• News
• News Archive
• Media Contact

Guard your data from departing employees

By Dean Kilpatrick, Associate, & Josie Toop, Solicitor

First published in The Press 12 January 2009

You don’t usually expect your things to disappear out the door if you break up with your partner. But if the split is acrimonious, you might be more wary.

The same could be said for the end of an employment relationship. You wouldn’t expect employees to take your confidential information when they leave, but unfortunately some do - particularly where the relationship has turned sour.

For a number of businesses, this can be the unfortunate reality of a staff member leaving. Files mysteriously get lost, computer contents, product, pricing and client lists are copied, and data gets emailed to the employee’s personal email address.

The impact on the employer can be disastrous. More than one business has been detrimentally affected, even to the point of closure, by an employee making off with information and using it against them to gain a competitive advantage for their new employer or their own start up business.

Some ways to combat this pervasive problem include setting out expectations at the start of employment, monitoring access to information as you go and tailoring exit arrangements at the end of the employment - with the problem in mind.

The best tool, as always, is prevention. At the outset of the employment, make sure the employment agreement contains protections like a confidentiality provision. Confidentiality is an implied term of the employment relationship; the law imposes an obligation on the employee not to use or disclose your information. In general also, the more senior the employee, the more you can expect from them. However, your position will be strengthened by strong statements of what information is confidential, and how it can be dealt with.  An intellectual property provision is also a good idea.

A restraint of trade provision, including non-solicitation of clients and non-solicitation of employees for a period after the employment terminates, is also a very good idea. Employees can challenge the reasonableness of these provisions, so they should restrain only to the extent required to protect your business.

A ‘garden leave’ clause can be helpful if you want to remove the employee from the workplace for their notice period. Be aware that if you exercise this you will need to pay them during this time.

Implement computer policies that make it clear that computer use will be monitored. Consider prohibiting use of USB drives or other data storing equipment on your system. Even limiting downloads from the system onto emails, unless they have prior approval, is a possibility.

While employees are working, only give them access to the information they require to carry out their job. Make clear the purposes for which the information can be used. Crack down on any instances of the employee taking or emailing confidential information home; even “to work on.” Monitor computer use.

As the employment relationship is coming to an end, assess whether the employee presents a risk. Of course, many employees are honest and would never dream of stealing your information, so you need to weigh up matters on a case by case basis.

If you are suspicious, consider placing the employee on garden leave. Reiterate that confidential information or intellectual property should not be removed from the workplace. Look at their recent computer history. Get in a computer forensic expert to check what the employee has been up to. Inform the employee that you expect them to abide by their post employment obligations such as maintaining confidentiality and any restraint obligations. 

You might also want to minimise the risk of clients potentially going with the departing employee to the new business. One way to tackle this would be to email the clients that the employee has been dealing with, informing them of the employee’s departure and informing them who they will be dealing with from the company in future. A coffee or a lunch with that client and their new ‘go-to,’ so they put a face to the name, may also be helpful.

If the employee is taking your information take action without delay. It is usually a good idea to take legal advice. Steps available include seeking undertakings from the employee that they will not use your information, or legal remedies from the courts like search and seizure orders, injunctions restraining the employee from using your information, and if they already have, money to you for losses caused. You may even be able to take action against the new employer if they have induced the employee to take your information

• .Disclaimer: the content of this article is general in nature and not intended as a substitute for specific professional advice on any matter and should not be relied upon for that purpose.