The Cour de cassation, Luxembourg's highest court in civil and criminal matters, rendered an important decision on 3 April 2014 regarding data theft.
The matter before the Cour de cassation was a criminal case against a former bank employee. The employee had downloaded and photocopied confidential documents belonging to the bank. He then resigned on the basis of what he alleged to be gross misconduct of the bank. In the ensuing proceedings before an employment tribunal, he produced the confidential documents he had downloaded and photocopied as evidence. Thereupon, the bank filed a criminal complaint for (i) theft and (ii) violation of professional secrecy obligations.
Pierre Elvinger of EHP acted for the bank.
- In a judgment of 26 June 2012, the Luxembourg District Court considered that the employee had committed both the offences of (i) theft and (ii) violation of professional secrecy. The District Court did not distinguish between the downloaded and the photocopied documents, thus recognising that the taking of incorporeal property such as data downloaded from a server constitutes theft.
However, the District Court upheld a justification defence based on the defendant's procedural rights in the employment tribunal proceedings. Applying French precedent, the District Court considered that theft and violation of professional secrecy by an employee were justified if the employee's aim in performing these acts was to gather evidence necessary for his defence against his employer before a court of law.
As a result, the defendant was acquitted.
- By a decision of 10 July 2013, the Court of Appeal confirmed the defendant's acquittal, but gave partly different reasons from the Luxembourg District Court.
Regarding theft, the Court of Appeal made a distinction between the downloading of electronic data and the photocopying of paper documents.
The Court of Appeal held that an object of theft can only be an item of moveable corporeal property. According to this interpretation of the law, data cannot be stolen, because it is not a "thing" that can be stolen. The defendant could therefore not be guilty of theft on the basis of having downloaded confidential data.
As for the photocopies, the Court of Appeal held that the mens rea element was missing. In merely making photocopies of confidential documents, the defendant did not display an intent to act as if he were the owner of the originals or to usurp the possession of the originals unbeknownst to and against the will of the rightful owner.
Regarding violation of professional secrecy, the Court of Appeal upheld the District Court's reasoning and added that the justification defence invoked by the District Court is a consequence of Article 6 of the European Convention of Human Rights, which has priority over domestic law. The line of case-law established in France regarding a justification defence to theft on the basis of Article 6 can be extended to the offence of violation of professional secrecy.
- The Cour de cassation's decision of 3 April 2014 partly strikes down the decision in the context of the civil request submitted.
Regarding theft, the Cour de cassation followed the Court of Appeal's distinction between the downloading of electronic data and the photocopying of paper documents. However, it provided a radically different ruling on these points.
The Cour de cassation held that "electronic data stored on the bank's server and which is legally its [i.e. the bank's] exclusive property constitute incorporeal property which can be apprehended by way of downloading". In other words, electronic data stored on a server qualifies as a "thing" ("chose") that can be stolen. This wide interpretation of the definition of theft marks a break with the Court of Appeal's case-law as well as with the French Cour de cassation's case-law. Henceforth, under Luxembourg law, data theft is theft.
Regarding the photocopying of documents, the Cour de cassation held that "the employee who makes, for his personal ends, unbeknownst and against the will of the owner, photocopies of documents belonging to his employer and which he only has in his possession precariously, commits an act of apprehension of said documents, thus fulfilling the material conditions of theft." The Cour de cassation thus considers that taking a document to make an unauthorised photocopy constitutes the actus reus of theft.
As for the mens rea element, the Cour de cassation held that the Court of Appeal failed to provide sufficient legal basis for its decision when it stated that the defendant did not display an intent to act as if he were the owner of the originals or to usurp the possession of the originals unbeknownst to and against the will of the rightful owner. The Court of Appeal should have looked into the question of whether the documents were strictly necessary for the defendant's defence before the employment tribunal.
Finally, the Cour de cassation upheld the Court of Appeal's acquittal of the defendant on the count of violation of professional secrecy.
The matter will now return to the Court of Appeal, which will have to decide whether theft is to be retained in order to analyse thereupon whether justification causes do exist in order to conclude whether the civil claim is to be admitted in light of the Cour de cassation's decision.
The Cour de cassation ruling brings legal certainty to an area of law that has been ridden with conceptual difficulties since the advent of information technology. Debates around the question of whether data is a "thing" ("chose") that can be stolen abound in civil law jurisdictions. In Luxembourg, the question is settled, for now. This is particularly relevant in the financial industry, where a significant proportion of the work population has access to confidential data on a daily basis.
Moreover, it is significant that the Cour de cassation has narrowed the justification defence to theft based on an employee's need to gather evidence for his defence in the context of a dispute with his employer by holding that criminal courts must examine whether the stolen documents were "strictly necessary" for the employee's defence. The Cour de cassation thus strikes a delicate balance between the competing rights to confidentiality of the employer and to a fair trial of the employee.
