R v Bow Street Metropolitan Stipendiary Magistrate, ex p Government of the United States of America
An employee who is authorised to access some data on a computer, but accesses other data which she is not authorised to access, commits the offence of unauthorised access under the Computer Misuse Act 1990.
Facts
Ms Ojomo was employed by American Express in Florida, and was authorised to access customer accounts on its computer system, but only those accounts which were assigned to her. She accessed other accounts and obtained information which she passed to others, including Mr Allison, who used it to forge credit cards and withdraw large sums of money from cash machines. The United States sought the extradition of Mr Allison from England, for offences including conspiracy to secure unauthorised access to a computer under section 1 of the Computer Misuse Act 1990. The magistrate held that Ms Ojomo's access was not unauthorised, because she was entitled to access the computer system.
Legal principle
The House of Lords held that the access was unauthorised, and that Mr Allison could be extradited. Lord Hobhouse said that section 1 of the Act was concerned with authority to access the particular programs or data on the computer, not with authority to access the computer in general, and that an employee who was authorised to access only certain data, and accessed other data, committed the offence. The House disapproved the reasoning of the Divisional Court in DPP v Bignell, which had suggested that police officers who used the police computer for private purposes did not commit the offence because they were authorised to use it, to the extent that it was inconsistent with this approach.
Related cases on technology, software, platforms and digital assets
- AA v Persons Unknown [2019] EWHC 3556 (Comm)
- Cartier International AG v British Telecommunications plc [2018] UKSC 28, [2018] 1 WLR 3259
- DPP v Lennon [2006] EWHC 1201 (Admin)
- Emotional Perception AI Ltd v Comptroller General of Patents, Designs and Trade Marks [2024] EWCA Civ 825
- Google France SARL v Louis Vuitton Malletier SA Joined Cases C-236/08 to C-238/08, [2010] ECR I-2417
- Google LLC and Alphabet Inc v Commission (Google Shopping) Case C-48/22 P, EU:C:2024:726
- L'Oréal SA v eBay International AG Case C-324/09, [2011] ECR I-6011
- Quoine Pte Ltd v B2C2 Ltd [2020] SGCA(I) 02
Studying data protection and technology law? Our tutors help you understand and apply cases like this in essays, problem questions and exams. Request a quote or browse our law notes.
This summary is for study and revision and is not legal advice. Although our case summaries are checked for accuracy, we do not guarantee that they are free from errors or omissions. Always read the full judgment for the court's reasoning.
