Confidentiality can be vital for maintaining business and contacts, and in some industries is more crucial than in others. It’s likely that your employees deal with sensitive information on a daily basis, sometimes accessing data that is critical to your business. So it’s prudent to have a good understanding of how to react and what the implications are under employment law where confidential information is concerned. If you encounter an employee’s breach of confidentiality the below should assist you in knowing how to deal with the situation and prevent breaches of confidentiality in the future.
Jump to:
What constitutes an employee breach of confidentiality?
There are both express and implied confidentiality obligations an employee may have during and after their employment. And a breach of any of these could amount to a breach of confidentiality.
Enforceable confidentiality restrictions are in place to prevent an employee (or other individual working within your business) from using private information that they gather whilst working for you, in a way that could damage your business.
The type of confidential information which is critical to your business and might be included in confidentiality restrictions are information relating to:
- Trade secrets - such as how particular processes are performed or confidential formulas, for example. This information is protected during and after employment and is not limited by time. The obligation is implied into every employment contract, meaning there does not need to be a confidentiality clause in an employee’s contract for this information to be protected.
- Confidential information – this is information such as sensitive financial information, which is protected because it is obviously confidential and should remain so, or an employee has explicitly been advised not to disclose it.
- Employee skill or knowledge – this is information that the employee has learned and allows them to do their job. Some of this knowledge may be protected if it is specific to their time with your business, but if it is knowledge which the employee already had when it joined your business or is common knowledge in the industry or in the particular role held by the employee, it is unlikely that this information would be protected.
If there is disclosure of the protected confidential information by an employee, then a claim for breach of confidentiality in an employment contract may be possible. If information is already in the public domain, it is not confidential and so disclosure of this information would not be a breach of confidentiality.
What steps should I take to deal with an employee breach of confidentiality?
If you believe that there has been a breach of confidentiality, the first step is usually to fully identify and evidence this. You will then usually want to confront the employee about this, explaining that you are aware of a breach, specifically what the breach is and what the consequences of that breach are. It is advisable to do this is writing so that they are formally put on notice from that point of the claim you are making against them.
It is a good idea to then seek a signed undertaking from the offending employee to confirm that they will cease breaching the confidentiality restriction and not repeat it or breach any other confidentiality or other employment obligation. If the employee has left your business and is now a former employee, and there is no express contractual term (or if the term is inadequate) you can seek to impose a better-drafted restriction. However, there may be little incentive on the ex-employee to agree to anything more onerous than the original contractual restriction(s).
If you are a former employer of an employee who has breached confidentiality owed to your business, you may also wish to consider seeking an undertaking from the employee’s new employer, or any other third party you believe has access to the confidential information as a result of the employee passing this on. Any third party in this position may be ordered by a court not to use the information and the new employer is made aware that you are pursuing the employee in respect of their breach of confidentiality. This should mean that the new employer stops the employee from using the confidential information, but if it does not, this at least gives you the option of pursuing the new employer for inducing the employee to breach their contractual obligations to your business by encouraging the employee or failing to prevent them from using the confidential information. The new employer is likely to have deeper pockets than your former employee, should you require compensating for the breach of confidentiality.
If the employee refuses to sign the undertaking or has caused significant damage to your business, it is advisable for employers to seek legal advice to see what other options you may have to prevent further use of your business’ confidential information.
Our employment solicitors can help guide you as to whether issuing proceedings, seeking an injunction and/or damages are most appropriate in your circumstances and guide you through the relevant processes stage by stage
What preventative measures can I take to make sure my business is protected from breaches of confidentiality in the future?
There are some measures which can be taken to avoid breaches of confidentiality by employees, such as including an express duty of confidentiality, as opposed to just the implied duties of confidentiality and good faith in every contract of employment. This would clearly set out the employee’s obligations in respect of confidential information and consequences of breaching confidentiality, at the beginning of the employment relationship, so that both parties know where they stand and the employee can ask any questions to clarify anything before they have access to your business’ confidential information.
Another way in which employers often choose to protect themselves from breaches of confidentiality are through restrictive covenants. These prevent former employees from competing with your business or dealing with some of your business contacts for a reasonable period after leaving your employment, in a reasonable geographical area, to protect your legitimate business interests. Provided that they are reasonable they are enforceable. For more information about restrictive covenants, see our article.
There are other steps which can be taken so that an employer ensures they are making clear which information is confidential. The extent to which the employer makes clear that information was considered confidential is critical. Therefore, any actions which demonstrate the employer has made clear to employees what constitutes confidential information and anything which can show that their employees understand this, is helpful to the employer’s cause in later enforcement.
Some things which may assist with this are:
- Ensure that some of the most sensitive confidential information is only shared with staff that are required to know this to perform their jobs and this information is not circulated more widely. It is important to tread a careful balance here, so that some staff members do not feel excluded or that they are not trusted, but so that the number of people with this sensitive information is minimised.
- Confidential information should be clearly marked as such whether on the front of documents, tops of emails or otherwise.
- A colour coding system with different documents printed on different colour paper depending on the level of confidentiality attached to the document.
- Where possible, keep the data secure whether by way of password protection if electronically stored, or locked away, if it is stored manually.
- Properly monitor employee access to data and company electronic devices, whilst ensuring no breaches of the GDPR or right to employee privacy and train staff effectively and regularly on the GDPR. Here are more details on the requirements for GDPR training of your staff.
- There should be a clear reporting procedure for breaches or potential breaches of confidential information and effective confidentiality agreements which are specific and appropriate to the staff members and their specific access to confidential information.
If you would like further assistance with drafting documents and clauses relating to protection of company confidential information, please contact our specialist employment solicitors.
You should ensure that there is effective communication within the business and that you are aware of the working habits of your employees so that you can easier identify if anything appears untoward about their behaviour. For example, if an employee suddenly starts requesting secretaries to collect certain information without an obvious business reason, excessive use of telephones or photocopiers or working after hours could indicate something to be suspicious of.
