Preventing data breaches by departing employees

Gwendoline Davies outlines what steps businesses can take to protect confidential information when staff leave

Employers across the country are cutting tens of thousands of jobs as the pandemic continues to hit the economy. The furlough scheme has slowed the number of redundancies, but UK unemployment is expected to reach 2.6 million by mid-2021, equating to 7.5 per cent of the working population.

With most office workers now working from home, confidentiality and information security have become key considerations for HR professionals. But how do you ensure that a departing employee is not taking confidential information with them?

To guard against the consequences of a breach of confidentiality or restrictive covenant, it is essential that post-termination restrictions are employee appropriate, properly drafted and legally enforceable. While specialist advice may be required on a case-by-case basis, there are general considerations that are worth remembering when it comes to the drafting and enforcement of restrictive covenants and confidentiality obligations.

Drafting restrictive covenants 

It is important to keep your restrictive covenants short and distinct, as they are more likely to be treated as severable in the event that one is unenforceable. Employers should also avoid blanket covenants where possible, as it could result in the covenant being unenforceable. 

Post-termination restrictions should always be specific to the particular role and level of seniority of the employee, and employers should regularly review or update covenants to ensure they reflect any potential changes in the law or promotions of the employee. 

Employers should also avoid using multiple covenants across multiple documents. If there are different sets of covenants applying to the same employee, there is the risk that a court will only enforce the less restrictive set. 

When introducing new covenants, it is crucial that evidence of the employee’s agreement to them is retained. Additionally, it is worth considering imposing an obligation on the employee to inform any new employer of any restrictive covenants you have in place, and ensuring the departing employee provides a copy to their new employer.

Finally, always remember to keep your part in the employment contract, as any breaches can undermine the ability to enforce restrictive covenants against an ex-employee. 

Enforcing restrictive covenants

When it comes to the enforcement of post-termination restrictions, there are a few criteria that all employers should be aware of. First, remind any departing employees of the restrictive covenants and of the obligation to notify any new employer of the restrictive covenants. 

If you suspect that an individual may have breached the restriction or potentially abused confidential information, employers should conduct an investigation as quickly as possible to mitigate any damage and avoid losing any evidence of the breach. This may also need to include forensic document retention/collection and IT analysis, while ensuring you comply with data protection/privacy laws. 

During the investigation, consider what damage may have been done as result of the breach and collate as much evidence as you can. At this point, it may be worth taking urgent specialist advice – a specialist can ensure that the employer’s overall position remains protected (and in particular that legal privilege applies) from the outset of any investigation. It is important to document all associated costs with the investigation including management time spent. 

If you are not considering a without notice injunction, send a pre-action letter to the relevant employee. This is a necessary legal step before matters can be escalated via litigation, but it also sets out the case that the employee has to answer.

Finally, do not delay – apart from the likelihood of additional damage being caused, the longer an employee continues to breach their restrictive covenants and/or use confidential information belonging to the company, the more significantly they will undermine an employer’s ability to obtain an injunction and increase the risk of loss and damage. 

Gwendoline Davies is partner and head of commercial dispute resolution at Walker Morris