The Res Judicata effect of Criminal Judgments on Civil Proceedings – A Recent Tech Dispute

5 min 15 sec April 6, 2026 (Edited) الترجمة العربية

Written by

Omar Khodeir

Legal Director

o.khodeir@tamimi.com View LinkedIn Profile

Zane Anani

z.anani@tamimi.com View LinkedIn Profile

The rise of digitalization and connected technologies has brought with it a corresponding surge in cybercrimes that pose significant risks to businesses operating in today’s tech-driven economy. Cybercrimes encompass a broad range of unlawful activities involving electronic tools, computers and networks, including unauthorized access to computer systems, data theft, deletion or manipulation of electronic records, hacking of email systems, ransomware attacks, and digital extortion.  These offences can cause substantial harm to companies — disrupting operations, destroying valuable intellectual property, and compromising sensitive business information.

Under UAE law, such conduct is criminalized under the UAE Cybercrime Law (Federal Decree-Law No. 34 of 2021), which establishes severe penalties for unauthorized access, data interference, and system sabotage. However, while criminal prosecutions address public interest concerns and punish wrongdoers, affected companies often seek civil remedies to recover their actual financial losses. This intersection between criminal liability and civil recovery raises complex evidentiary and procedural questions that courts must navigate carefully.

In a recent Dubai Court of Cassation Judgment (No. 611 of 2025), the court issued a decision that addresses the binding effect of criminal judgments and the evidentiary burden for civil damages in a technology-related dispute. The judgment underscores that while a criminal conviction can conclusively establish fault in civil proceedings, claimants still bear the burden to prove the existence of additional damage and its specific quantum, supported by concrete evidence.

The court also clarified the scope of expert mandates, the limits of intervention in factual determinations, and the permissibility of global lump-sum damages in appropriate circumstances. This article will discuss the significance of this case and examines the court’s key findings.

Factual Background

The claimant company employed the defendant as a computer engineer and programmer, tasking him with developing VAT-related software and other internal systems. The parties subsequently entered into an agreement dated 22 December 2019, which imposed confidentiality obligations, required the return of company property, and established completion deadlines tied to the defendant’s work permit expiry date. The agreement further provided for intellectual property exclusivity, penalties upon non-completion, and liability for damages caused by delay or non-delivery.

The company alleged that the defendant subsequently obstructed its operations, emptied code repositories, disabled programs, accessed the company’s email domain to delete code-related correspondence, and attempted to extort payment in exchange for the return of data.

A technical expert was engaged, who reported significant non-performance on development tasks and failures to deliver technical documentation. The defendant was ultimately convicted in a final criminal judgment for conduct related to unauthorized system access and data deletion.

The defendant in this matter was convicted for intercepting and deleting software code and related electronic data of the claimant company without consent. A final judgment was issued in this criminal case to that effect. Subsequently, the claimant filed a separate civil claim for compensation against the defendant for the damages sustained.

In the ensuing civil proceedings, the Court of First Instance awarded the claimant AED 80,000 plus interest for costs linked to the criminal complaint, legal fees, and the engagement of a technical specialist, while rejecting broader technical-damage claims for lack of proof. The Court of Appeal affirmed this decision, prompting the company to petition for cassation, challenging, among other grounds, the alleged disregard of criminal judgment preclusion and the expert’s scope.

The Cassation Appeal

The claimant challenged the lower court decisions before the Court of Cassation on the basis that the courts had awarded only a limited amount of compensation and disregarded other additional damages resulting from the unauthorized interception of its electronic system. To support this contention, the claimant relied on the criminal judgment’s res judicata effect, which binds the civil courts. Given that a prior criminal conviction had been issued against the defendant for intercepting and deleting the company’s software code and related data, the claimant argued there was no room for the civil courts to revisit whether these acts and related harm had occurred or not.

The Court of Cassation rejected the claimant’s challenge on the basis that it is well established that three elements must be present in tort-based claims: (a) fault or wrongdoing; (b) harm; and (c) causation or causal relationship. The Court held that whilst the criminal judgment’s res judicata effect binds the civil court on the element of fault, it does not bind the civil court in its power to assess the adequate compensation relating to the element of harm. Accordingly, this does not relieve the claimant of its obligation to prove actual, compensable technical harm and its value beyond what the court had determined and assessed. Consequently, the Court found no legal error in the lower courts’ reliance on the court-appointed expert and their decision to award only those losses that were sufficiently substantiated.

Key findings

The Court reaffirmed the doctrine that a final criminal judgment has binding effect in civil proceedings over matters necessarily and conclusively decided—namely, the occurrence of the act, its legal characterization, and attribution to the perpetrator—as a matter of public order preventing re-litigation of settled issues. However, this preclusion does not extend to the existence, nature, or quantification of additional civil damage, which must be independently proven by the claimant. In this case, the criminal conviction bound the civil courts on fault, but the claimant still had to establish the additional actual technical damage and its valuation.

The Court emphasized the classic three pillars of civil liability—fault, damage, and causation—and clarified that damage is an indispensable element that cannot be presumed from fault alone. The claimant bears the burden of proving additional damages that occurred and of quantifying it, and courts are entrusted to evaluate the sufficiency of evidence on these factual issues without cassation interference where reasons are sound and grounded in the record.

On the evidentiary record, the court-appointed expert found that the claimant did not submit adequate proof of technical losses attributable to the alleged deletions or system interference, nor did it provide details of the allegedly deleted programs, their values, or data necessary to compute loss, leading the trial court—whose reasoning the appellate court adopted—to conclude that the additional technical damages were unproven.

Finally, the Court stressed that reweighing evidence, contesting the expert’s persuasiveness, or urging a different inference falls within the realm of factual debate inappropriate for cassation review, thereby justifying dismissal of the petition and the award of costs against the claimant.