How to respond to data theft in the workplace

Data theft, the unauthorised copying or removal of sensitive information from company systems, has become a significant concern for businesses of all types and sizes. This threat can originate from many sources, with internal threats from  employees, consultants, directors and even shareholders posing a substantial risk.

Departing employees, especially those planning to join a competitor or start their own business, are particularly vulnerable to temptation. A misguided sense of ownership over company data, coupled with the belief that such actions are commonplace, can lead to serious breaches.

The prevalence of flexible and remote work arrangements further exacerbates this risk, as employees may store sensitive information on personal devices, making it easier to misuse or steal.

Common types of data theft in the workplace

• Customer databases and contact details - Including client lists, contact information, purchase history, preferences, and any CRM data that provides competitive advantage. This often forms the most valuable target for departing employees.

• Financial information and trade secrets - Internal financial reports, profit margins, pricing strategies, supplier agreements, and proprietary business methods that give the company its competitive edge.

• Business strategies and plans - future business plans, marketing strategies, expansion plans, merger discussions, and other strategic information that could benefit competitors if disclosed.

• Product designs and specifications - technical drawings, design documents, manufacturing processes, and product specifications that represent significant research and development investment.

• Source code and technical information - proprietary software code, algorithms, technical solutions, and development documentation that forms part of the company's intellectual property.

• Client lists and pricing information - detailed information about client relationships, including negotiated rates, contract terms, and specific service arrangements that could be used to target clients.

Legal action employers can take

In cases of data theft, businesses may pursue legal action, such as :-

• Disciplinary action or dismissal - for current employees, disciplinary measures, including termination, may be appropriate.

• Injunctions - court orders can be obtained to prevent further misuse of data and compel the return of stolen information. Orders obtained may include orders preventing use or disclosure of stolen data, court-supervised searches of premises to locate and preserve stolen data and relevant devices or orders requiring surrender of devices and documents containing stolen data.

• Civil litigation - lawsuits may be filed to recover damages and seek other remedies.

• Criminal prosecution including private prosecution - law enforcement may pursue criminal charges against the perpetrator whether a prosecution under the Computer Misuse Act, Data Protection Act criminal offences or Theft Act offences.

Our experience and how we can help

We offer a comprehensive range of legal services to assist businesses affected by data theft :-

• Investigation and evidence gathering – understanding the legal rules and risks of obtaining evidence is vital before you start investigating. Getting it wrong can mean any evidence is inadmissible at court and you may even be breaching employment law or data and privacy laws. Evidence may be found in emails, downloads, or other digital footprints. We work with forensic experts to recover deleted or encrypted data.

• Mitigating risk and damage - including ensuring clients comply with any data breach notification requirements.

• Legal action and dispute resolution – we represent clients pursuing legal action against individuals or organisations responsible for the data theft in court proceedings. We also negotiate settlements or pursue litigation to recover damages and losses and liaise with the police about possible criminal law action.

• Preventing future data theft and mitigation data related legal risk - legal advice and services include ensuring you have robust employment contracts, enforceable terms protecting confidential information during and after employment, clarity on what is protected information and usage restrictions and specific post-termination restrictions.