Legal Options If Employees Breach Confidentiality in Singapore

If an employee leaks confidential information from your business, the legal and operational implications are potentially serious. In this article we will discuss:

• What is confidential information
• When breaches of confidentiality might occur
• The potential consequences of a breach of confidentiality
• How to prevent breaches of confidentiality by employees
• What employers can do if employees have breached confidentiality
• How a lawyer can help you prevent breaches of confidentiality, or address breaches that have already occurred

What is Confidential Information?

Confidential information generally refers to any information pertaining to a business that is not publicly available. It may include passwords, emails relating to the business, trade secrets, personal data of individuals and third-parties, pricing information and client information.

Your employment agreements with your employees should clearly define the types of business information that are considered confidential information (and hence cannot be disclosed).

The employment agreements should also state when your employees are allowed to disclose such information. Standard exceptions to the duty not to disclose confidential information include where:

• The law requires such disclosure (e.g. as per a court order)
• The disclosure is necessary in order to file tax returns
• The information has already become publicly available (through some means other than a breach of confidentiality)

When Might Breaches of Confidentiality Occur?

A time to be on high alert for breaches of confidentiality is when an employee leaves to join a competitor. This is a time when employees might be inclined to intentionally take things like client lists or pricing information, which can possibly benefit them in their new job, with them.

However, breaches of confidential information can also happen at any time through sheer carelessness. For example, inadequate cybersecurity measures can result in data being stolen from your business through simple phishing email scams.

Data can also be stolen when more sophisticated spyware is unintentionally installed on a work computer when an employee visits an unsafe website, and the spyware then adjusts the computer’s security settings or connects external hardware to the computer.

Apart from cyberattacks, careless leaks can occur when employees simply don’t know what information can be shared externally and what information is confidential. They may provide information such as personal contact details of other employees or management to customers or suppliers who call and simply ask for it for apparently reasonable purposes.

What are the Potential Consequences of a Breach of Confidentiality?

The operational risk is obvious and generally well understood: if the information that was disclosed by the employee could give a competitor any kind of competitive advantage against you, you could suffer financial loss arising out of the movement of client revenue from you to that competitor.

The legal risk is that if you were negligent in allowing this leak to occur, your business is vicariously responsible for your employee’s actions, which could place your business in breach of its contractual confidentiality obligations to third-parties.

This could possibly lead to a lawsuit against you for damages and/or it could place your business in breach of its obligations under the Personal Data Protection Act, resulting in an enforcement action against your business by the Personal Data Protection Commission.

How to Prevent Breaches of Confidentiality by Employees

There are a variety of tools available to prevent and limit breaches of confidentiality by employees. Knowing how to deploy them effectively relies on your business having a clearly stated confidentiality policy that is effectively communicated to employees. A lawyer can work with you to craft a confidentiality policy that is feasible for your business.

Core to this policy is defining what is and is not confidential and then putting in place protocols that determine how confidential information must be handled safely. This could possibly include things like the use of:

• Strong passwords that need to be changed regularly
• Two-factor authentication for access to sensitive data
• Regularly-updated anti-virus programs
• Email monitoring software

Then there are practical measures such as:

• Setting rules for how different kinds of information must be stored, and who may access such information
• Implementing authorisation protocols for securing management approval before any information is disclosed externally under non-standard circumstances.

However, the key to the successful implementation of a confidentiality policy is educating the staff about it and ensuring that they follow it.

As for intentional breaches of confidentiality, the consequences for these need to be clearly spelled out in the confidentiality policy. Disciplinary or legal action must also be taken in each instance of a breach in order to deter any future breaches.

What Can Employers Do If Employees have Breached Confidentiality?

If you discover that an employee has intentionally breached confidentiality, the first thing to do is to gather evidence of this in order to:

1. Understand the extent of the breach; and
2. Be able to take action against the employee in breach.

If the breach is serious, you may wish to consider exercising the provision of your employment agreement that allows you to terminate employment without notice for cause (you should ensure that your employment agreement has such a term).

Unless you are a government agency, a breach of confidentiality in itself will not amount to a criminal offence so there is no point in getting the police involved. However, you may wish to engage a lawyer to sue the employee for breach of his employment contract’s confidentiality clause.

To do this, the breach must have caused some actual financial loss to your business and you would need to make some attempt at quantifying how much loss was caused. The loss could be in terms of loss of good-will, loss of actual clients or something else.

A lawyer will be able to engage the services of a forensic accountant to assist in quantifying this in due course if necessary.

Apart from seeking damages to compensate you for the quantified financial loss, the lawyer may possibly also be able to obtain an injunction preventing the employee from retaining or distributing any further confidential information, as a method of damage control.

How Can a Lawyer Help?

Like everything else, when it comes to protecting the confidentiality of your businesses’ information, prevention is better than cure. That’s why the best time to consult a lawyer is before anything bad happens.

Adding watertight confidentiality clauses to employment agreements

A lawyer can help to reduce the likelihood of bad things happening in the future by revising your employment agreements to ensure that your employees’ contractual confidentiality obligations are as tight as they can be (i.e. without any loopholes).

When revising your employment agreements, the lawyer can also ensure that your business has broad contractual powers to respond appropriately by immediately terminating employment and taking legal action if your employees breach their confidentiality obligations.

Drafting comprehensive confidentiality policies

Similarly, engaging a lawyer to draft a comprehensive confidentiality policy for your business will help prevent future incidents that could derail your business, and help to reduce your business’ legal exposure if those incidents do occur.

With a comprehensive confidentiality policy in place, you are also more likely to be protected against third-party claims (e.g. from clients) for negligence in allowing a breach of confidentiality, and from any potential enforcement action from the Personal Data Protection Commission for any failure to prevent the disclosure of third-party personal data.

Suing employees who have breached confidentiality

Whether or not you have taken the prudent approach of engaging a lawyer early on for these purposes, if an employee has breached confidentiality in a way that has caused an adverse impact on your business, it is recommended that you consult a lawyer about the possibility of suing that employee as soon as possible.

This way, the lawyer can assess the extent to which the legal remedies available to you are likely to reduce the damage done by your employee.