DPP v Lennon
Sending a huge number of emails to a company's server, to disrupt its operation, is an unauthorised modification of data, because the owner of the server does not consent to emails sent for that purpose.
Facts
Mr Lennon was dismissed by his employer. He then used a mail bombing program to send about 500,000 emails to the company's email server, purporting to come from members of its staff, which caused the server to crash. He was charged with causing an unauthorised modification of the contents of a computer, contrary to section 3 of the Computer Misuse Act 1990. The youth court held that there was no case to answer, because the company's server was configured to receive emails, so the owner had consented to the addition of data by the sending of emails.
Legal principle
The Divisional Court allowed the prosecution's appeal and remitted the case for trial. The court said that the owner of a computer which is able to receive emails is ordinarily to be taken as consenting to the sending of emails to the computer, but that this implied consent has limits, and does not cover emails which are not sent for the purpose of communication but for the purpose of interrupting the proper operation and use of the system. The deluge of emails sent by Mr Lennon was not authorised. The offence under section 3 has since been replaced by the offence of unauthorised acts with intent to impair the operation of a computer, under the Police and Justice Act 2006.
Related cases on technology, software, platforms and digital assets
- AA v Persons Unknown [2019] EWHC 3556 (Comm)
- Cartier International AG v British Telecommunications plc [2018] UKSC 28, [2018] 1 WLR 3259
- Emotional Perception AI Ltd v Comptroller General of Patents, Designs and Trade Marks [2024] EWCA Civ 825
- Google France SARL v Louis Vuitton Malletier SA Joined Cases C-236/08 to C-238/08, [2010] ECR I-2417
- Google LLC and Alphabet Inc v Commission (Google Shopping) Case C-48/22 P, EU:C:2024:726
- L'Oréal SA v eBay International AG Case C-324/09, [2011] ECR I-6011
- Quoine Pte Ltd v B2C2 Ltd [2020] SGCA(I) 02
- R v Bow Street Metropolitan Stipendiary Magistrate, ex p Government of the United States of America [2000] 2 AC 216
Studying data protection and technology law? Our tutors help you understand and apply cases like this in essays, problem questions and exams. Request a quote or browse our law notes.
This summary is for study and revision and is not legal advice. Although our case summaries are checked for accuracy, we do not guarantee that they are free from errors or omissions. Always read the full judgment for the court's reasoning.
