UK: What Can Be Done if an Employee Steals Confidential Information?

Unlawful removal of confidential information can have serious consequences for a business in the U.K., including significant financial loss and reputational damage. When a senior employee removes confidential information and resigns to join a competitor, this is of even more concern. Here are key steps a business should take in such situations:

• Investigate: Investigations should be started early as they can be complex and time-intensive because of the large amounts of data involved or due to difficulties with getting access to relevant devices. Choose a team of trusted people to carry out the investigation to avoid tipping off potential co-conspirators. When reviewing large amounts of data, carry out a data protection impact assessment.
• Consider other potential wrongdoing: Theft of confidential information may be part of a bigger problem, so don’t make the focus of the investigation too narrow. Other unlawful conduct often also happens and the employee may not be acting alone. For example, the employee may have been soliciting clients and/or staff, or evidence of a team move may come to light.
• Stabilize the business: To prevent any further damage to the business, inform relevant senior leaders of the confidential information that has been taken and what the consequences could be for the business and the relevant stakeholders. Business leaders should have early conversations with senior people who are in a position of trust. Consider what actions are needed to stabilize the business, such as suspending or limiting staff access to systems and placing employees on garden leave if they have not already left employment.
• Secure the confidential information: Problem employees still owe continuing obligations to their employers. These obligations include a mix of express and implied duties and in some cases include restrictive covenants and fiduciary duties. If the employee has already left the business, to secure the confidential information and flush out instances of wrongdoing, remind that person of their continuing obligations and demand the return of all confidential information. It may also be appropriate to request certain undertakings at this stage too. Carefully consider, however, whether putting the person on notice of the findings will cause further harm to the business: will the individual destroy or tamper with the evidence? If so, consider other options instead such as applying to the court for relief and protection without giving the person notice of the application.
• Put the new employer on notice: If an employee has resigned to go to a competitor, it is important to ensure that they are made aware of the employee’s obligations to their current employer and their wrongdoing. Businesses may also want to require a set of undertakings from the competitor, putting them under pressure to confirm that they will not act unlawfully or induce breaches of contract.
• Engage external counsel and other advisers: Consider what outside support may be needed, such as forensic services providers, external lawyers and PR advisers. Engaging advisers at an early stage will help ensure the business has the best possible protection.

The remedies in this context include:

• Court injunctions: In certain circumstances the court may grant an injunction, either on an interim or final basis. Appropriate injunctions include: immediate delivery up of the confidential information, an imaging order to copy the information held on electronic devices (which could include personal phones and laptops and personal email accounts), search orders (allowing entry and search of premises to seize evidence), freezing orders (to freeze assets) or springboard relief (used to tackle any head start gained).
• Financial remedies: Another option is a claim for damages to put the business in the position it would have been in had it not been for the breach. In certain less common situations, the company may have a claim for an account of profits.
• Criminal liability: The employee’s actions may also amount to a criminal offense, for example under data protection law or the Computer Misuse Act 1990. While financial remedies and securing stolen data is not the focus of criminal actions in the same way as civil actions, the threat of criminal liability may persuade the employee to take matters seriously.

Jessica Ambrose is an attorney with Mishcon de Reya in London. © 2024 Mishcon de Reya. All rights reserved. Reposted with permission of Lexology.