In a case led by Harrison Drury’s commercial dispute resolution team, we helped our client retrieve valuable confidential, commercial and personal data taken deliberately from the company by a former employee prior to their resignation.

Most employees are committed and loyal to their employers, but in some cases, an employee seeks to take advantage of the confidential information they have access to.

This may include stealing or copying confidential business data with the intention of using it in future employment or to set up a competitive business, despite it being in breach of their obligations to their employer.

In this case, Harrison Drury was appointed by a company from the logistics and transport sector to help in a matter of suspected misuse of confidential data by an employee.

The warning signs of data misuse

During the course of its regular email monitoring, the IT department of the company became aware of a large volume of email activity from one of its employee’s work email accounts. Over a series of days, the employee sent over 250 emails to a personal email account which cumulatively contained a vast quantity of highly confidential customer, haulier and supplier details and other commercial and personal data.

The confidential information had been built up by the company over several decades of trading and was of significant value and critical importance to the client.

After being challenged by senior personnel and asked to delete the information from their private email account, the employee refused, announced he was leaving and left the premises, in possession of confidential information that belonged to the company. He never returned.

Seeking legal support in cases of data misuse

The company is signed up to Harrison Drury’s dedicated employment and HR support service, HR Compass. The owner of the business contacted our employment law team to take immediate advice on how to deal with the employee’s departure from site, and on ways to retrieve the information taken and minimise the impact on the business.

Immediate advice was given to the employer as to how to best respond to the emerging circumstances. This took the form of real time assistance to enable the company to balance the need to progress and deal with matters swiftly while also acting reasonably.

Our employment law team immediately involved our dispute resolution team to seek the return of the company’s confidential information, using their combined expertise to provide the client with clear guidance and the best route to resolving the complex and dynamic situation.

Since the teams work so closely with one another, the commercial dispute team were effectively briefed by their employment colleagues and had immediate access to all the information they required to provide the speedy assistance which was so necessary for the client.

However, initial requests to return the data were ignored by the former employee, so the client instructed the commercial litigation team to prepare and send “pre-action correspondence” – which is communication sent prior to taking the matter to court. The ex-employee again failed to engage in a timely and satisfactory manner.

Given the lack of engagement by the former employee, if the client wanted to have any chance of retrieving its confidential information, there was no choice but to issue proceedings in the High Court, which included an application for interim and final injunctive relief against the ex-employee. This is a

legal remedy which can be sought from the courts to require a defendant to stop doing, or to compel them to do, something.

During our investigations, our commercial litigation team also identified that information sent by the former employee to a personal email account included some personal employee data. At this stage we involved our specialist regulatory team, with partner David Edwards advising the client regarding its obligations on data protection and the GDPR.

Taking the matter to court

After being served with proceedings, the ex-employee instructed solicitors to represent him and prior to the hearing, sought to negotiate. Although in the hours prior to the hearing broad agreement was reached as to the form of a final order, the matter ultimately came before the High Court.

Our team was able to secure an all-encompassing order for the client which fully dealt with every aspect of the issue. This included an undertaking by the ex-employee that he would allow the imaging and inspection of his electronic devices by a forensic IT expert to ensure the deletion from those devices of all confidential information belonging to the client. The client was also awarded costs which covered a sizeable portion of their legal expenses in bringing the case.

This was an extremely serious breach by the ex-employee of his contract of employment and common law duties. Several individual emails of the more than 250 emails taken contained so much confidential information the ex-employer would have been in a strong position to set up a competing business based on some of the individual emails alone.

The importance of robust employee contracts and policies

In any organisation protecting confidential data, sensitive commercial data and personal data from theft, or other misuse by staff, is complex; there isn’t one easy way to nullify the threat. There are however ways to reduce the risk, and to be in a strong position to deal with the matter quickly and effectively should a theft or misuse occur.

These include:

• Ensure clear and detailed employee contracts and a concise employee handbook are in place; these should clearly detail the employee’s obligations before, during and after employment, including data protection and IT use policies – and ensure employees are made aware of such policies.
• For further protection, in appropriate cases, restrictive covenants could be prepared and included in a contract of employment – but these must be drafted carefully to ensure they have the best chance of being enforceable.
• Provide regular IT training for staff to ensure they understand the obligation, and effective methods, to keep data safe.
• Consider using garden leave for departing employees who you feel may pose a threat, which allows them to be removed from the business for the duration of their notice period (noting that garden leave provisions can be useful in employee contracts).
• Disable or limit access to confidential and commercially sensitive data, and personal data, during an employee’s notice period, and/or otherwise restrict such access to certain individuals only during the currency of such employment.

This list is not exhaustive; our employment law team can provide further advice and help draft the necessary documents and policies to provide you with maximum protection.

A company’s responsibility on data protection

If your organisation collects information about individuals, you need to comply with UK data protection law. In short, personal data means information about a particular living individual. This may include customers, employees, partners, suppliers, business contacts, as well as public officials.

See the Guide to the UK General Data Protection Regulation (UK GDPR) for further details on how to comply with your obligations.

If an organisation has a data breach – which in the case above was due to personal data being taken by an employee – it is important to determine the severity of the breach and whether it is necessary to report to the Information Commissioner’s Office (ICO). Our regulatory and compliance specialist David Edwards and the regulatory team can advise clients on their GDPR and reporting obligations.

Making it possible

In this case, our client found themselves in a highly stressful and challenging situation which posed a significant threat to their business from a number of different perspectives. The team at Harrison Drury delivered urgent advice using the firm’s multi-disciplinary approach to ensure the client received the best possible support to resolve the situation.

By combining advice and support from an experienced multi-disciplinary team of lawyers and advisors, working across employment, commercial litigation, and regulatory law, we were able to bring the matter to a successful conclusion for our client.

We can make it possible for you too. Harrison Drury’s specialist teams are here to help. Call Harrison Drury on 01772 258321.