Businesses rely on confidential information every day, including customer databases, pricing information, supplier details, business strategies and trade secrets. Protecting this information is essential, particularly when employees leave and move to competitors.
Employees have a duty of confidentiality and good faith to their employers, while employers have a legitimate interest in preventing company information from being misused or disclosed without authorisation.
Unauthorised disclosure, copying or use of confidential information can amount to a breach of an employee’s obligations and may expose both the employee and any recipient of that information to legal consequences.
This issue was highlighted in the Federal Court of Australia decision of Show Pony Group Pty Ltd (Showpo) v Black Swallow Boutique & Ors (Black Swallow) (File No. NSD1984/2016), which demonstrates the importance of having effective confidentiality protections, cybersecurity processes and employee exit procedures in place.
Protecting Confidential Information in the Workplace
Confidential information can take many forms, including:
- customer and client databases;
- supplier and contractor information;
- pricing and financial information;
- business strategies and marketing plans;
- trade secrets and commercially sensitive documents; and
- internal systems, processes and intellectual property.
While employees generally owe obligations of confidentiality as part of the employment relationship, businesses should not rely solely on these implied duties. Clear employment contracts, workplace policies and security procedures can help reduce the risk of confidential information being misused.
Case Study: Showpo v Black Swallow Boutique
Show Pony Group Pty Ltd (Showpo) v Black Swallow Boutique & Ors involved a dispute between two online fashion retailers operating in similar markets.
Showpo alleged that a former employee downloaded confidential business information shortly before resigning and provided it to her new employer, Black Swallow Boutique.
The information allegedly taken included approximately 306,000 contacts, including:
- customer mailing lists;
- subscribers;
- competition entrants; and
- supplier contacts.
After discovering that Black Swallow had allegedly used the database as part of its marketing activities, Showpo commenced proceedings in the Federal Court of Australia.
Showpo first sought an urgent injunction, which is a Court order preventing a party from using or disclosing information while the dispute is being determined. This type of urgent action can be important where the misuse of confidential information could cause ongoing commercial harm.
The matter was ultimately resolved through mediation. By consent, the Court ordered that Black Swallow, its chief executive and Showpo’s former employee be permanently restrained from using or disclosing the customer contact information or any information derived from it. Compensation of $60,000 was also paid to Showpo.
How Businesses Can Protect Confidential Information
Businesses should take proactive steps to protect sensitive information and reduce the risk of unauthorised access, particularly when employees have access to valuable commercial data.
Review Online Security and Data Management Processes
Cybersecurity risks are not limited to external threats. Confidential information breaches can also occur internally, including through employees accessing, copying or sharing information without permission.
Businesses should consider:
- working with IT professionals to review security systems, backups and data storage practices;
- limiting access to confidential information only to employees who require it for their role;
- maintaining records of who has access to sensitive information;
- training employees about cybersecurity risks, scams and unauthorised access attempts;
- requiring employees to report suspicious activity immediately;
- implementing strong password requirements and regular password updates;
- avoiding shared passwords or using the same password across multiple systems; and
- removing access to business systems immediately when an employee leaves the business.
Businesses should also consider whether an employee’s access should be restricted before their final day of employment where there is a concern that confidential information may be misused.
Use Employment Contracts and Workplace Policies
Although employees have confidentiality obligations arising from the employment relationship, these obligations should also be clearly documented in written employment agreements.
Employment contracts should address:
- the employee’s obligations regarding confidential information;
- how company information can be accessed and used;
- ownership of business documents and intellectual property; and
- the employee’s obligations after leaving the business.
Workplace policies and codes of conduct should also clearly explain expectations regarding:
- computer and technology use;
- handling confidential information;
- data security; and
- acceptable workplace behaviour.
Consider Restraint of Trade Clauses
Businesses may also consider including restraint of trade clauses in employment contracts to protect legitimate business interests after an employee leaves.
A restraint of trade clause may seek to prevent an employee from:
- using confidential information after leaving employment;
- soliciting clients or customers; or
- working for certain competitors for a specified period.
However, restraint clauses must be carefully drafted. A restraint that goes beyond what is reasonably necessary to protect a business’s legitimate interests may be unenforceable.
What Can a Business Do If Confidential Information Has Been Misused?
If an employer suspects that an employee or former employee has accessed or disclosed confidential information without permission, it is important to obtain legal advice promptly.
Depending on the circumstances, legal options may include seeking:
- an urgent injunction preventing further use or disclosure of the information;
- orders requiring confidential information to be returned or destroyed;
- compensation for losses suffered as a result of the breach;
- damages for breach of contract or other legal rights; and
- recovery of legal costs.
Taking early action can be critical because confidential information may lose its commercial value if it is widely disclosed or used by competitors.
Conclusion
Confidential information breaches can have significant consequences for businesses, particularly where customer databases, trade secrets or commercially valuable information are involved.
Employers can reduce these risks by implementing strong cybersecurity practices, using carefully drafted employment agreements, maintaining clear workplace policies and acting quickly when confidential information may have been misused.
If you are concerned about an employee misusing confidential information or require assistance preparing employment agreements and workplace policies, obtaining advice from an experienced employment lawyer can help protect your business interests.
Contact our team for advice regarding confidentiality obligations, employment contracts and protecting your business information.