GENERAL ASSEMBLY OF NORTH CAROLINA
SESSION 2025
H D
HOUSE BILL DRH40322-ML-67
Short Title: Protect Health and Gov't Personnel Info. (Public)
Sponsors: Representative Rubin.
Referred to:
*DRH40322 -ML-67*
A BILL TO BE ENTITLED 1
AN ACT TO PROVIDE ADDITIONAL PROTECTIONS FOR PR OTECTED HEALTH 2
INFORMATION AND GOVERNMENT EMPLOYEE PERSONNEL INFORMATION. 3
Whereas, people throughout North Carolina provide sensitive health information to 4
their doctors, hospitals, and other health care providers, and they often provide sensitive health 5
information as part of key government programs like Medicare and Medicaid; and 6
Whereas, federal, State, and local government employees are frequently required to 7
provide sensitive personal information to the government as part of their hiring and employment, 8
and this sensitive information is entrusted to the government to care for in accordance with strict 9
procedures; and 10
Whereas, unauthorized copying of these sensitive forms of data can lead to lasting 11
injury to those affected; and 12
Whereas, North Carolina's Computer Trespass offense criminalizes unauthorized 13
copying of computer data but lacks an automatic minimum amount of damages for 14
misappropriation of protected health information or government personnel files; Now, therefore, 15
The General Assembly of North Carolina enacts: 16
SECTION 1. G.S. 14-458 reads as rewritten: 17
"§ 14-458. Computer trespass; penalty. 18
(a) Except as otherwise made unlawful by this Article, it shall be unlawful for any person 19
to use a computer or computer network without authority and with the intent to do any of the 20
following: 21
(1) Temporarily or permanently remove, halt, or otherwise disable any computer 22
data, computer programs, or computer software from a computer or computer 23
network. 24
(2) Cause a computer to malfunction, regardless of how long the malfunction 25
persists. 26
(3) Alter or erase any computer data, computer programs, or computer software. 27
(4) Cause physical injury to the property of another. 28
(5) Make or cause to be made an unauthorized copy, in any form, including, but 29
not limited to, any printed or electronic form of computer data, computer 30
programs, or computer software residing in, communicated by, or produced 31
by a computer or computer network. 32
(6) Falsely identify with the intent to deceive or defraud the recipient or forge 33
commercial electronic mail transmission information or other routing 34
information in any manner in connection with the transmission of unsolicited 35
H.B. 608
Mar 31, 2025
HOUSE PRINCIPAL CLERK General Assembly Of North Carolina Session 2025
Page 2 DRH40322-ML-67
bulk commercial electronic mail through or into the computer network of an 1
electronic mail service provider or its subscribers. 2
For purposes of this subsection, a person is "without authority" when (i) the person has no 3
right or permission of the owner to use a computer, or the person uses a computer in a manner 4
exceeding the right or permission, or (ii) the person uses a computer or computer network, or the 5
computer services of an electronic mail service provider to transmit unsolicited bulk commercial 6
electronic mail in contravention of the authority granted by or in violation of the policies set by 7
the electronic mail service provider.provider, or (iii) in the case of computer data that is in a 8
personnel file of a local, State, or federal government employee, the person has no authority 9
under local, State, or federal law to view or otherwise access that information or has willfully 10
failed to follow the requirements of the local, State, or federal law granting such authority. For 11
purposes of this subsection, the term "personnel file" is as defined in G.S. 1-539.2A. 12
(b) Any person who violates this section shall be guilty of computer trespass, which 13
offense shall be punishable as a Class 3 misdemeanor. If there is damage to the property of 14
another and the damage is valued at less than two thousand five hundred dollars ($2,500) caused 15
by the person's act in violation of this section, the offense shall be punished as a Class 1 16
misdemeanor. If there is damage to the property of another valued at two thousand five hundred 17
dollars ($2,500) or more caused by the person's act in violation of this section, the offense shall 18
be punished as a Class I felony. 19
(c) Any person whose property or person is injured by reason of a violation of this section 20
may sue for and recover any damages sustained and the costs of the suit pursuant to 21
G.S. 1-539.2A. 22
(d) It is not a violation of this section for a person to act pursuant to Chapter 36F of the 23
General Statutes." 24
SECTION 2. G.S. 1-539.2A reads as rewritten: 25
"§ 1-539.2A. Damages for computer trespass. 26
(a) Any person whose property or person is injured by reason of a violation of 27
G.S. 14-458 may sue for and recover any damages sustained and the costs of the suit. Without 28
limiting the general of the term, "damages" shall include loss of profits. If the injury arises from 29
the transmission of unsolicited bulk commercial electronic mail, the injured person, other than 30
an electronic mail service provider, may also recover attorneys' fees and may elect, in lieu of 31
actual damages, to recover the lesser of ten dollars ($10.00) for each and every unsolicited bulk 32
commercial electronic mail message transmitted in violation of this section, or twenty-five 33
thousand dollars ($25,000) per day. The injured person shall not have a cause of action against 34
the electronic mail service provider which merely transmits the unsolicited bulk commercial 35
electronic mail over its computer network. If the injury arises from the transmission of unsolicited 36
bulk commercial electronic mail, an injured electronic mail service provider may also recover 37
attorneys' fees and costs and may elect, in lieu of actual damages, to recover the greater of ten 38
dollars ($10.00) for each and every unsolicited bulk commercial electronic mail message 39
transmitted in violation of this section, or twenty-five thousand dollars ($25,000) per day. 40
(a1) If the injury arises from a violation of G.S. 14-458 involving trespass to computer 41
data that is protected health information, the injured person may sue and recover for each 42
violation the greater of the damages sustained or five thousand dollars ($5,000) and the costs of 43
the suit. 44
(a2) If the injury arises from a violation of G.S. 14-458 involving trespass to computer 45
data that is in the personnel file of a local, State, or federal employee, the injured person may sue 46
and recover for each violation the greater of the damages sustained or five thousand dollars 47
($5,000) and the costs of the suit. 48
(b) A civil action under this section shall be commenced before expiration of the time 49
period prescribed in G.S. 1-54. In actions alleging injury arising from the transmission of 50 General Assembly Of North Carolina Session 2025
DRH40322-ML-67 Page 3
unsolicited bulk commercial electronic mail, personal jurisdiction may be exercised pursuant to 1
G.S. 1-75.4. 2
(c) The following definitions apply in this section: 3
(1) Damages. – Includes loss of profits. 4
(2) Personnel file. – Any employment-related or personal information gathered 5
by an employer about its employee. Employment-related information includes 6
information related to an individual's application, selection, promotion, 7
demotion, transfer, leave, salary, contract for employment, benefits, 8
suspension, performance evaluation, disciplinary actions, and termination. 9
Personal information includes an individual's home address, social security 10
number, medical history, personal financial data, marital status, dependents, 11
and beneficiaries. 12
(3) Protected health information. – As defined in 45 C.F.R. § 160.103." 13
SECTION 3. This act becomes effective July 1, 2025, and applies to offenses 14
committed on or after that date. 15