In this blog post, we look at a recent decision by the UK Court of Appeal and a separate prosecution brought by the Information Commissioner’s Office (“ICO”; the UK data protection authority), which together serve as a cautionary tale for employees and prospective future employers of the risks of civil liability and criminal conviction for confidential information and data theft.

Clear contractual terms and policies, supplemented by training, remain critical tools for employers seeking to deter employees from misappropriating corporate information.  Employers may wish to make use of these examples to underscore the importance of compliance.

Equitable Duty of Confidence

Travel Counsellors Ltd v Trailfinders Ltd [2021] EWCA is an important case that explores the circumstances creating a duty on a new employer to protect confidential information belonging to the previous employer.  An equitable duty of confidence arises if a recipient of information knows or ought to have known that it is confidential.

Several employees left Trailfinders in order to engage with Travel Counsellors Ltd (“TCL”) as franchisees.   They were encouraged to bring customer contacts with them, and accordingly took various steps to access Trailfinders’ proprietary databases in order to compile relevant customer information that they might use for their own benefit, and for the benefit of TCL.

The High Court and the Court of Appeal found that TCL’s senior management would or should have been aware: (i) that the information provided by former Trailfinders employees was likely to have been copied from Trailfinders’ systems; and (ii) that Trailfinders would reasonably have regarded it as confidential.  Nevertheless, TCL did not ask for information about the source of the information, or the extent to which Trailfinders might have sought to protect it.  TCL therefore breached its equitable obligation of confidence to Trailfinders.

Importantly, the Court of Appeal held that knowledge/notice of confidentiality had to be assessed by reference to the actions of a reasonable person in the recipient’s position.  If that person would have made enquiries upon receipt of information that might be confidential, while the defendant recipient made none, an equitable obligation of confidence arises.  It is not always necessary to prove that the defendant recipient deliberately turned a blind eye — depending on the circumstances, the absence of reasonable enquiry may be sufficient to establish liability.  TCL was therefore liable for a breach of the equitable duty of confidence.

The individual employees concerned were also found to be in breach of their contracts of employment and of equitable obligations of confidence to Trailfinders in an earlier decision by the Intellectual Property Enterprise Court.

Unauthorized Access to Personal Data was an Offence under the Computer Misuse Act

The ICO recently published details of its prosecution of a motor industry employee who, during her employment, compiled and transferred road traffic accident data without the authorization of her employer.  The employee sold the personal data to an accident claims management firm which used it to make nuisance calls.

The employee was found to have committed offences under the Computer Misuse Act 1990, section 1 of which refers to causing a computer to perform a function with intent to secure access to any program or data held on that computer.

The employee has been sentenced to eight months of imprisonment, suspended for two years, and must also carry out 100 hours of unpaid work, contribute £1,000 in costs and repay a benefit figure of £25,000.  The director of the accident claims management firm which received the data received a similar sentence after pleading guilty to conspiracy to secure unauthorized access to computer data.

An employee who obtains, retains or discloses personal data without the consent of the data controller (which will often be their employer) may also commit a criminal offence under section 170 of the Data Protection Act 2018 (“DPA”).  Such action may also constitute a reportable data breach under the DPA and the UK General Data Protection Regulation.

The ICO has the power to take action to change the behavior of organizations and individuals that collect, use and keep personal information.  This includes criminal prosecution, non-criminal enforcement and audit.

The UK Supreme Court’s decision in 2020 in the case of Wm Morrison Supermarkets plc v Various Claimants [2020] UKSC 12 confirmed that that an employer cannot be held liable for actions of an employee who commits an illegal act in pursuance of their own independent venture that is unrelated to activities they are authorized to undertake on behalf of their employer.  While this decision will give some comfort to employers, companies nonetheless risk very significant revenue-based fines and claims for compensation by data subjects if personal data is not sufficiently protected by adequate safeguards.

 

Photo of Christopher Walter Christopher Walter

Christopher Walter works with employer clients on domestic and international HR-legal compliance, disputes, and transactional projects. Chris is a former co-chair of the firm’s International Employment practice, and previously served for eight years as Managing Partner of the London office.

Chris’s advisory practice…

Christopher Walter works with employer clients on domestic and international HR-legal compliance, disputes, and transactional projects. Chris is a former co-chair of the firm’s International Employment practice, and previously served for eight years as Managing Partner of the London office.

Chris’s advisory practice encompasses the full range of employment and employee benefits issues that matter to leading multinational employers, including the drafting of share and other incentive plans, global mobility, privacy compliance, employment issues in M&A transactions, outsourcing, workforce integration, and the implementation of core policies/codes of conduct, with a particular focus on business and human rights.

Chris began his legal career as a UK barrister, however, and also has considerable experience as an advocate before UK courts and tribunals, securing confidentiality injunctions and defending employers against claims of unfairness, discrimination and other alleged violations of employment laws.

Chris is recommended by Legal 500 UK for his “exceptional service.” Chambers UK (2015) notes that he is “focused, business-oriented and solution-driven.” Chris has been listed by Who’s Who Legal since 2007 as one of the world’s top employment lawyers.

Chris has served as chair of the International Committee of the Employment Lawyers Association and a member of ELA’s Management Committee. He is also a member of the European Employment Lawyers Association and the Share Plan Lawyers Group.

Chris regularly publishes articles and speaks on employment and data privacy law at both external seminars and in-house client training events.

Photo of Helena Milner-Smith Helena Milner-Smith

Helena Milner-Smith helps companies navigate complex international HR-legal compliance issues.

Helena advises clients across a range of industries on all aspects of UK and international employment law, including the HR aspects of privacy compliance and human rights regulation.

Helena has particular expertise advising…

Helena Milner-Smith helps companies navigate complex international HR-legal compliance issues.

Helena advises clients across a range of industries on all aspects of UK and international employment law, including the HR aspects of privacy compliance and human rights regulation.

Helena has particular expertise advising on the HR-legal aspects of multi-jurisdictional transactions. She also regularly assists clients seeking to protect their business and increase international compliance by designing and implementing global policies, employment contracts and restrictive covenants.

Helena has been recognised by Legal 500 UK for her “exceptional service” and “responsive and practical” advice.

In addition, Helena has gained valuable in-house experience while on secondment at three large multinational corporations – a pharmaceutical company, an oil company and a leading investment bank

Photo of Louise Freeman Louise Freeman

Louise Freeman represents parties in complex commercial disputes, and co-chairs the firm’s Commercial Litigation and European Dispute Resolution Practice Groups.

Described by Legal 500 as “one of London’s most effective partners” and by Chambers as “a class act,” Louise helps clients to navigate…

Louise Freeman represents parties in complex commercial disputes, and co-chairs the firm’s Commercial Litigation and European Dispute Resolution Practice Groups.

Described by Legal 500 as “one of London’s most effective partners” and by Chambers as “a class act,” Louise helps clients to navigate challenging situations in a range of industries, including life sciences, technology and financial markets. Most of her cases involve multiple parties and jurisdictions, where her strategic, dynamic advice is invaluable.

Louise also represents parties in significant competition litigation proceedings, including a number of the leading cases in England.

Louise is a key member of our market-leading Privacy and Data Security Litigation team, which advises a broad range of international clients on data privacy-related litigation. She has recently represented a client in an intervention in an appeal in the leading UK case making new law in relation to both data privacy claims and class actions.

Photo of Dan Cooper Dan Cooper

Daniel Cooper is co-chair of Covington’s Data Privacy and Cyber Security Practice, and advises clients on information technology regulatory and policy issues, particularly data protection, consumer protection, AI, and data security matters. He has over 20 years of experience in the field, representing…

Daniel Cooper is co-chair of Covington’s Data Privacy and Cyber Security Practice, and advises clients on information technology regulatory and policy issues, particularly data protection, consumer protection, AI, and data security matters. He has over 20 years of experience in the field, representing clients in regulatory proceedings before privacy authorities in Europe and counseling them on their global compliance and government affairs strategies. Dan regularly lectures on the topic, and was instrumental in drafting the privacy standards applied in professional sport.

According to Chambers UK, his “level of expertise is second to none, but it’s also equally paired with a keen understanding of our business and direction.” It was noted that “he is very good at calibrating and helping to gauge risk.”

Dan is qualified to practice law in the United States, the United Kingdom, Ireland and Belgium. He has also been appointed to the advisory and expert boards of privacy NGOs and agencies, such as Privacy International and the European security agency, ENISA.

Photo of Mark Young Mark Young

Mark Young, an experienced tech regulatory lawyer, advises major global companies on their most challenging data privacy compliance matters and investigations.

Mark also leads on EMEA cybersecurity matters at the firm. He advises on evolving cyber-related regulations, and helps clients respond to…

Mark Young, an experienced tech regulatory lawyer, advises major global companies on their most challenging data privacy compliance matters and investigations.

Mark also leads on EMEA cybersecurity matters at the firm. He advises on evolving cyber-related regulations, and helps clients respond to incidents, including personal data breaches, IP and trade secret theft, ransomware, insider threats, and state-sponsored attacks.

Mark has been recognized in Chambers UK for several years as “a trusted adviser – practical, results-oriented and an expert in the field;” “fast, thorough and responsive;” “extremely pragmatic in advice on risk;” and having “great insight into the regulators.”

Drawing on over 15 years of experience advising global companies on a variety of tech regulatory matters, Mark specializes in:

  • Advising on potential exposure under GDPR and international data privacy laws in relation to innovative products and services that involve cutting-edge technology (e.g., AI, biometric data, Internet-enabled devices, etc.).
  • Providing practical guidance on novel uses of personal data, responding to individuals exercising rights, and data transfers, including advising on Binding Corporate Rules (BCRs) and compliance challenges following Brexit and Schrems II.
    Helping clients respond to investigations by data protection regulators in the UK, EU and globally, and advising on potential follow-on litigation risks.
  • GDPR and international data privacy compliance for life sciences companies in relation to:
    clinical trials and pharmacovigilance;

    • digital health products and services; and
    • marketing programs.
    • International conflict of law issues relating to white collar investigations and data privacy compliance.
  • Cybersecurity issues, including:
    • best practices to protect business-critical information and comply with national and sector-specific regulation;
      preparing for and responding to cyber-based attacks and internal threats to networks and information, including training for board members;
    • supervising technical investigations; advising on PR, engagement with law enforcement and government agencies, notification obligations and other legal risks; and representing clients before regulators around the world; and
    • advising on emerging regulations, including during the legislative process.
  • Advising clients on risks and potential liabilities in relation to corporate transactions, especially involving companies that process significant volumes of personal data (e.g., in the adtech, digital identity/anti-fraud, and social network sectors.)
  • Providing strategic advice and advocacy on a range of EU technology law reform issues including data privacy, cybersecurity, ecommerce, eID and trust services, and software-related proposals.
  • Representing clients in connection with references to the Court of Justice of the EU.
Photo of Mark Welch Mark Welch

Mark Welch is an associate in the International Employment Practice Group, having joined the firm as a trainee solicitor in 2018. His practice covers a range of both UK and international employment issues including international employment aspects of global transactions, HR-legal compliance issues…

Mark Welch is an associate in the International Employment Practice Group, having joined the firm as a trainee solicitor in 2018. His practice covers a range of both UK and international employment issues including international employment aspects of global transactions, HR-legal compliance issues and contentious employment matters.

Mark also assists clients seeking to protect their business and increase international compliance through the drafting and implementation of employment contracts and internal policies. He has particular experience in relation to whistleblowing matters, both advising clients on whistleblower protections and requirements for compliance purposes and defending clients in contentious matters involving allegations based on protected disclosures.

Mark gained valuable experience while on secondment to a large pharmaceutical client. He is a member of the firm’s Diversity Committee.