Sometimes employees, whether maliciously or not, move corporate data to personal storage. When this happens it opens the door to leaks of confidential or proprietary information. When offboarding, a standard exit interview isn’t always enough to ensure the protection of confidential or proprietary data.
We are often asked, is this criminal? Can the police be involved in taking confidential or proprietary information? The answer is often no, however, if an employee has engaged in a theft of data and has breached a position of trust, there could be potential criminal liability. However, the bulk of cases we see are departing employees over including documents or files upon their departure. When advising employers and employees, we review and consider the company’s policies, regulatory obligations and the nature of the data and context for it being taken. There could be many employment, regulatory, or civil consequences outside of whether the police are involved.
If the employer has discovered data has been sent to an employees own email, or a mass download or zip file has been created, they will often intervene and want to ensure this is not their information. This is where a Data Cleansing Call comes in. This is a scheduled call where a combination of the IT, HR, and/or legal department work with a former or departing employee to ensure company data is completely removed from the individual’s personal devices and accounts. This is often a formal and facilitated process designed to avoid or remediate a data leak and secure data from unauthorized use. It is a step that for most employers is key to ensuring they have done their due diligence to secure their own or their clients confidential information.
Think of this process as the digital equivalent of handing back your office keys and clearing out your desk, except, instead of physical keys and desk, you’re making sure company passwords, files, and drafts aren’t accidentally left behind on your personal phone or computer.
Here’s how a data cleansing process typically unfolds:
1) Guided and Supervised Deletion
This is not a task left solely to the departing employee. This is a supervised session to ensure precision in the data cleansing process. The focus of the deletion is on confidential or proprietary information that has been moved to personal accounts or storage devices. This includes (among other things) corporate files and internal documents, client data and contact lists, emails containing company communications, templates and work structures.
2) Verification
For deletion to be effective, there has to be verification that no residual copies exist in the personal devices or accounts. This involves tracking down and removing backups and drafts of confidential or proprietary data that was created either automatically or manually. To ensure a thorough data cleanse, the organization will want to check personal computers and hard drives, cloud drives (Google Drive, Dropbox, etc), and cell phones.
3) Formal Declaration
The final step may be that the employer asks the employee to provide an attestation or statutory declaration confirming that all company property, confidential documents, and electronic files have been returned and permanently deleted. This declaration serves as evidence that they have not retained any company information and a commitment to not misuse confidential or proprietary data. This declaration is made under the understanding that it carries legal force.
A Fair Process
The signed declaration or exit agreement is only as strong as the verification process. The data cleansing call is an important step to bridge the gap between making the declaration and ensuring the confidential and proprietary information remains permanently and irretrievable deleted from all personal accounts and devices.
For employers, this process protects proprietary data, client lists, and intellectual property from accidental data leaks. For employees, it provides peace of mind that ensures they will not be accused of causing a data leak after they leave. If you want to consult about your rights as an employer, and what policies you need in place to implement this type of process, we would be happy to speak with you. This is especially important if you are in a regulated profession where clients are owed a duty of confidentiality.
Whether you are an employer seeking to build secure offboarding policies or an employee navigating an upcoming data cleansing call, having the right legal support is critical. Greenwood Law specializes in helping both employers and employees understand their rights and obligations and navigate these complex situations. If you are faced with this type of situation, or something similar, contact us for guidance on next steps.
