Criminal Conviction and Civil Liability in UAE Tech Cases: Insights from a Dubai Court of Cassation Ruling
The fast growth of digital tools and online systems has increased cybercrimes that hurt businesses. These crimes include illegal access to computer systems, stealing or deleting data, hacking emails, ransomware, and digital threats. Such actions can stop operations, damage important business information, and cause big financial losses.
UAE law treats these acts as serious crimes under Federal Decree-Law No. 34 of 2021 on Countering Rumors and Cybercrimes. This law sets strong penalties for unauthorized access, data changes, and system interference. While criminal cases focus on punishment and public interest, affected companies usually want civil compensation to recover their real losses. This creates important questions about evidence and court procedures.
What the Dubai Court of Cassation Decided in Case No. 611 of 2025
In a recent ruling, the Dubai Court of Cassation clarified the link between criminal convictions and civil claims for damages in technology disputes. The court confirmed that a final criminal conviction proves the wrongdoing (fault). However, the company claiming damages must still clearly prove the actual harm caused and the exact amount of money they lost, using solid evidence.
Background of the Case
A company hired the defendant as a computer engineer and programmer to build VAT-related software and other internal systems. They signed an agreement on 22 December 2019. This agreement included rules on keeping information confidential, returning company property, meeting deadlines linked to the defendant’s work permit, protecting intellectual property, and paying penalties for delays or non-delivery.
The company said the defendant caused problems by emptying code storage areas, disabling programs, deleting important emails about the code, and trying to demand money to return the data.
A technical expert reviewed the work and found major shortcomings in completing tasks and providing documents. The defendant was later convicted in a final criminal judgment for unauthorized access to the system and deleting software code and related data without permission.
After the criminal conviction, the company filed a separate civil case asking for compensation for the losses.
Court Decisions at Different Levels
The Court of First Instance awarded the company AED 80,000 plus interest. This covered costs from the criminal complaint, legal fees, and hiring a technical expert. The court rejected claims for broader technical damages because there was not enough proof.
The Court of Appeal agreed with this decision. The company then took the case to the Court of Cassation, arguing that the lower courts ignored the criminal judgment and did not properly consider the expert’s role.
Main Points from the Court of Cassation Ruling
The Court of Cassation rejected the company’s appeal. It explained the three basic requirements for any claim based on wrongdoing (tort liability):
- Fault or illegal act
- Actual harm or damage
- A clear link between the act and the harm (causation)
The court said a final criminal judgment has a strong binding effect (res judicata) on civil courts. It conclusively proves that the illegal act happened, its legal nature, and who did it. This prevents re-arguing those facts.
However, this binding effect does not automatically prove the amount or type of extra civil damages. The claimant (the company) must still provide clear evidence of the specific harm and its value.
The criminal conviction settled the question of fault, but the company needed to prove any additional technical losses and their exact cost. The lower courts correctly relied on the expert report and only awarded amounts supported by proper evidence.
Other Important Clarifications from the Judgment
- Burden of Proof: Damage cannot be assumed just because fault is proven. The claimant must show real losses with concrete details, such as descriptions of deleted programs, their value, and how the interference caused financial harm.
- Role of Experts: Courts can appoint experts and decide how much weight to give their findings.
- Limits of Cassation Review: The Court of Cassation does not re-examine facts or re-weigh evidence if the lower courts gave clear reasons based on the case records.
- Lump-Sum Awards: In suitable cases, courts may award a reasonable overall amount, but only when supported by available evidence.
In this case, the expert found that the company did not provide enough details or proof of technical losses from the deletions or system issues. As a result, the courts limited the award to the proven costs (AED 80,000 plus interest).
Why This Judgment Matters for Businesses
This decision sends a clear message: A criminal conviction helps prove that wrongdoing occurred, but it is not enough by itself for full financial recovery in a civil case. Companies must gather and present strong technical and financial evidence to support their damage claims.
Businesses facing similar tech disputes should:
- Keep detailed records of systems, code, and data.
- Document all costs and losses clearly.
- Work closely with technical experts early.
- Understand that criminal and civil paths are related but separate when it comes to proving money claims.
The Court of Cassation dismissed the appeal and ordered the claimant to pay the costs of the cassation proceedings.
This ruling helps set clearer boundaries between criminal findings and the extra requirements for civil compensation in UAE technology and cyber-related cases. It encourages companies to build strong evidence for their losses beyond simply relying on a criminal outcome.
