A current employee is considering opening her own business and, without her employer’s knowledge or permission, downloads a list of existing and potential client contact information from her office computer onto a CD. Or perhaps a former employee is suspected of stealing strategic business plans to give to his new competitor employer. How can an employer protect itself when a current or former employee misuses confidential or proprietary information? Can the employer commence an action in court to prohibit the use of the stolen information or to recover monetary damages? The good news is that the answer is “yes.”
If, for example, the employee has executed an employment agreement with his or her employer that prohibits the use or disclosure of confidential information either during the term of employment or for a reasonable period thereafter, the employer can assert a claim for breach of that agreement. As with any breach of contract claim, the employer will have to prove that the breach of the agreement caused damage to the employer.
Whether or not there is an employment contract, a employer may be able to assert a claim under the federal Computer Fraud and Abuse Act, 18 U.S.C. § 1030 (“CFAA”). The CFAA — enacted in 1984 to protect governmental and financial institutions from hackers — was later expanded to protect the electronically stored confidential and proprietary information of private businesses. The CFAA prohibits a person “without authorization” from accessing a protected computer and prohibits a person with access to a computer from “exceeding authorized access.” 18 U.S.C. § 1030(a). The CFAA covers any computer “used in interstate or foreign commerce or communication,” which effectively includes any computer that is linked to the Internet or has the capacity to send and receive email. 18 U.S.C. § 1030(e)(2). The CFAA requires claims to be brought within two years of either the wrongful act or the discovery of the damage caused by the wrongful act.
Under this statute, an employer can seek monetary damages if it has suffered at least $5,000 in loss or damage in any one-year period. Loss is defined as “any reasonable cost to the victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of the interruption of service.” 18 USC § 1030(2)(11). Thus, while the loss must be computer-related, it includes the cost of hiring a computer forensic expert to discover evidence of wrongdoing, and several courts have held that misappropriation of trade secrets or other confidential information is enough to satisfy the $5,000 threshold. The CFAA provides for compensatory damages and injunctive or equitable relief, but not exemplary or punitive damages or attorneys’ fees.
One benefit of the CFAA is that it is broadly interpreted to prohibit an employee from improperly accessing any information on computers (as that term is defined by the statute), not just trade secrets. Additionally, the statute can be used even where an employee has not signed a confidentiality or non-compete agreement.
Employers may also consider asserting claims for the employee’s breach of his or her fiduciary duty, including the duty of loyalty. An employee may breach the duty of loyalty if, during his or her employment, he or she unfairly competes with the employer, diverts business opportunities to himself or herself or to others to the detriment of the employer, or accepts improper kickbacks. See, e.g., Elec. Co. v. Brenner, 42 N.Y.2d 291 (1977) (concerning kickbacks); Alexandra & Alexandra of N.Y., Inc. v. Fritzen, 147 A.D.2d 241, 247-48 (1st Dep’t 1989) (concerning a diversion of corporate opportunity). Additionally, “New York law establishes that an employer-employee relationship is fiduciary.” City of New York v. Balkan, Inc., 656 F. Supp. 536, 550 (E.D.N.Y. 1987). Thus, for example, New York courts have held that a former employee who breaches an employment agreement not to steal confidential information or solicit employees is liable for breach of fiduciary duty. See, e.g., Minnelli v. Soumayah, 41 A.D.3d 388, 839 N.Y.S.2d 727, 728-29 (1st Dep’t 2007) (complaint stated claim for breach of fiduciary duty where defendant had a contractual obligation not to disclose confidential information that he might have acquired during the course of his employment); Operative Cake Corp. v. Nassour, 15 Misc.3d 1127(A), 2007 WL 1214662 (Sup. Ct. Queens Co. Apr. 11, 2007) (claim for fiduciary duty survived motion for summary judgment where there was evidence that employee solicited other employees and deleted certain computer files).
If a current or former employee tells a client false information about the employer, the employer may also consider claims for defamation, libel and/or slander. Additionally, depending on the jurisdiction, an employer may assert a claim for tortious interference with contractual relations or tortious interference with prospective business relations if wrongful means were used to interfere. Employers also should not forget about claims for conversion and replevin, which exist if there is a taking of property without a right to it and provide respectively for damages equal to the value of the property and return of the property. Pemrick v. Stracher, No. 92 Civ. 959, 2007 WL 1876504, at *15 n.26 (June 28, 2007 E.D.N.Y.)
So, if your employee or former employee engages in misconduct, you are not left without a remedy. Employers can take action to stop the misconduct and/or to recover damages for harm caused by the misconduct.