An employee forwards sensitive business information to a private environment, what sanctions are possible?

It is relatively easy for most employees to send business information to a private environment, such as to their personal email or cloud storage. The motive may be innocent, for example because the employee wants to work from home but cannot access the online business environment there. But it also happens that an employee has other intentions. Consequences of this information leaving the business environment unauthorized, can be damaging. This article discusses possible measures against the employee.

Instant dismissal

An employee who sent 791 documents from his employer’s server, to his personal Dropbox account, shortly after being told that his fixed-term employment contract would not be renewed, justifiably received an instant dismissal. The employer maintained an IT policy that stated (among other things) that employees should not make copies of the employer’s data, or store the employer’s information in personal locations. According to the court, the retrieval of business-sensitive and confidential information towards the end of an employment contract constitutes an urgent reason for dismissal, especially in view of the employer’s IT policy, known to the employee, and the repeated communication about it. In fact, the employer had recently sent an e-mail to all employees reminding them that they should not take any documents or property belonging to the employer at the end of their contract. This led the court to conclude that the employee was deemed sufficiently familiar with the internal rules prohibiting the transfer of business information to a private environment. The court therefore qualified the employee’s conduct as seriously culpable so that he was not entitled to any transitional compensation.

Tip 1: Maintain a (clear) IT-policy

This ruling confirms the importance of having a clear policy on a specific subject, in this case IT, and repeated communication thereof. Such IT policy can include clear guidelines and procedures on the use and protection of business information. The policy can include (among other things) provisions stating that employees are not allowed to make copies of employer data, take data outside the employer’s online environment, or store employer information in a private environment. It is important that all employees are aware of this policy and understand what is expected of them. This leads to avoiding misunderstandings and unknowing violations. An employer can continue to ‘’feed‘’ employees’ awareness of the policy, for instance by providing training and sending reminders via email.

Penalties for breaching the confidentiality clause

In the same dismissal case, the employer claimed fines for breach of the confidentiality clause. but this claim was unsuccessful since the clause was aimed at preventing business information from reaching third parties. According to case law, transferring business information to a private environment does not automatically entail that this is distributed to third parties. For this reason, the court in ruled that there was no breach of the confidentiality clause and the employee was not liable for any penalties.

Tip 2: Expand the confidentiality clause

Most employment agreements contain a confidentiality clause with an associated penalty clause.  This clause is often aimed at preventing confidential and competition-sensitive business information from reaching third parties. Demonstrating that business information has reached third parties is complex if it can only be proven that an employee has forwarded this information to a private environment/downloaded documents to their laptop. It is possible to formulate a confidentiality clause broader and more extensive to include the transfer of information to a private environment. It is also possible to include company data clauses in the employment agreement. Under this clause, the employee is not allowed to keep company data and business information in their possession and store it in a private environment or otherwise take it outside the employer’s IT environment, without the employer’s prior written consent. In these cases, an employer can also impose the fine linked to the confidentiality/company data clause if a (former) employee does transfer business information to his private environment. Note: whether the clause holds up and whether the employer can therefore invoke this will ultimately depend on the circumstances.

Conclusion

Transferring business information to an employee’s private environment can have serious consequences for both the employer and the employee. By implementing measures such as a clear policy, employers can minimize this risk. Should an employee transfer business information to a private environment despite these measures, various sanctions are possible, depending on the measures taken.

If you are dealing with a situation where an employee has transferred business information to a private environment, and wish to know what steps can be taken, please contact us. We are also happy to support you in drawing up a policy and guidelines on the use and protection of business information.