Mischief to Computer Data

The short answer

Mischief can apply to computer data as well as physical property. Deleting files, changing records or locking someone out of their accounts can all be mischief to data under s. 430(1.1) of the Criminal Code. It carries up to 10 years by indictment. Many of these cases arise when an employee leaves a job or a relationship ends, so the question of who was allowed to control the data is often central.

What counts as mischief to data

Section 430(1.1) covers wilfully doing any of the following:

• Destroying or altering computer data.
• Making data meaningless, useless or ineffective.
• Obstructing, interrupting or interfering with the lawful use of data.
• Denying access to data to a person who is entitled to it.

Common situations

• An employee deletes company files or emails before leaving a job.
• Someone changes passwords to lock out an employer or a former partner.
• A shared phone, tablet or computer is wiped.
• Business records or databases are changed.

What the Crown must prove

Workplace cases

When an employee leaves a job, disputes often arise about files, emails, client lists and accounts. Employment contracts and company policies may say who owns certain data and what employees may delete. However, a policy does not decide the criminal case on its own. The Crown must still prove that you acted wilfully and without authorization or an honest belief in your right to act.

Relationship cases

After a relationship ends, former partners sometimes change passwords to shared streaming, banking, email or social media accounts. Whether this is mischief depends on who was entitled to use the account and what data was affected. Taking back control of an account that is genuinely yours is very different from locking someone out of their own data.

The evidence in a typical case

The evidence often includes system logs showing logins and deletions, IP addresses, device records, emails or messages about the data, and reports from the employer's IT staff or an outside investigator. Logs can show that an account was used, but they do not always show who was using it. Shared passwords and shared devices can make identity a real issue.

What happens after you are charged

1. Release: Police usually release you with conditions, which may include not accessing certain accounts or contacting the complainant.
2. Disclosure: The Crown provides the technical evidence, which can take time and may need careful review.
3. Pre-trial: Your lawyer reviews whether you were authorized and whether the data was actually affected.
4. Resolution or trial: Some cases resolve through restoration of the data and restitution, while others go to trial.

Defences

• Authorization: You were allowed to change or delete the data.
• Colour of right: You honestly believed the data was yours to control.
• Identity: Other people had access to the same accounts or devices.
• No real interference: The data was not actually destroyed, changed or blocked.

For example, deleting personal photos from a work phone before returning it is very different from wiping the company's client database.

Penalties

• By indictment: The maximum is 10 years in jail (s. 430(5)).
• On summary conviction: The maximum is 2 years less a day, a fine of up to $5,000, or both.

There is no minimum sentence, so a discharge may be available. Courts may also order restitution for the cost of restoring the data. Damage to the computer equipment itself, rather than the data, is usually charged as ordinary property mischief, with penalties that depend on value, as explained in our guide to mischief under $5,000.

Restitution for data recovery

When data is deleted or changed, the owner may pay an IT company to recover or rebuild it. The court can order you to repay those costs when they are readily calculated (s. 738). Restoring the data yourself, or helping the owner recover it, can reduce the loss and may support a better outcome. Any steps you take should be arranged through your lawyer.

Effects beyond the sentence

Because mischief to data carries a maximum of 10 years, a conviction can make a permanent resident inadmissible for serious criminality. It can also affect future jobs, especially in technology, finance and other fields where employees have access to sensitive systems.

Possible outcomes

Data, devices and Charter rights

Police often need a warrant to search a phone, computer or online account, because these devices contain large amounts of private information. If police searched a device without proper authority, or went beyond what a warrant allowed, the evidence may be excluded under s. 24(2) of the Charter. Employers can also gather evidence from company systems, but what they hand over to police, and how, can raise its own legal questions.

What to do now

• Do not access the accounts or systems involved, even to fix the problem, without legal advice.
• Keep copies of any employment contract, policy or message that shows what you were allowed to do with the data.
• Do not contact the employer or former partner about the data directly.
• Write down the timeline of what you did, when and why, while you still remember it.

How we can help

We can review what was actually changed, who had access and whether you were authorized to act. Call (647) 223-1980 for a free consultation.

Frequently asked questions