The Supreme Court recently ruled on the case of an employee who deleted a large quantity of data from the hard disk of his employer's computer and removed the back-up CD-ROMs. The court considered the criteria for the crime of malicious damage to a computer system; its findings have significant implications for employers.
The provision at issue was Article 635(2) of the Criminal Code, which relates to the total or partial destruction, dispersal, deterioration or putting beyond use of things belonging to others.
At first instance the employee was found guilty of a criminal offence under Article 635(2). He was found to have deleted a file containing a large amount of data from a company computer. Even after extensive data restoration operations, the data proved to be only partly recoverable.
In a subsequent trial the Supreme Court found the employee guilty on the original charges.(1) In defining 'damage' under Article 635(2), the court held that damage may be said to occur where a computer system or computer data is altered, but can be restored or recovered through technical operations. The loss need not be irrecoverable; it is sufficient for the recovery of lost data to be expensive or time consuming. In this case, some of the data recovered by the employer nevertheless remained impossible to access.
From an employment law perspective, the Supreme Court decision demonstrates the recourse available to an employer if employees inflict damage on company IT systems or wrongfully delete information from company computers. In such circumstances the employer may react by taking action on a civil or criminal law basis.
The case also reminds employers of the importance of creating a company policy on the use of IT systems. The existence of such a policy - and its effective communication to all relevant employees - will be significant in any case of wrongdoing or misuse in connection with an employer's IT systems.
Moreover, the decision confirms the overall framework of safeguards for a company's IT assets in respect of illicit conduct by employees, reflecting the development of such systems at EU level.(2)
For further information on this topic please contact Andrea Stanchi at Stanchi Studio Legale by telephone (+39 02 546 9522), fax (+39 02 551 91641) or email ([email protected]).
Endnotes