What can a business do if an employee steals its confidential information?

Unlawful removal of confidential information can have serious consequences for a business, including significant financial loss and reputational damage. Where a senior employee removes confidential information and resigns to join a competitor, this is of even more concern.  Below, we set out the key steps a business should take in such situations and consider some of the possible remedies that can be obtained.

1. Investigate: Investigations should be started early as they can be complex and time intensive because of the large amounts of data involved or due to difficulties with getting access to relevant devices. Choose a team of trusted people to carry out the investigation to avoid tipping off potential co-conspirators. When reviewing large amounts of data, carry out a data protection impact assessment.  
2. Consider other potential wrongdoing: Theft of confidential information may be part of a bigger problem, so don't make the focus of the investigation too narrow. Other unlawful conduct often also happens, and the employee may not be acting alone. For example, the employee may have been soliciting clients and/or staff, or evidence of a team move may come to light.
3. Stabilise the business: To prevent any further damage to the business, inform relevant senior leaders of the confidential information that has been taken and what the consequences could be for the business and the relevant stakeholders. Business leaders should have early conversations with senior people who are in a position of trust. Consider what action are needed need to take to stabilise the business, such as suspending or limiting staff access to systems and placing employees on garden leave if they have not already left employment.
4. Secure the confidential information: Problem employees still owe continuing obligations to their employers. These obligations include a mix of express and implied duties and in some cases include restrictive covenants and fiduciary duties. If the employee has already left the business, to secure the confidential information and flush out instances of wrongdoing, remind the employee of their continuing obligations and demand the return all confidential information. It may also be appropriate to request certain undertakings from them at this stage too. Carefully consider, however, whether putting the employee on notice of the findings will cause further harm to the business: will the employee destroy or tamper with the evidence? If so, consider other options instead such as applying to the court for relief and protection without giving the employee notice of the application.
5. Put the new employer on notice: If the employee has resigned to go to a competitor, it is important to ensure that they are made aware of the employee's obligations to their current employee and their wrongdoing. Businesses may also want to require a set of undertakings from the competitor, putting them under pressure to confirm that they will not act unlawfully or induce breaches of contract.
6. Engage external counsel and other advisers: Consider what outside support may be needed, such as forensic services providers, external lawyers and PR advisers. Engaging advisers at an early stage will help ensure the business has the best possible protection.

The remedies in this context include:

1. Court injunctions: In certain circumstances the court may grant an injunction, either on an interim or final basis. Appropriate injunctions include: immediate delivery up of the confidential information, an imaging order to copy the information held on electronic devices (which could include personal phones and laptops and personal email accounts) search orders (allowing entry and search of premises to seize evidence), freezing orders (to freeze assets) or springboard relief (used to tackle any head start gained) .
2. Financial remedies: Another option is a claim for damages to put the business in the position it would have been in had it not been for the breach. In certain less common situations, the company may have a claim for an account of profits.
3. Criminal liability: The employee's actions may also amount to a criminal offence, for example under data protection law or the Computer Misuse Act 1990. While financial remedies and securing stolen data is not the focus of criminal actions in the same way as civil actions, the threat of criminal liability may persuade the employee to take matters seriously.

Mishcon's High Court team has extensive and market leading experience advising on some of the most prominent, high value and complex commercial employment disputes. We help employers recover stolen confidential information and trade secrets, prevent the publication, dissemination or use of such information by competitors and former employees, and obtain other appropriate remedies. If you have any questions, contact our experts at mdremploymenthighcourt@mishcon.com.