s action be brought pursuant to section 502, subdivision (e), and because that was Sillman’s sole cause of action against her, the trial court should have exercised its broad discretion in deciding whether to award her attorney fees without having to first find Sillman’s action was frivolous or abusive. Steuermann says the statute’s legislative history does not support any contrary intent, and she asks us to reject the holdings of federal district courts concluding otherwise. Steuermann argues the court prejudicially erred by conditioning its consideration of section 502 attorney fees on whether Sillman’s claim was frivolous or abusive, as the Legislature has not imposed any such restriction.
26
After Steuermann submitted her brief on the attorney fees appeal,11 another panel of this court resolved these issues in Hay v. Marinkovich, supra, 108 Cal.App.5th 707. Holding section 502’s language was clear and unambiguous, this court concluded based on the statutory text alone a court may award any party—including a prevailing defendant—section 502 attorney fees. (Hay, at pp. 719-720.) “The fact that the statute may be broad does not make it ambiguous.” (Id. at p. 720.) Hay went on to disagree with federal district courts holding that the legislative history indicated any intent to allow only fee awards to prevailing plaintiffs. (Id. at pp. 720-722.)
This court also addressed the standard that applies to a prevailing defendant’s request for fees under section 502. (Hay v. Marinkovich, supra, 108 Cal.App.5th at p. 722.) We analyzed the issue by applying the framing of Travis v. Brand (2023) 14 Cal.5th 411, which looked at other statutory contexts and addressed “whether a trial court’s discretion to award fees to a prevailing defendant is coextensive with its discretion to award fees to a prevailing plaintiff” where “[t]he text of the statute does not specify the standard that should govern an award of fees to either prevailing party.” (Travis, at p. 414; see Hay, at p. 723.) We held based on section 502’s goals and objectives (Hay, at pp. 725-726) that an “asymmetrical standard” applied: section 502 defendants may only recover attorney fees where the plaintiff’s claim was objectively without foundation when brought, or the plaintiff continued to litigate after it clearly became so. (Hay, at pp. 713, 726-727.) “A contrary rule would chill private enforcement of the statute and thus undermine its purpose.” (Id. at p. 727.)
11 As in the consolidated appeal, Sillman has not provided a respondent’s brief.
27
This court in Hay went on to conclude that the trial court’s decision in that case—that the plaintiff’s case was not “frivolous”—was not an abuse of discretion. (Hay v. Marinkovich, supra, 108 Cal.App.5th at p. 728.) Examining the trial evidence, we explained the plaintiff’s claim “had ‘some basis in fact.’ ” (Id. at pp. 728-729.) Further, the jury’s special verdict showed the plaintiff’s claim was not objectively without foundation. (Id. at p. 729.) This court reasoned: “ ‘[T]he jury found in Plaintiff’s favor on some of the . . . section 502 claim questions on the special verdict, as well as on the other causes of action.’ Although the jury found [the defendant] had permission to copy and access the data, polling revealed that this finding was not unanimous—three of the 12 jurors believed [he] acted without permission. The jury also found, seemingly inconsistently, that [the defendant] lacked justification to intrude on [the plaintiff’s] expectation of privacy. The lack of unanimity on the permission question under the section 502 claim, along with the jury’s finding under the invasion of privacy claim that [the defendant] invaded [the plaintiff’s] privacy without justification, further demonstrates that [the plaintiff’s] claim was not objectively without foundation. ‘Instead, the case at bar appears to be a routine case in which the plaintiff merely failed to achieve success on her claim.’ ” (Ibid.)
We acknowledge that here, the trial court ruled Sillman’s section 502 claim against Steuermann was not frivolous or abusive. However, the court did not have the benefit of our reasoning in Hay v. Marinkovich, supra, 108 Cal.App.5th 707, and its conclusion that a prevailing defendant seeking attorney fees under section 502 must demonstrate that a plaintiff’s action was either “objectively without foundation when brought, or the plaintiff continued to litigate after it clearly became so.” (Id. at p. 713, see also id. at pp. 726-727, 728.) We leave it to the trial court in the first instance to make
28
that determination applying the standards expressed in Hay, including by allowing the parties to address the matter anew and/or by reconsidering Steuermann’s motion for attorney fees.
DISPOSITION
The judgment against Reynolds and Atlas is reversed, as is the postjudgment order awarding Penal Code section 502 attorney fees to Sillman against those defendants. The postjudgment order denying attorney fees to Steuermann is reversed and the matter remanded for the trial court to decide whether Steuermann is entitled to attorney fees, including attorney fees on appeal, under the standards expressed in Hay v. Marinkovich, supra, 108 Cal.App.5th 707. Atlas Storage, LLC and M. Kathryn Newnham as personal representative of the estate of Dixie J. Reynolds shall recover their costs on appeal.
O’ROURKE, Acting P. J.
WE CONCUR:
DO, J.
KELETY, J.