Filed 9/4/26 Sillman v. Newnham CA4/1
NOT TO BE PUBLISHED IN OFFICIAL REPORTS
California Rules of Court, rule 8.1115(a), prohibits courts and parties from citing or relying on opinions not certified for
publication or ordered published, except as specified by rule 8.1115(b). This opinion has not been certified for publication
or ordered published for purposes of rule 8.1115.
COURT OF APPEAL, FOURTH APPELLATE DISTRICT
DIVISION ONE
STATE OF CALIFORNIA
STEVEN SILLMAN, D083732, D084394
Plaintiff and Respondent,
v. (Super. Ct. No.
37-2021-00021625-CU-BT-CTL)
M. KATHRYN NEWNHAM, as
Personal Representative, etc., et al.,
Appellants.
CONSOLIDATED APPEALS from a judgment and postjudgment
orders of the Superior Court of San Diego County, Joel R. Wohlfeil, Judge.
Judgment reversed in part; postjudgment orders reversed and remanded with
directions.
Niddrie Addams Fuller Singh and John S. Addams; Pinnacle Legal and
Vincent Renda; Law Office of John A. Simpson and John A. Simpson, for
Appellants Atlas Storage, LLC and M. Kathryn Newnham, as personal
representative of the estate of Defendant Dixie J. Reynolds.
Niddrie Addams Fuller Singh and John S. Addams; Law Office of R.
Anthony Mahavier and R. Anthony Mahavier, for Defendant and Appellant,
Evelyn Steuermann.
No appearance for Plaintiff and Respondent.
Appellants M. Kathryn Newnham, as personal representative of the
estate of Dixie J. Reynolds, and Atlas Storage, LLC (Atlas) appeal a judgment
following a special jury verdict on plaintiff and respondent Steven Sillman’s
claim that Atlas and Reynolds violated Penal Code section 5021 of
California’s Comprehensive Computer Data Access and Fraud Act (CDAFA or
the Act). The jury found Atlas and Reynolds had knowingly accessed
Sillman’s e-mail account without his permission, awarding Sillman $1 in
damages against Reynolds and $40,000 against Atlas. While the jury found
Atlas’s bookkeeper and comptroller, appellant Evelyn Steuermann, had also
accessed Sillman’s e-mail account, it further found she did so while acting
within the scope of her employment. Because the Act creates an exception for
persons acting within the scope of employment (§ 502, subd. (h)(1)), the court
entered judgment in Steuermann’s favor. The court later awarded Sillman
$93,808 in attorney fees under the Act, but denied Steuermann attorney fees,
finding Sillman’s claim against her was not frivolous or abusive.
Newnham and Atlas contend the Act does not apply because
defendants did not “knowingly access” or “use” the e-mail account within the
meaning of the Act, and Sillman was not the sole owner of the account. They
1 Undesignated statutory references are to the Penal Code. While these
appeals were pending, Reynolds’s counsel notified us that Dixie J. Reynolds
had passed away. Counsel has since substituted M. Kathryn Newnham, the
personal representative of Reynolds’s estate, as the appellant. At times, we
refer to Reynolds and Atlas collectively as defendants.
2
argue Sillman’s remedy was to sue for negligence or claim his e-mails’
destruction supported his complaint’s other claim of an ownership interest in
Atlas, his former employer. Newnham and Atlas further contend Sillman
failed to prove the market value of his e-mails, thus the jury’s damages
awards are unsupported by substantial evidence.
Newnham and Atlas also appeal from the court’s postjudgment order
awarding Sillman $98,808 in attorney fees under the Act. Their sole
argument is if we reverse the judgment, we must reverse the attorney fee
award as well. Steuermann appeals the order denying her attorney fees,
contending the court abused its discretion by conditioning the award on a
finding of whether Sillman’s claim was frivolous or abusive. She asks us to
reverse the order and direct the court to reconsider her attorney fees motion,
exercising its broad discretion to award a prevailing defendant fees “under
the plain language of [section 502] with no conditions.”2
We agree Sillman did not prove Reynolds or Atlas violated section 502,
and that the jury’s damages award—based solely on the section 502 claim—is
unsupported by the evidence. Accordingly, we reverse the judgment against
them as well as the court’s attorney fees award to Sillman, which falls with
the reversal. As for the issues raised by Steuermann’s attorney fee appeal,
we resolved them in Hay v. Marinkovich (2025) 108 Cal.App.5th 707, which
held a prevailing defendant on a section 502 claim is entitled to attorney fees
under that statute, but only if he or she demonstrates the plaintiff’s claim
was objectively without foundation when brought, or the plaintiff continued
2 Sillman also filed an appeal but this court dismissed it after he failed to
file an opening brief. Sillman has not filed a respondent’s brief. We do not
treat that failure as a default or admission of error, but independently
examine the record and reverse only if we find prejudicial error. (Kennedy v.
Eldridge (2011) 201 Cal.App.4th 1197, 1203; see In re Bryce C. (1995) 12
Cal.4th 226, 233.)
3
to litigate after it clearly became so. (Id. at p. 713.) We reverse the order
denying Steuermann attorney fees and direct the trial court on remand to
address her request for attorney fees under those standards.
FACTUAL AND PROCEDURAL BACKGROUND
Sillman, Reynolds’s son-in-law, was hired as an Atlas employee by
Reynolds’s husband. As of 2018, Sillman helped run various Atlas entities
and properties with Steuermann. After her husband’s death, Reynolds
became part of Atlas’s daily operation and hired a management company for
it. Reynolds fired Sillman in 2021.
In May 2021, Sillman sued Reynolds, Atlas and related entities, in part
alleging that in 2015, he and Reynolds’s husband orally agreed he would be
provided a specified ownership interest in Atlas.
In October 2021, Steuermann contacted representatives at
GoDaddy.com (GoDaddy) because Reynolds’s e-mail address, which she used
for both business and personal purposes, had stopped working. Steuermann
told the representative that she was just trying to recover that one e-mail
address. The GoDaddy representative instructed Steuermann to provide
documentation at a secure site to prove Reynolds’s identification, and after
Steuermann did so, the GoDaddy representative told her the account had
been suspended for nonpayment. Steuermann looked at Atlas’ credit card
statements and discovered that Atlas had been paying for the account, which
stopped working in May 2021 because Sillman’s company credit card,
eliminated after his termination, had been declined. GoDaddy then assisted
Steuermann in getting the credit card working again, including by resetting
the password so that she could change it. In doing so, Steuermann saw there
were other e-mail addresses unaffiliated with Atlas in the account, and
became concerned that Sillman could see Reynolds’s e-mails. Steuermann
4
moved Reynolds’s e-mails to a separate GoDaddy account. She could see the
rest of the accounts, but did not know what happened with them.
Steuermann changed the log-in information and password to protect
Reynolds’s e-mails. She did not delete anything.
Sillman eventually filed supplemental pleadings adding Steuermann as
a party and including a cause of action for a violation of section 502. In that
cause of action, Sillman alleged he was the owner of a GoDaddy internet
service provider account (hereafter the account or the GoDaddy account)
containing e-mail accounts, websites, domains and electronically stored
information. He alleged that Atlas, Reynolds and Steuermann knowingly
accessed that account without his permission.3 According to Sillman, they
then changed its ownership from him to Reynolds; reset his password to
prevent him from accessing the account; changed the names of certain of his
e-mail accounts; and used, read, downloaded, took, lost and/or destroyed
thousands of his private and privileged e-mails, documents, communications
and electronically stored information. He sought injunctive relief, statutory
treble damages, interest, as well as attorney fees and costs.
The matter proceeded to a jury trial. At trial, Sillman’s counsel read
from Steuermann’s recorded interactions with GoDaddy representatives.
One GoDaddy representative sent Steuermann an e-mail with a customer
number and a password reset. Steuermann responded by telling the
representative, “Now I really want to . . . recover one e-mail out of there. The
rest of the account, I don’t need any of the e-mails that are on there.”
Steuermann asked the representative to identify the other e-mails, and he
did, telling her that some were Microsoft e-mails and listing them. The
3 The supplemental complaint alleges that the access occurred in October
2022, but Steuermann testified she contacted GoDaddy in October 2021.
5
GoDaddy representative explained that he had to set up a workspace five-e-
mail plan, even though Steuermann only wanted to restore one e-mail. In
response to Steuermann’s questions, he said the e-mails had officially left the
account on October 17, 2021, which meant they had expired in late
September 2021. Steuermann and the representative went over some of
Sillman’s e-mail domains, with the representative explaining that some of
them had already been moved to Microsoft and others the representative had
moved over. In the process, Steuermann said, “So the—[¶] . . . [¶] . . . only
one that needs to be in this is just [Reynolds’s e-mail address] . . . [¶] . . . [¶]
. . . “I just wanted—I’m not really clear on how all of this is set up and
works.” She also said, “So under this account, now it still has all of those
either [sic] e-mails, but they really aren’t active, correct?” The GoDaddy
representative responded, “Correct. Yeah.”
Later, Steuermann called back frustrated that she had not been able to
get the new e-mail account to work. The GoDaddy representative explained
that “when things go past due, sometimes . . . the stuff will get stuck in the
server . . . .” He asked whether she was going to keep the e-mail in the
workspace e-mail server or move it to Microsoft. Steuermann responded:
“Well, you know, here’s the thing. This account was set up by an ex-
employee. He’s got all kinds of domains in there, and we really just want this
one. I want to get rid of everything else because it’s not affiliated with the
company.” The representative instructed Steuermann to open another
account by clicking on a domain transfer button, and said: “Then what we
would do as far as the e-mail, is it would cancel the e-mail, it would cancel
the e-mail renewal from the other day, and we’d rebuy the e-mail plan in the
other account, and we’d have a little system move-over that we would do. It
6
shouldn’t take more than, like, [10] or 15 minutes to get everything
organized.”
Steuermann then activated the new account, but saw the other e-mail
domains. She asked what was going to happen with the other account. The
representative told her: “The other account will just stay with all those other
products in there, but the card that you used yesterday is no longer going to
be in there. So I would tell whoever that employee is, if you still have contact
with them at least, tell them that . . . they would want to go through and
update that account to being underneath his or her own name and then
update . . . the payment method (indiscernible) stuff. Otherwise, like, these
things are all going to basically not be able to be renewed.”
Steuermann testified that she did not tell Sillman she would be
contacting GoDaddy or get his permission to do so. After speaking with the
GoDaddy representative, she did not notify anyone they would need to renew
their GoDaddy e-mail accounts or they would no longer be renewable.
Specifically, she did not tell Sillman that she had contacted GoDaddy. She
did not know if any of Sillman’s GoDaddy accounts were reinstated. On cross
examination, Steuermann testified that her sole intent was to restore
Reynolds’s e-mail, and nothing else. By the time she communicated with
GoDaddy, Sillman had already sued the company, which had an impact on
whether she could contact him and tell him what had transpired.
Sillman testified that he used his personal credit card when he set up
Reynolds’s GoDaddy e-mail account, and that was his practice when paying
for those accounts. He never gave Steuermann permission in October 2021 to
contact GoDaddy and have his account deleted; he found out that
Steuermann had contacted GoDaddy when all of his e-mails went missing.
Sillman had his accounts restored, but not the e-mails. When asked what
7
kind of information was within them, he stated: “A lot of personal stuff that
was irreplaceable, letters from—e-mails from my dad who passed, both
grandfathers. I coached my kids’ soccer, so we had like, you know, that kind
of stuff, the—just more personal-type stuff, and a lot of business stuff. It was
over a 15-year time frame. . . . Something like that. [¶] . . . So it was all the
tax stuff. All the business agreements, and that includes with clients.
There’s a lot of stuff there. Just stuff you can’t replace. A lot of stuff in this
case. We don’t know what we’re missing here.” Sillman estimated the
number of important e-mails on the GoDaddy servers to be “maybe 20,000 or
so.” He stated generally that the attachments to them included “[a] lot of
photos” and “[a] lot of kid stuff that you can’t replace.” Sillman did not
produce a GoDaddy employee, technology expert or computer expert for trial.
In closing arguments, Sillman’s counsel explained that Sillman paid for
and created the GoDaddy accounts and put Reynolds’s and her husband’s
personal e-mail accounts under that umbrella, but defendants directed
Steuermann to move Reynolds’s account out and delete Sillman’s e-mails
because they were afraid Sillman would find information helpful to his legal
case against them. Counsel asserted that Steuermann authorized GoDaddy
“over and over again . . . to delete the other accounts.” He pointed out that
Steuermann did not contact Sillman about his e-mail accounts because they
“didn’t want him to know” but rather “wanted these accounts to become
permanently deleted . . . .” Counsel argued: “And they did it with total
disregard for the value of his account. He said he had 20,000 e-mails on
there. He had photographs of his children and his relatives that he’ll never
get back. He had banking information and company information, basically
his whole life on those accounts and they—like going into a house and
8
burning it down to hide the evidence, did the exact same thing.” Counsel told
the jury they would “be asked to come up with a value for those e-mails.”
Reynolds’s counsel argued that the entire phone call with GoDaddy
happened only because Reynolds’s e-mail did not work, so not knowing who to
call, she asked Steuermann to handle it. Counsel stated that Reynolds did
not tell Steuermann to also “dump all [Sillman’s] e-mails.” He pointed out
that someone had already transferred some of the e-mail accounts to
Microsoft and that it was probably Sillman, but that Sillman had not
mentioned or recalled any e-mails supporting his claim of an ownership
interest in Atlas. Steuermann’s counsel argued that GoDaddy deleted
Sillman’s data, not Steuermann, and that the evidence was that Steuermann
was not looking for Sillman’s account, only Reynolds’s e-mail and nothing
else.
On the section 502 claim, the trial court instructed the jury that
Sillman had to prove: (1) he is the owner of the GoDaddy.com, LLC Internet
Service Provider account; (2) defendants knowingly accessed his account; (3)
defendants’ use of the account was without his permission; (4) he was
harmed; and (5) defendants’ conduct was a substantial factor in causing his
harm.
The jury found Sillman was the owner of the GoDaddy account, and
that Reynolds and Atlas knowingly accessed that account without Sillman’s
permission.4 It found that as a result of those actions, Sillman sustained $1
in damages from Reynolds, $20,000 from Atlas in past economic loss, and
4 The jury found that Steuermann accessed Sillman’s e-mail account but
did so while acting in the scope of her employment. The court thus entered
judgment in Steuermann’s favor under the exception contained in section
502, subdivision (h)(1). (See People v. Childs (2013) 220 Cal.App.4th 1079,
1100.)
9
$20,000 from Atlas in future economic loss. The jury rejected Sillman’s
claims pertaining to any ownership interest in Atlas. The court entered
judgment accordingly.
Reynolds and Atlas then moved for judgment notwithstanding the
verdict as to the section 502 claim on grounds Sillman had not presented
evidence that any of his e-mails or the deleted data had market value. They
asked the court to strike the damages award. Reynolds and Atlas argued in
the alternative that Sillman had not produced evidence of intentional or
malicious conduct. They pointed out that in all the evidence from
Steuermann herself or the calls to GoDaddy representatives, Steuermann
never directed GoDaddy to delete anything and GoDaddy did not state it
intended to do so. They argued Sillman “never introduced evidence,
documentary or otherwise, to show when the [GoDaddy] accounts were
deleted or by whom, much less how any defendant caused that deletion,
intentionally, willfully, or even inadvertently.” The trial court denied the
motion, finding “a rational foundation in the evidence to support the jury
verdict.”
DISCUSSION
I. Appeal of Judgment Against Reynolds and Atlas for Violating Section 502
A. The Act
The Act “is essentially an anti-computer hacking statute that was
enacted to prohibit the unauthorized use of any computer system for an
improper purpose.” (Hay v. Marinkovich, supra, 108 Cal.App.5th at p. 717;
see Chrisman v. City of Los Angeles (2007) 155 Cal.App.4th 29, 34 [“Section
502 defines ‘access’ in terms redolent of ‘hacking’ or breaking into a
computer”]; People v. Gentry (1991) 234 Cal.App.3d 131, 141, fn. 8 [discussing
legislative purposes of section 502].) “Section 502 was first created in 1979
10
because ‘no statute specifically proscribes fraud committed by means of
computer, or prohibits the alteration or destruction of computers or computer
programs.’ [Citation.] There was concern that ‘[s]abotage of a computer
could seriously disrupt business or government operations.’ [Citation.] The
stated goal of this new legislation was to tackle computer ‘misuse,’ like the
‘manipulation resulting in the payment of money not owed’ or the
‘concealment of embezzlement.’ [Citation.] When the original statute was
repealed and replaced in 1987, that concern remained at the forefront. The
law was changed in order ‘to provide for increased penalties for computer
“hackers” and to provide standardized definitions of terms.’ ” (Teran v.
Superior Court (2025) 112 Cal.App.5th 371, 381-382 (Teran).)5
The Act subjects a party to criminal liability for various actions, many
of which require the person “knowingly access” computers or data without
permission. (§ 502, subd. (c)(1), (2), (4), (5), (7), (11).) A person is liable if he
or she “[k]nowingly accesses and without permission alters, damages, deletes,
destroys, or otherwise uses any data . . . in order to either (A) devise or
5 In 1987, lawmakers added a statement of legislative intent (Teran,
supra, 112 Cal.App.5th at p. 382): “It is the intent of the Legislature in
enacting this section to expand the degree of protection afforded to
individuals, businesses, and governmental agencies from tampering,
interference, damage, and unauthorized access to lawfully created computer
data and computer systems. The Legislature finds and declares that the
proliferation of computer technology has resulted in a concomitant
proliferation of computer crime and other forms of unauthorized access to
computers, computer systems, and computer data. [¶] The Legislature
further finds and declares that protection of the integrity of all types and
forms of lawfully created computers, computer systems, and computer data is
vital to the protection of the privacy of individuals as well as to the well-being
of financial institutions, business concerns, governmental agencies, and
others within this state that lawfully utilize those computers, computer
systems, and data.” (See also People v. Childs, supra, 229 Cal.App.4th at pp.
1099-1100.)
11
execute any scheme or artifice to defraud, deceive, or extort, or (B) wrongfully
control or obtain money, property, or data.” (§ 502, subd. (c)(1).) A person is
liable if he or she “[k]nowingly accesses and without permission takes, copies,
or makes use of any data from a computer, computer system, or computer
network, or takes or copies any supporting documentation, whether existing
or residing internal or external to a computer, computer system, or computer
network.” (§ 502, subd. (c)(2).) Liability attaches to one who “knowingly and
without permission uses or causes to be used computer services” (§ 502, subd.
(c)(3)), which the Act defines as including “electronic mail services.” (§ 502,
subd. (b)(4).) It also attaches to a person who “[k]nowingly and without
permission disrupts or causes the disruption of computer services or causes
the denial of computer services to an authorized user of a computer, computer
system or computer network.” (§ 502, subd. (c)(5).) The Act imposes liability
on a person who “[k]nowingly accesses and without permission . . . deletes[ ]
or destroys any data . . . which reside or exist internal or external to a
computer, computer system, or computer network.” (§ 502, subd. (c)(4).)6
“ ‘Access’ means to gain entry to, instruct, cause input to, cause output from,
cause data processing with, or communicate with, the logical, arithmetical, or
memory function resources of a computer, computer system, or computer
network.” (§ 502, subd. (b)(1).) “ ‘Data’ means a representation of
information, knowledge, facts, concepts, computer software, or computer
6 The Act sets out fourteen categories of activity that constitute an
offense. (§ 502, subd. (c)(1)-(14); see People v. Hawkins (2002) 98 Cal.App.4th
1428, 1440 [“the statute describes a number of computer crimes in somewhat
overlapping language”].) Sillman’s complaint did not specify which sections
defendants assertedly violated. Some categories involve government
computers or public safety infrastructure (§ 502, subd. (c)(10)-(12), (14)) or
knowingly introducing a computer “contaminant” (§ 502, subd. (8)). Those
provisions are inapplicable to these facts.
12
programs or instructions. Data may be in any form, in storage media, or as
stored in the memory of the computer or in transit or presented on a display
device.” (§ 502, subd. (b)(8).)
The Act “authorizes ‘the owner or lessee of the . . . data who suffers
damage or loss by reason of a violation of [the statute]’ to bring a civil suit.”
(Garrabrants v. Erhart (2023) 98 Cal.App.5th 486, 507; § 502, subd. (e)(1); see
also Erhart v. Bofl Holding, Inc. (2019) 387 F.Supp.3d 1046, 1057 [the Act
“grants a private right of action for compensatory damages and other relief to
‘the owner . . . of the computer . . . or data who suffers damages or loss by
reason of a violation’ ”]; see also NovelPoster v. Javitch Canfield Group
(N.D.Cal. 2014) 140 F.Supp.3d 954, 964.) Under the statute, that owner
“may bring a civil action against the violator for compensatory damages and
injunctive or other equitable relief. Compensatory damages shall include any
expenditure reasonably and necessarily incurred by the owner . . . to verify
that a computer system . . . or data was or was not altered, damaged, or
deleted by the access.” (§ 502, subd. (e)(1).)
B. Contentions and Standard of Review
Appellants contend section 502 does not apply to Sillman’s claims.
Relying on Sunbelt Rentals, Inc. v. Victor (N.D.Cal. 2014) 43 F.Supp.3d 1026
and Chrisman v. City of Los Angeles, supra, 155 Cal.App.4th 29, they argue
Reynolds and Atlas did not “knowingly access” the GoDaddy account within
the Act’s meaning of that phrase, stating “[t]his was not a case of ‘hacking’ or
even akin to hacking, for an improper or illegitimate purpose.” Comparing
the facts to those in Sunbelt Rentals, they argue Reynolds and Atlas “did not
circumvent barriers intended to protect access to the GoDaddy account” but
instead, “Steuermann contacted GoDaddy, explained the circumstances,
provided the requested documentation, and only after GoDaddy verified it,
13
was given access to the account.” As part of this contention, Newnham and
Atlas argue that Sillman did not present evidence he was the sole owner of
the GoDaddy account. They argue that because Reynolds and Atlas had
“some level of ownership rights to the account, Sillman could not claim a
section 502 violation as a matter of law.”
Appellants further contend Reynolds and Atlas did not “use” the
account within the Act’s meaning in that there was “no evidence that they
took, looked at, or used the other e-mails in the account.” They argue that to
the extent “use” includes deletion of data, Reynolds and Atlas did not delete
Sillman’s e-mails, rather, GoDaddy did because Sillman failed to update the
account’s payment information after he left Atlas. According to appellants,
the transcripts of Steuermann’s interactions with GoDaddy reflect that all
Sillman had to do was contact GoDaddy to place the account under his name
and update the payment information.
Finally, appellants argue that even assuming the Act applies, the
judgment must be reversed for the absence of evidence of the market value of
Sillman’s deleted e-mails. They argue that “Sillman may have offered
sufficient evidence to show a sentimental value on the deleted e-mails, [but]
he did not offer substantial evidence establishing that it had a ‘market
value,’ ” meaning “what a buyer would pay for the e-mails or the data they
contained.” They rely on authority applying the definition to the theft of
electronic data such as stolen access card information (People v. Liu (2019) 8
Cal.5th 253, 257), browsing history (Brown v. Google LLC (N.D.Cal. 2023)
685 F.Supp.3d 909, 940) and misappropriated data (Marshall &
Swift/Boeckh, LLC v. URS Corporation (C.D.Cal., Feb. 22, 2012, No. CV 08-
04375) 2012 WL 12964282, at p. *2). Appellants argue that personal value is
14
irrelevant to market value, citing Civil Code section 3355’s definition of
peculiar value and McMahon v. Craig (2009) 176 Cal.App.4th 1502.
Here, the jury made factual findings in Sillman’s favor in its special
verdicts, including as to damages. In that instance, we apply the substantial
evidence standard of review to decide whether the evidence supports the
jury’s verdict. (See, People v. Gentry, supra, 234 Cal.App.3d at p. 140; see
generally Conservatorship of O.B. (2020) 9 Cal.5th 989, 1005-1006; Padideh
v. Moradi (2023) 89 Cal.App.5th 418, 438 [when a jury decides the facts and
the ensuing appeal raises the sufficiency of the evidence to support the jury’s
verdict, we would apply substantial evidence review on appeal].) Where
defendants’ claims rest on the meaning of the Act, we exercise de novo
review. (Accord, Teran, supra, 112 Cal.App.5th at p. 378.) “Our fundamental
task in interpreting a statute is to determine and effectuate the intended
purpose of the Legislature. [Citation.] To do that, we first look to the
statutory language, which usually provides the best indicator of the statute’s
purpose. [Citation.] If it is unambiguous, then its plain meaning controls,
and that is the end of the analysis. [Citation.] If, however, the language is
ambiguous, then we look to extrinsic aids, including the legislative history.”
(Hay v. Marinkovich, supra, 108 Cal.App.5th at p. 719; see also Teran, at pp.
378-379.)
C. The Evidence Fails to Support The Jury’s Findings Under the Act
The evidence summarized above shows that Steuermann contacted
GoDaddy for one purpose: to recover or reinstate Reynolds’s e-mail address so
that Reynolds’s could again use it. With GoDaddy’s assistance, she changed
the password and gained entry to the account, which contained both
Sillman’s and Reynolds’s e-mail addresses, and ultimately created a new
account only for Reynolds’s e-mail. In the course of doing so, the GoDaddy
15
representative informed Steuermann that the other e-mail addresses within
the account had become disabled the prior month due to nonpayment.
As stated above, the Act permits a civil action only by one who is the
“owner or lessee of the computer, computer system, computer network,
computer program, or data who suffers damage or loss by reason of a
violation . . . .” Even if we assume arguendo Sillman owned or at least partly
owned the GoDaddy e-mail account to the extent of his personal e-mail
addresses and the data within those,7 there is no evidence Sillman owned or
leased any “computer, computer system, or computer network” involved in
this matter. This eliminates defendants’ liability under various subsections
of the Act prohibiting knowing and unauthorized access of, or damage to a
computer (§ 502, subd. (c)(6), (7), (8)) or “provid[ing] or assist[ing] in
providing a means of accessing a computer [or] computer system . . . .” (§ 502,
7 We query whether Sillman continued to “own” his e-mail addresses and
accounts, as well as the data within them, once GoDaddy disabled the
accounts due to nonpayment. “[T]he concept of ‘ownership’ has particular
meaning in the law. The Civil Code defines ‘ownership’ as ‘the right of one or
more persons to possess and use [a thing] to the exclusion of others.’ (Civ.
Code, § 654.) Black’s Law Dictionary similarly defines an ‘owner’ as
‘[s]omeone who has the right to possess, use, and convey something; a person
in whom one or more interests are vested.’ (Black’s Law Dict. (11th ed.
2019).)” (Garrabrants v. Erhart, supra, 98 Cal.App.5th at p. 508.) In the
context of an instructional error claim, this court in Garrabrants rejected the
proposition that an individual who stores his personal and confidential data
with a third party has an ownership interest in that data for purposes of a
private right of action under section 502. (Id. at p. 509.) There is no need to
address the question, because we conclude Steuermann’s conduct on
Reynolds or Atlas’s behalf did not subject defendants to liability under any of
the relevant prohibited acts set forth in section 502, subdivision (c).
16
subd. (c)(13)). We limit our assessment of the evidence to those prohibited
acts involving data8 or computer services, i.e. e-mail services.
While the evidence shows Steuermann on Reynolds’s behalf accessed
the GoDaddy account and could see Sillman’s e-mail addresses, there is no
evidence—either direct or from which the jury could infer—that Steuermann
saw their contents or used them so as to execute a “scheme . . . to defraud,
deceive or extort” (§ 502, subd. (c)(1)(A)) or take control over or obtain the e-
mails (§ 502, subd. (c)(1)(B)). (See People v. Tillotson (2007) 157 Cal.App.4th
517, 528 [third necessary element of section 502, subdivision (c)(1) is that the
defendant have the specified purposes].) No such evidence exists as to
Reynolds or Atlas. (Compare Mintz v. Mark Bartelstein and Associates Inc.
(C.D. Cal. 2012) 906 F.Supp.2d 1017, 1032 [finding on summary judgment
section 502, subdivision (c)(1) violation (knowingly and without permission
using a computer to wrongfully obtain data) where company employee
8 “[T]he plain language of section 502 includes an extremely broad
definition of ‘data.’ The statutory definition does not include any express
requirements limiting the reach of the overall statute to non-public,
confidential, or proprietary information; it does not limit data to information
that is unique and possessed only by a single entity, but extends to
information that is duplicative of that possessed by other entities; and it does
not require that the entity whose computer is at issue have some legal
ownership interest in the data itself. The breadth of this definition of data
makes sense within the context of the overall statute: section 502
criminalizes a diverse range of conduct involving computer systems and data,
prohibiting, among other things, altering, damaging, deleting, or destroying
data without permission.” (Teran, supra, 112 Cal.App.5th at pp. 371, 380-
381, citing § 502, subd. (c)(1), (4).) In Teran, the court analyzed section 502,
subdivision (c)(2), concerning the use of data without permission. (Id. at p.
374.) There, an individual shared information containing writ decisions
arising out of civil service proceedings involving sheriff’s deputies. (Id. at p.
376.) The court held that the statute did not apply and criminal liability did
not attach to the sharing of “purely public court records.” (Id. at p. 386.)
17
accessed plaintiff’s gmail account without permission and viewed the
contents of several e-mails].)
Nor is there evidence Steuermann otherwise took, copied or “made use
of” Sillman’s e-mail addresses (§ 502, subd. (c)(2), (3) [violation for knowingly
and without permission “us[ing] or caus[ing] to be used computer services”]).
“Principles of statutory interpretation obligate us to give different meanings
to the words ‘use’ and ‘access’ in order to avoid rendering either word
redundant.” (Chrisman v. City of Los Angeles, supra, 155 Cal.App.4th at p.
34.) The statute does not define the term “use” or “include any language to
explain the permission necessary for a given use of data. But the
requirement that an individual obtain permission for the use of data that
resides on an entity’s computer can only be reasonably understood to apply to
situations where the entity has some dominion over, or right to control, the
uses made of that data.” (Teran, supra, 112 Cal.App.5th at p. 381.)
Here, the evidence and sole inference the jury could draw from it was
that Sillman had lost access to his GoDaddy e-mail accounts for nonpayment
a month before Steuermann accessed the account; thus, he had no “dominion
over, or right to control, the uses made of that data” (Teran, supra, 112
Cal.App.5th at p. 381) even assuming Steuermann’s actions constituted use.
Subsection (c)(5) of the Act requires proof that defendants “knowingly
and without permission . . . causes the disruption” or “denial” of computer
services, but those services must be “to an authorized user of a computer,
computer system, or computer network.” (§ 502, subd. (c)(5).) By the time
Steuermann contacted GoDaddy in October 2021, Sillman was no longer an
authorized user of any Atlas computer, nor was he even an authorized user of
the data, having failed to pay GoDaddy to maintain the account and its e-
mail addresses.
18
Subsection (c)(4) of section 502 makes it a violation to knowingly access
and without permission “delete[ ] or destroy any data . . . which reside or
exist internal or external to a computer, computer system or computer
network.” Notably, this subsection does not use the phrases “assists in,” or
“causes” as the Act does in its other subdivisions. (§ 502, subd. (c)(3) [“causes
to be used computer services”], (5) [“causes the disruption”], (6) [“assists in
providing a means of accessing”], (7) [“causes to be accessed”].) “When one
part of a statute contains a term or provision, the omission of that term or
provision from another part of the statute indicates the Legislature intended
to convey a different meaning.” (Cornette v. Department of Transportation
(2001) 26 Cal.4th 63, 73, 109; see People v. Childs, supra, 220 Cal.App.4th at
p. 1102 [“When different words are used in adjoining subdivisions of a statute
that were enacted at the same time, that fact raises a compelling inference
that a different meaning was intended”]; accord, California Capital Ins. Co. v.
Hoehn (2024) 17 Cal.5th 207, 221 [“ ‘ “In interpreting statutory language, a
court must not ‘insert what has been omitted, or . . . omit what has been
inserted’ ” ’ ”].) We must treat the omission as meaningful, requiring that to
impose liability under subdivision (c)(4), the party must themselves directly
destroy or delete the data, and not somehow facilitate or “cause” its deletion.
Here, the record contains no evidence that Steuermann herself deleted or
destroyed Sillman’s data.
Our conclusions are consistent with the Legislature’s intent in drafting
section 502, which at bottom is to protect against “tampering, interference,
damage, and unauthorized access to lawfully created computer data . . . .”
(§ 502, subd. (a).) The protection is broad (see, e.g., People v. Hawkins, supra,
98 Cal.App.4th 1428, 1441 [“Subdivision (c)(3) [of section 502] is a broad
prohibition against unauthorized use of a computer”]; People v. Lawton (1996)
19
48 Cal.App.4th Supp. 11, 15 [“Subdivision (c) of [section 502] is a laundry list
of illegal activity ranging from use of a computer to defraud or extort, to
infecting a computer with a virus”]) and not limited to just “browsers” and
“hacking” (Mahru v. Superior Court (1987) 191 Cal.App.3d 545, 549 [rejecting
idea that legislative declaration regarding the need to deter “unauthorized
intrusions into computer systems” is conclusive of a “legislative intent to
deter and punish only browsers and hackers”; concluding instead that the
court “cannot be confident . . . that this brief declaration of purpose was
intended to summarize every act covered by the statute”].) But “it is less
than clear that the statute is meant to subject individuals or entities to
liability who took no active role in tampering with, or in gaining
unauthorized access to computer systems. Indeed, the relatively few cases
interpreting the statute largely seek to impose liability against individuals or
entities who are alleged to have actually participated in unauthorized
‘hacking’ or the unlawful disclosure of information.” (Claridge v. RockYou,
Inc. (N.D.Cal. 2011) 785 F.Supp.2d 855, 863 [plaintiff could not allege
liability against a defendant under section 502, subdivision (c)(6) on the
theory it failed to provide a sufficiently secure system against third party
hackers]; compare Galderma Laboratories, L.P. v. Revance Therapeutics, Inc.
(C.D.Cal., Mar. 29, 2024, No. 2:23-CV-02879-FLA (SKX)) 2024 WL 3008860,
at p. *6 [section 502 violation stated by allegations that former employee
deleted information from his former employer’s laptop and accessed and took
its data using that laptop after his employment had ended, and that new
employer made false statements to the former company about it].)
We need not further analyze the various theories, because even if
Sillman had presented evidence of a violation to support the jury’s verdict, we
20
conclude below that Sillman did not present evidence of damage or loss
within the meaning of the Act.
D. Economic Damages Award
Section 502’s provision for a civil action extends to one who “suffers
damage or loss by reason of a violation” of any of the Act’s subdivision (c)
provisions. (§ 502, subd. (e)(1).) The Act does not define the terms damage or
loss, but it specifies that the party “may bring a civil action against the
violator for compensatory damages,” which “shall include any expenditure
reasonably and necessarily incurred by the owner . . . to verify that . . . data
was or was not altered, damaged, or deleted by the access.” (§ 502, subd.
(e)(1).)9 Here, the court instructed the jury on economic damages, and
specifically that to recover damages for the “unique value of [his]
GoDaddy.com, LLC e-mail account,” Sillman must prove: (1) the e-mail
9 The Act’s federal counterpart, the Computer Fraud and Abuse Act
(CFAA), similarly provides a civil remedy for “[a]ny person who suffers
damage or loss by reason of a violation of this section.” (18 U.S.C. § 1030(g);
Ticketmaster L.L.C. v. Prestige Ent. W., Inc. (C.D.Cal. 2018) 315 F.Supp.3d
1147, 1174 [“The CDAFA is California’s state-law analogue to the CFAA”]).)
Unlike California’s Act, the CFAA specifically defines the terms damage and
loss: “Damage” is “any impairment to the integrity or availability of data, a
program, a system, or information.” (18 U.S.C. § 1030(e)(8).) A “loss” is “any
reasonable cost to any victim, including the cost of responding to an offense,
conducting a damage assessment, and restoring the data, program, system,
or information to its condition prior to the offense, and any revenue lost, cost
incurred, or other consequential damages incurred because of interruption of
service.” (18 U.S.C. § 1030(e)(11).) Additionally, the CFAA authorizes a civil
action only if the conduct caused a “loss to one or more persons during any
one-year period aggregating at least $5,000 in value.” (LVRC Holdings LLC
v. Brekka (9th Cir. 2009) 581 F.3d 1127, 1132; 18 U.S.C. § 1030(c)(4)(A)(i)(I).)
The Ninth Circuit has held that “any theory of loss must conform to the
limited parameters of the CFAA’s definition” such that “ ‘revenue lost,’ . . .
refers only to losses that occurred ‘because of interruption of service.’ ”
(Andrews v. Sirius XM Radio Inc. (9th Cir. 2019) 932 F.3d 1253, 1263.)
21
account had some market value; (2) the e-mail account had unique value to
him; and (3) Atlas’ or Reynolds’s “conduct was intentional and wrongful.” It
instructed: “No fixed standard exists for deciding the amount of this value.
You must use your judgment to decide a reasonable amount based on the
evidence and your common sense.”10
“ ‘ “Damages” are monetary compensation for loss or harm suffered by a
person, or certain to be suffered in the future, as the result of the unlawful
act or omission of another.’ ” (DeLisi v. Lam (2019) 39 Cal.App.5th 663, 681,
quoting Civ. Code, §§ 3281-3283.) “Compensatory damages ‘are intended to
redress the concrete loss that the plaintiff has suffered by reason of the
defendant’s wrongful conduct.’ ” (Los Angeles Unified School Dist. v. Superior
Court (2021) 64 Cal.App.5th 549, 555.) Compensatory damages are
synonymous with actual damages. (DeLisi, at p. 681.) “ ‘ “Actual” is defined
as “existing in fact or reality,” as contrasted with “potential” or
“hypothetical,” and as distinguished from “apparent” or “nominal.”
(Webster’s Third New Internat. Dict. (1964) p. 22.) It follows that “actual
damages” are those which compensate someone for the harm from which he
or she has been proven to currently suffer or from which the evidence shows
he or she is certain to suffer in the future. They are to be distinguished from
those which are nominal rather than substantial, exemplary or punitive
rather than compensatory, and speculative rather than existing or certain.’ ”
(DeLisi, at p. 681.)
The jury was asked to award a damages amount based on the e-mails’
unique or peculiar value to Sillman. “Where certain property has a peculiar
value to a person recovering damages for deprivation thereof, or injury
10 Noneconomic damages, on the other hand, “compensate an injured
plaintiff for nonpecuniary injuries” including emotional distress. (Burchell v.
Faculty Physicians & Surgeons etc. (2020) 54 Cal.App.5th 515, 526.)
22
thereto, that may be deemed to be its value against one who had notice
thereof before incurring a liability to damages in respect thereof, or against a
willful wrongdoer.” (Civ. Code, § 3355.) But that provision refers to “unique
economic value, not its sentimental or emotional value.” (McMahon v. Craig,
supra, 176 Cal.App.4th at p. 1518, italics added.) “Compensatory damages
are not given for emotional distress caused merely by the loss of . . . things
. . . .” (Id. at p. 237, quoting Rest.2nd Torts, § 911.) Here, there is no
evidence from which the jury could reach a reasonably certain, unspeculative,
amount of damage suffered by Sillman for the loss of his e-mail data.
(Piscitelli v. Friedenberg (2001) 87 Cal.App.4th 953, 989 [“Whatever its
measure in a given case, it is fundamental that ‘damages which are
speculative, remote, imaginary, contingent, or merely possible cannot serve
as a legal basis for recovery’ ”].) Sillman’s testimony was that there were
about 20,000 important e-mails in his GoDaddy e-mail accounts, but he did
not attempt to place a monetary value on them. Their sentimental value was
not relevant to the compensatory economic damages analysis.
II. Attorney Fees
Following entry of judgment, both Sillman and Steuermann sought
awards of attorney fees as prevailing parties under section 502, which
provides simply that “[i]n any action brought pursuant to this subdivision the
court may award reasonable attorney’s fees.” (§ 502, subd. (e)(2).) Sillman
sought to recover $375,231 in attorney fees and $36,205.62 in costs under not
only section 502, but also Code of Civil Procedure section 1021.5, arguing the
award would result in the enforcement of an important right affecting the
public interest and conferring a significant benefit on the general public.
Steuermann sought an award of $129,956 in attorney fees and $5,000
in costs under section 502. She pointed out that Sillman only added the
23
claim against her in a supplemental complaint and presented no evidence to
support his argument that she acted outside the course and scope of her
employment. She pointed to the jury’s unanimous verdict in her favor, as
well as the fact Sillman elected to reject a pretrial settlement offer she had
made. Steuermann argued section 502 broadly authorized the court to award
reasonable attorney fees, stating “[n]othing about the plain language of
section [502, subdivision] (e)(2) or its discernable legislative history supports
denying fees . . . .”
Sillman opposed Steuermann’s motion on grounds the Legislature in
2000 amended section 502 to limit an award of attorney fees to a prevailing
plaintiff. He pointed out that federal district courts had reached this
conclusion. Sillman further argued that even if Steuermann were entitled to
an attorney fee award, her claim was not substantiated by billing statements
or detailed records.
The trial court awarded Sillman $93,808 in reasonable attorney fees,
and denied him costs. It denied Steuermann attorney fees. The court
pointed to federal district case law holding the Legislature sought to limit
section 502 attorney fee awards to prevailing plaintiffs, but noted contrary
authority in an unpublished California Court of Appeal decision. The court
quoted from Physician’s Surrogacy, Inc. v. German (S.D.Cal. 2018) 311
F.Supp.3d 1190: “ ‘If recovery of attorney’s fees is limited to prevailing
plaintiffs under . . . [section] 502[, subdivision] (e), defendants are not
permitted to recover their attorneys’ fees as defendants . . . . If the decision
to award fees remains within the trial court’s discretion, the court finds it
would be unreasonable to award fees because the court did not determine
that plaintiff’s section 502 claim was either frivolous or abusive . . . .
Accordingly, the court declines to award defendants attorneys’ fees under
24
section 502[, subdivision ](e).’ ” The trial court ruled Steuermann “is not
entitled to an award of statutory attorney fees as a prevailing party.
Further, the court finds that [Sillman’s] claim against [Steuermann] was not
frivolous or abusive.”
A. Award of Attorney Fees to Sillman Against Reynolds and Atlas
Given we have reversed the judgment on Sillman’s section 502 claim,
we reverse the award of attorney fees to Sillman. An order awarding
attorney fees “ ‘falls with a reversal of the judgment on which it is based.’ ”
(Gunther v. Alaska Airlines, Inc. (2021) 72 Cal.App.5th 334, 358.)
B. Denial of Attorney Fees to Steuermann
Steuermann contends section 502’s plain language—“[i]n any action
brought pursuant to this subdivision the court may award reasonable
attorney’s fees”—allows for a discretionary award of attorney fees to a
prevailing defendant without any condition. She argues the statute requires
only that Sillman’s action be brought pursuant to section 502, subdivision (e),
and because that was Sillman’s sole cause of action against her, the trial
court should have exercised its broad discretion in deciding whether to award
her attorney fees without having to first find Sillman’s action was frivolous or
abusive. Steuermann says the statute’s legislative history does not support
any contrary intent, and she asks us to reject the holdings of federal district
courts concluding otherwise. Steuermann argues the court prejudicially
erred by conditioning its consideration of section 502 attorney fees on
whether Sillman’s claim was frivolous or abusive, as the Legislature has not
imposed any such restriction.
25
After Steuermann submitted her brief on the attorney fees appeal,11
another panel of this court resolved these issues in Hay v. Marinkovich,
supra, 108 Cal.App.5th 707. Holding section 502’s language was clear and
unambiguous, this court concluded based on the statutory text alone a court
may award any party—including a prevailing defendant—section 502
attorney fees. (Hay, at pp. 719-720.) “The fact that the statute may be broad
does not make it ambiguous.” (Id. at p. 720.) Hay went on to disagree with
federal district courts holding that the legislative history indicated any intent
to allow only fee awards to prevailing plaintiffs. (Id. at pp. 720-722.)
This court also addressed the standard that applies to a prevailing
defendant’s request for fees under section 502. (Hay v. Marinkovich, supra,
108 Cal.App.5th at p. 722.) We analyzed the issue by applying the framing of
Travis v. Brand (2023) 14 Cal.5th 411, which looked at other statutory
contexts and addressed “whether a trial court’s discretion to award fees to a
prevailing defendant is coextensive with its discretion to award fees to a
prevailing plaintiff” where “[t]he text of the statute does not specify the
standard that should govern an award of fees to either prevailing party.”
(Travis, at p. 414; see Hay, at p. 723.) We held based on section 502’s goals
and objectives (Hay, at pp. 725-726) that an “asymmetrical standard” applied:
section 502 defendants may only recover attorney fees where the plaintiff’s
claim was objectively without foundation when brought, or the plaintiff
continued to litigate after it clearly became so. (Hay, at pp. 713, 726-727.) “A
contrary rule would chill private enforcement of the statute and thus
undermine its purpose.” (Id. at p. 727.)
11 As in the consolidated appeal, Sillman has not provided a respondent’s
brief.
26
This court in Hay went on to conclude that the trial court’s decision in
that case—that the plaintiff’s case was not “frivolous”—was not an abuse of
discretion. (Hay v. Marinkovich, supra, 108 Cal.App.5th at p. 728.)
Examining the trial evidence, we explained the plaintiff’s claim “had ‘some
basis in fact.’ ” (Id. at pp. 728-729.) Further, the jury’s special verdict
showed the plaintiff’s claim was not objectively without foundation. (Id. at p.
729.) This court reasoned: “ ‘[T]he jury found in Plaintiff’s favor on some of
the . . . section 502 claim questions on the special verdict, as well as on the
other causes of action.’ Although the jury found [the defendant] had
permission to copy and access the data, polling revealed that this finding was
not unanimous—three of the 12 jurors believed [he] acted without
permission. The jury also found, seemingly inconsistently, that [the
defendant] lacked justification to intrude on [the plaintiff’s] expectation of
privacy. The lack of unanimity on the permission question under the section
502 claim, along with the jury’s finding under the invasion of privacy claim
that [the defendant] invaded [the plaintiff’s] privacy without justification,
further demonstrates that [the plaintiff’s] claim was not objectively without
foundation. ‘Instead, the case at bar appears to be a routine case in which
the plaintiff merely failed to achieve success on her claim.’ ” (Ibid.)
We acknowledge that here, the trial court ruled Sillman’s section 502
claim against Steuermann was not frivolous or abusive. However, the court
did not have the benefit of our reasoning in Hay v. Marinkovich, supra, 108
Cal.App.5th 707, and its conclusion that a prevailing defendant seeking
attorney fees under section 502 must demonstrate that a plaintiff’s action
was either “objectively without foundation when brought, or the plaintiff
continued to litigate after it clearly became so.” (Id. at p. 713, see also id. at
pp. 726-727, 728.) We leave it to the trial court in the first instance to make
27
that determination applying the standards expressed in Hay, including by
allowing the parties to address the matter anew and/or by reconsidering
Steuermann’s motion for attorney fees.
DISPOSITION
The judgment against Reynolds and Atlas is reversed, as is the
postjudgment order awarding Penal Code section 502 attorney fees to
Sillman against those defendants. The postjudgment order denying attorney
fees to Steuermann is reversed and the matter remanded for the trial court to
decide whether Steuermann is entitled to attorney fees, including attorney
fees on appeal, under the standards expressed in Hay v. Marinkovich, supra,
108 Cal.App.5th 707. Atlas Storage, LLC and M. Kathryn Newnham as
personal representative of the estate of Dixie J. Reynolds shall recover their
costs on appeal.
O’ROURKE, Acting P. J.
WE CONCUR:
DO, J.
KELETY, J.
28