Court of Appeals

Cite as 2014 Ark. App. 609 ARKANSAS COURT OF APPEALS DIVISION IV No. CV-13-1033 Opinion Delivered November 5, 2014 INFINITY HEADWEAR & APPAREL, LLC APPEAL FROM THE BENTON APPELLANT COUNTY CIRCUIT COURT [NO. CV2012-1813-5] V. HONORABLE XOLLIE DUNCAN, MICHAEL COUGHLIN JUDGE APPELLEE AFFIRMED BRANDON J. HARRISON, Judge This case primarily asks whether, under Arkansas or federal law, Michael Coughlin unlawfully took electronic business data from Infinity Headwear & Apparel, LLC. The circuit court answered “no” and granted summary judgment against Infinity’s first amended complaint. Infinity appeals that decision, but we affirm the circuit court. I. Background Infinity markets sportswear, apparel, and other products. In May 2008, Coughlin was hired as Infinity’s sales manager. Coughlin signed an acknowledgment of company policies informing him that all work product was the sole property of Infinity and was nontransferable. Coughlin did not sign a nondisclosure provision or a non-compete agreement. In August 2012, Coughlin began working for Outdoor Cap Co., Inc., a larger competitor of Infinity. Before leaving Infinity, Coughlin emailed files from Infinity’s database to his personal email account. This database contained, among other things,

Cite as 2014 Ark. App. 609 Infinity’s sales plans, margins, marketing and operating costs, customer and supplier lists, royalty negotiations, and future project ideas. Only employees could access the database. In September 2012, Infinity sued Coughlin for breach of contract, violating the Theft of Trade Secrets Act, breaching a duty of loyalty, and conversion. Infinity also sought temporary injunctive relief against Coughlin. Coughlin responded to Infinity’s motion for a temporary restraining order. Following an evidentiary hearing, the circuit court denied Infinity’s motion for a temporary restraining order because Infinity had not adequately protected its information as the trade-secrets law requires. See Saforo & Assocs., Inc. v. Porocel Corp., 337 Ark. 553, 991 S.W.2d 117 (1999). After the temporary restraining order was denied, Infinity amended its complaint. The first amended complaint dropped the trade-secrets claim but raised six claims: that Coughlin (1) breached a contract, (2) violated the federal Computer Fraud and Abuse Act (CFAA), (3) committed unlawful acts under an Arkansas statute dealing with computer-related activity (Ark. Code Ann. § 5-41-202 (Repl. 2013)), (4) breached a duty of loyalty, (5) converted tangible and intangible property, and (6) was liable for replevin. Infinity sought, among other things, damages, injunctive relief, and an order directing that Coughlin to return all of Infinity’s property. Coughlin answered the complaint. Later, Coughlin moved for summary judgment against Infinity’s first amended complaint. Infinity opposed the motion. Following a hearing, the circuit court granted Coughlin’s motion. The court ruled that any contract between the parties was oral and that,

Cite as 2014 Ark. App. 609 in any event, there was no triable issue on whether a breach had occurred. On the breach-of-loyalty claim, the court ruled that there was no such claim because no fiduciary relationship existed between the parties; nor was one ever alleged. The court also found that Coughlin was permitted to copy data to a personal computer so that he could work remotely. The court also ruled that there was no genuine issue of material fact in dispute on the point that Coughlin deliberately destroyed or misused data and thus rejected the federal CFAA claim. Regarding the state-law computer claim, the court entered judgment for Coughlin because the statute unambiguously stated that there was no civil remedy available for alleged unlawful acts regarding a computer. The court entered summary judgment on the conversion claim because, according to it, our supreme court has not recognized a cause of action for conversion of intangible things like Infinity’s data and, in any event, Coughlin did not deprive Infinity of the data or its use. On appeal, Infinity abandoned some of its claims, and here argues that the court erred when it (1) granted Coughlin’s motion on the conversion claim, (2) held that no claim exists for breach of the duty of loyalty, and (3) found that, to assert a claim under CFAA, a misuse or destruction of data is required. II. Discussion A summary judgment is proper only when there are no genuine issues of material fact to be litigated, and the party is entitled to judgment as a matter of law. Locke v. Cont’l Cas. Co., 2013 Ark. App. 690. Once the moving party has established a prima facie entitlement

Cite as 2014 Ark. App. 609 to summary judgment, the opposing party must meet proof with proof and show the existence of a material issue of fact. Id. We determine if summary judgment was appropriate based on whether the evidentiary items presented by the moving party leave a material fact unanswered, focusing our review not only on the pleadings, but also on the affidavits and documents filed. Id. We view the evidence in the light most favorable to the party against whom the motion was filed, and resolve all doubts and inferences against the moving party. Id. A. The Contract, Unlawful Acts Regarding a Computer, and Replevin Claims As we have mentioned, Infinity’s first amended complaint pleaded, among other things, breach of contract, a claim under Ark. Code Ann. § 5-41-202 (Repl. 2013), and replevin. The circuit court entered summary judgment against these claims. Because Infinity has not appealed those adverse rulings, we will not address them further. B. The Breach-of-Loyalty Claim Infinity argues that the circuit court erred in ruling that Arkansas does not recognize a claim for breaching the duty of loyalty. Infinity correctly observes that no Arkansas appellate court has addressed whether a company like it may pursue an independent, freestanding breach-of-loyalty claim in the circumstances this case presents. We hold that the circuit court was correct: Arkansas law does not recognize an independent breach-of-loyalty claim on this case’s facts, and we decline to recognize one at this time. To support its argument that Arkansas should (or does) recognize an independent action for breach of common law duty of loyalty—even when no fiduciary relationship is

Cite as 2014 Ark. App. 609 alleged—Infinity cites Howard W. Brill, Arkansas Law of Damages § 19:1 (5th ed. 2004) and Vigoro Industries., Inc. v. Crisp, 82 F.3d 785 (8th Cir. 1996). Professor Brill’s book states that “[u]nder the common law, an employee owes a duty of loyalty to the employer. At a minimum, that duty prohibits the employee from soliciting the employer’s customers for himself or competing with his employer while still employed.” Arkansas Law of Damages, supra. As authority for these propositions, Professor Brill cites the United States Court of Appeals for the Eighth Circuit’s Vigoro Indus., Inc. v. Crisp opinion. It is true that the Eighth Circuit, in Vigoro, discussed an employee’s “breach of loyalty,” but it did so in the fiduciary-duty context. Id. at 788. Here, however, Infinity does not allege that a fiduciary duty existed and that it was breached. Consequently, this case is materially different from Vigoro. C. The Federal Computer Fraud and Abuse Act Claim A summary judgment against Infinity’s claim that Coughlin violated the Computer Fraud and Abuse Act, 18 U.S.C. § 1030, was also justifiable. The circuit court ruled that there was no evidence that Coughlin had deliberately destroyed or misused Infinity’s data. Our analysis differs somewhat from the circuit court’s—it arguably took a failure-of-proof approach while we take more of a statutory-interpretation approach—but the end result is the same. Some federal courts have stated that CFAA’s general purpose was to protect the public against computer hackers (so-called electronic trespassers). Dresser-Rand Co. v. Jones, 957 F. Supp. 2d 610 (E.D. Pa. 2013); accord Shamrock Foods Co. v. Gast, 535 F. Supp. 2d 962,

Cite as 2014 Ark. App. 609 965 (D. Ariz. 2008); U.S. Bioservices Corp. v. Lugo, 595 F. Supp. 2d 1189, 1193 (D. Kan. 2009). Generally speaking, the legislation permits a person who “suffers damage or loss” because of a violation of the CFAA to “maintain a civil action against the violator” for damages and injunctive relief. 18 U.S.C. § 1030(g). The act defines “damage” as “any impairment to the integrity or availability of data, a system, or information.” 18 U.S.C. § 1030(e)(8). “Loss” under the CFAA is defined broadly as “any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service.” 18 U.S.C. § 1030(e)(11). The loss suffered from a violation must exceed $5,000 before a civil suit may be filed. 18 U.S.C. § 1030(c)(4)(A)(i)(I). Infinity argues that triable issues of fact exist regarding Coughlin’s authorization to access its computers. Specifically, it says that “the parties dispute material facts as to whether Coughlin was authorized to use the computers of Infinity to send files to his personal email account in preparation to join a competitor,” and “[t]hey further dispute whether he was authorized to keep these files after leaving Infinity’s employ.” We disagree that genuine issues of disputed material fact exist to prevent summary judgment on this record and CFAA’s provisions. Under CFAA, “an employee is authorized to access a computer when his employer approves or sanctions his admission to that computer,” an employee is “without authorization” when “he gains admission to a computer without approval,” and an

Cite as 2014 Ark. App. 609 employee “exceeds authorized access” “when he has approval to access a computer, but uses his access to obtain or alter information that falls outside the bounds of his approved access.” WEC Carolina Energy Solutions LLC v. Miller, 687 F.3d 199, 204 (4th Cir. 2012) (internal citation omitted). There is no genuine dispute of material fact on whether Coughlin accessed a computer without authorization or exceeded his authorized access so as to trigger CFAA’s provisions. Infinity allowed its employees, like Coughlin, to use computers to access company information of the sort at issue in this case. Infinity’s CFO testified that fourteen people had access to the same information, termed “shared resources,” that Coughlin did when he left Infinity. Using a unique password, each Infinity employee could access all of Infinity’s shared data. The CFO further stated that “[i]t is possible that any or all employees have the very same documents on their personal computers as Michael Coughlin did.” Simply put, because Infinity allowed or permitted Coughlin to access and download Infinity’s shared data, he cannot be liable under the CFAA. See WEC Carolina, 687 F.3d at 207; see also LVRC Holdings LLC v. Brekka, 581 F.3d 1127, 1128 (9th Cir. 2009); Amphenol Corp. v. Paul, 993 F. Supp. 2d 100 (D. Conn. 2014). That he emailed this information to a personal email account is not a material legal point. “Whatever happens to the data subsequent to being taken from the computers . . . is not encompassed in the purview of the CFAA.” Dresser-Rand Co., 957 F. Supp. 2d at 615. Another court has put the matter this way in a similar factual context: “Because [the employee] was authorized to use [the company’s] computers while he was employed at [the company], he did not access a

Cite as 2014 Ark. App. 609 computer ‘without authorization’ in violation of § 1030(a)(2) or § 1030(a)(4) when he emailed documents to himself and to his wife prior to leaving [the company]. Nor did emailing the documents ‘exceed authorized access,’ because [the employee] was entitled to obtain the documents.” LVRC Holdings, 581 F.3d at 1129. Given this case’s facts, we hold that the circuit court did not err in granting summary judgment against Infinity’s CFAA claim. D. The Conversion Claim Regarding the conversion claim, our supreme court has held that the Theft of Trade Secrets Act preempts tort claims for conversion of trade secrets. R.K. Enter., LLC v. Pro-Comp Mgmt., Inc., 356 Ark. 565, 571–74, 158 S.W.3d 685, 688–90 (2004). The court made clear that the Trade Secrets Act is the exclusive remedy for the alleged misappropriation of trade secrets. In our view, this fact answers Infinity’s electronic-data conversion claim. To the extent it asks us to create a new cause of action for the conversion of electronic data, we decline to do so. The circuit court’s decision to reject Infinity’s conversion claim as it relates to electronic data is affirmed. This case was mostly about intangible information or business data that Infinity said Coughlin took and used to unfairly disadvantage Infinity in the marketplace. But there is a “tangible property” argument too. On the collateral argument that some tangible property was unlawfully taken from Infinity, the circuit court’s order more or less granted it the relief it sought: the court found that Coughlin did not possess “the information and property . . . described in [Infinity’s] First Amended Complaint. Any such information and property

Cite as 2014 Ark. App. 609 that is currently in the possession of [Coughlin’s] counsel shall be returned to [Infinity’s] counsel subsequent to the entry of this Order.” That order resolved any tangible-property dispute given the case’s history. For example, during the temporary hearing in October 2012 that addressed the then-pending trade-secrets claim, it appears that the tangible-property angle, to the extent one existed, was “worked out between the lawyers.” And during the hearing on the motion for summary judgment in July 2013, Infinity’s lawyer stated that “[t]he claim for replevin need not go forward assuming the Taylor Law Firm is keeping the information appropriately.” Finally, Infinity’s brief points us to Doug Keller’s affidavit as it argues its conversion claim on appeal, but that affidavit does not clearly delineate what property was wrongfully taken and needed to be returned. The bottom line is that no triable issue exists on the conversion claim. III. Conclusion The circuit court’s summary-judgment order is affirmed. Affirmed. G RUBER and WOOD, JJ., agree. Keith, Miller, Butler, Schneider & Pawlik, PLLC, by: G. Nicholas Arnold and George Rozzell, for appellant. Taylor Law Partners, LLP, by: William B. Putnam, for appellee.