Data theft - what are employers options and risks?

Employee data theft

Data theft involves unauthorised copying, downloading or removal of personal data or confidential business information from a company's computer systems or electronic devices.

Data theft can occur where employees or consultants are preparing to join a competitor, establish their own business or misuse information for other reasons. External attackers may also target valuable business data.

Research suggests that the risk of data theft may increase as employees approach departure. Some departing employees mistakenly believe that taking company information is acceptable because others do so, or because they regard the data or intellectual property as their own. Others seek to use customer databases, commercial information or technical know-how to demonstrate their value to a new employer. In some cases, the motive may be retaliation against a former employer.

See also our insight about employee's post employment duties with confidential information.

Data theft by company directors

Data theft is not confined to employees. We advise on shareholder disputes involving allegations of misappropriation of company assets and information, including cases where director-shareholders treat company data as their own. Such conduct may involve breaches of fiduciary duties, contractual obligations or, in some circumstances, fraud.

Remote working and the use of personal devices can increase the risk of unauthorised data transfers. Where a competitor is using stolen information, prompt legal advice may help prevent further misuse and limit commercial damage. An injunction may be appropriate in certain circumstances.

What data do employees and consultants unlawfully use?

Common targets include:

• Customer lists and databases
• Pricing structures
• Financial information
• Company secrets and confidential information
• Company policies and employee information
• Operating processes and strategic plans
• Software source code

How do employees remove or use business data?

Common methods include:

• Transferring files to USB drives, mobile phones or other removable devices
• Emailing information to personal accounts
• Uploading files to cloud storage services
• Printing or photocopying confidential material

Investigating and obtaining evidence of employee data theft

Reliable evidence is essential before deciding whether to take legal action. System records may reveal unauthorised downloads or transfers, but evidence can be lost or altered through further device use. Digital forensic specialists may therefore need to establish what happened, when and how.

Investigations must be lawful and proportionate. Employers should review relevant contracts, IT policies and privacy notices, and consider their data protection obligations before accessing devices or personal information. Independent forensic experts and legal advice can help preserve evidence appropriately.

Legal action for data theft or unlawful use of confidential data

A business may pursue claims for breach of confidentiality obligations or restrictive covenants. Data theft may also amount to gross misconduct, although the employee may already have left.

Depending on the circumstances, criminal offences under the Data Protection Act 2018 or Computer Misuse Act 1990 may also be relevant. Any threat of legal or criminal action should be evidence-based and carefully considered.

Where appropriate, garden leave may help reduce the risk of misuse during an employee’s notice period.

Disciplinary action and possibly dismissal of the employee

If the employee remains employed, disciplinary action may be appropriate. Any investigation, suspension and dismissal must follow a fair and proportionate process. Even where there is evidence of misconduct, procedural failings may expose the employer to an unfair dismissal claim.

 Undertakings

A formal legal letter may lead to undertakings designed to prevent further misuse. These may require the individual to:

• Stop using or disclosing confidential information
• Return specified material or comply with appropriate deletion requirements
• Preserve relevant evidence
• Pay damages or an account of profits where legally justified

Applying for an injunction

Where the legal requirements are met, court orders may be available to prevent further misuse or preserve evidence. These may include:

• Forensic inspection orders – allowing specified devices or systems to be examined
• Search orders – permitting a court-supervised search for evidence
• Delivery-up orders – requiring specified documents or items to be returned

Is there a criminal case?

Depending on the facts, potential remedies may arise under:

• Data Protection legislation
• Computer Misuse Act 1990

Employee liability under the Data Protection Act

Certain conduct involving the unlawful obtaining, disclosure or retention of personal data may constitute a criminal offence under the Data Protection Act 2018. The ICO can investigate and prosecute certain offences.

Before reporting suspected wrongdoing, businesses should also consider their own data protection obligations, including data security and any applicable breach-reporting requirements.

Contact Us for advice and assistance

Data theft disputes can be costly, particularly where former employees argue that the information they use represents general skills and experience rather than confidential business information. Evidence of copying or downloading may be relevant, but the circumstances and nature of the information must also be considered.

If you suspect an employee, former employee, consultant or director has taken or misused company data, contact us to discuss how best to protect your business.