Rebecca Gray is not a name many people will have heard of. However, she, or rather the circumstances surrounding her change in jobs, is something employees would do well to remember.
Miss Gray worked for a recruitment agency - an industry well known for attaching a high value to client data, but also known for having a workforce that can readily move from one employer to the next. Most recruitment agencies will have post termination restrictions included in contracts, and in particular restrictions on the use of confidential information including employees accessing client data on termination of employment and attempting to use that data in a new role. Employers can take action against employees who breach those contractual restrictions by way of seeking interdict or injunction preventing use of the data, and by seeking damages.
However, in addition to the above, employees also risk criminal prosecution for unlawfully obtaining data. Section 55 of the Data Protection Act 1998 makes it an offence for an individual to "knowingly or recklessly, without the consent of the data controller - (a) obtain or disclose personal data or the information contained in personal data, or (b) procure the disclosure to another person of the information contained in personal data".
On leaving her existing role with a recruitment agency based in Widnes, Miss Gray emailed to her personal email address a list of 100 clients and potential clients that she then contacted upon starting a role at a rival company. She pleaded guilty to the offence and was fined £200, ordered to pay £214 prosecution costs and a £30 victim surcharge.
But it is not just employees that can come unstuck when dealing with data protection. In the case of McWilliams v Citibank Miss McWilliams was a trader who regularly communicated with people from other banks via an online chat facility, and the discussions included disclosure of confidential information. The Financial Conduct Authority (FCA) began investigating a number of financial institutions, including Citibank, due to concerns about the sharing of confidential data by traders in chat rooms and the manipulation of exchange rates. Citibank undertook internal investigations which led to Miss McWilliams' line manager being dismissed and Miss McWilliams being investigated and suspended.
Miss McWilliams made a subject access request (SAR) seeking all her data plus her data collected by 25 colleagues. The bank refused the request saying it was disproportionate. Miss McWilliams narrowed down her request and when it was still refused she complained to the Information Commissioners Office. Miss McWilliams also requested her disciplinary hearing be postponed pending the outcome of the FCA investigation as part of her defence was Citibank's relaxed attitude to compliance and that sharing data was custom and practice. However, Citibank proceeded with the disciplinary hearing and Miss McWilliams was dismissed despite the fact that only a limited investigation had been undertaken. Shortly afterwards, the FCA investigation stated that the guidance provided by Citibank on chatrooms did not detail what type of communications were unacceptable.
Miss McWilliams claimed unfair dismissal and the Employment Tribunal upheld her claim. The Employment Judge found Citibank's investigation to be inadequate. He also found that as Miss McWilliams was suspended with no access to information the failure to respond to her SAR (which was held not to be a fishing exercise) materially affected her ability to defend the allegations against her. This is despite the fact that the Court of Appeal has previously held that the primary purpose of a SAR is not to assist parties in litigation.
This case reinforces two factors for employers. The first is the importance of carrying out a fair and reasonable investigation. The second is the need to properly consider SAR's requests and whether there are justifiable grounds for non compliance with such a request irrespective of whether there is concurrent disciplinary action going on, or the possibility of future litigation.