The U.S. Court of Appeals for the Second Circuit in August addressed the proper application of the statute of limitations to a civil action — in the context of allegations of malicious statements made on the Internet over a broken romance and sexual misconduct — brought under the federal computer crime statute, the Computer Fraud and Abuse Act (CFAA). The case was Sewell v. Bernardin.
The CFAA, primarily a criminal statute, permits those who have suffered damages or loss due to a violation of the CFAA to bring a civil action to obtain compensatory damages and injunctive relief. However, for the cause of action to be valid, it must be brought within two years “of the date of the act complained or of the date of the discovery of the damage.” Sewell underscores the need for immediate action upon discovering a data breach to investigate and identify the perpetrator of the computer crime.
