Ex-employee has copied our database

[DaveSki]

An ex-employee who we terminated their contract of employment recently has begun a job at a rival company.

This ex-employee is now ringing our customers - their direct lines - and trying to sell exactly what this customer has historically purchased from us.

Now this person got a new job in double quick time without any reference being asked by us. Which we though was a bit odd at the time. We now know why.

I've put 2 & 2 together and it's pretty obvious this person has:
a) Copied our database - they had access from home due to the nature of their job
b) Taken our database to this rival company and been employed on the basis of having details on all our customers

This person was employed in a senior role and was privvy to very commercially sensitive data (business practices, intellectual property, trade secrets etc).

Our database contains customer details, invoices, trading history, etc. It's an absolute gold mine in the wrong hands. It also contains credit card details and bank account details.

I must stress that this is not a security breach as such - i.e. unauthorised access to the data. Rather this person had authorised access to this data whilst employed by us. And has copied it.

Is it possible to take out an injunction against this person and the company they know work for to forbid them from contacting our customers?

I know it's difficult to prove, but is the defence along the line of "well I remembered several hundred contact names, phone numbers and e-mail addresses in my head" actually plausible? I know you cannot make somebody forget what they have learned whilst in the employ of an organisation. But this is very different.

So is there any legal action we can take or are we stuffed?

 

[saxondale]

stuffed - get on the phone and get smoozing

 

[Williams lester]

Stuffed - perhaps you should be more careful as to how much access you give to sensitive info.

 

[DaveSki]

Stuffed - perhaps you should be more careful as to how much access you give to sensitive info.

Usual story. Probably familiar to so many people.

Person was a friend outside work. I had ambitions for this person to run the company over the longer term.

Bottom line: don't employ friends.

 

[saxondale]

doesnt help you but our rule of thumb - no one meets the same customer three times ina row.

 

[MASSEY]

I have 400 customer names and address's of a company i used to work for, as soon as i have capital to buy in bulk i will take a large percentage of there custom and it will be a profitable sideline,

and there is nothing they can do about it,

Your in no legal position to persue that person, it harsh i know but business is business as they say,.

 

[MH1]

I seem to remember computer experts can tell if such information has been accessed normally and also if it has been copied without permission, if you can show this then you should be able to take steps too limit the damage.

 

[internetspaceships]

stuffed - get on the phone and get smoozing

OMG I'm gonna agree with Sax!!!!! *grins*

He's spot on here. Get on the phone and keep them as customers, it's all you can do.

Hopefully you've got a cracking reputation with them so it shouldn't be too hard.

Oh, and the person who did this to you is an ass.

Regards

Jon

 

Vety hard to prove.

You might want to send a solicitors letter to the company stating that you have proof that they are using your database.

This may have some positive effect.

I suspect they would be breaking some law by having credit card details unauthorised.

Earl

 

[Lawyer]

There has been loads of litigation in this recession involving this area and I've done some of it but the bottom line is it's expensive to sue and often not worth doing it. You could send them a letter or solicitor's letter requiring them to undertake they cease to use your property and return it. Also did they have an employment contract prohibiting competing for a reasonable period after. If not I would advise you consider that for new employees. It helps in these situations. Get a lawyer to check employment contracts - post termination restrictive covenants if reasonable are valid and then you have two things to hammer them with - breach of confidentiality and IP rights and also the competition itself.

If your customers' details are in the public domain or the customer approached them then you may not be able to get very far. If you sue him it might back fire and I agree with the suggestions you speak to customers rather than litigate but it may be possible at least to curb the contact by threatening to sue.

 

[yorkshirejames]

Did you have a non-compete cause in his contract (and I wonder; would that clause still be valid in the event that you sack him - as you did?).

It might be useful to look at the case of RFD Media Group v Clements (in which the judgment is on the side of the company).

 

[VeryMark]

Databases can be protected either through copyright or the new database right. For copyright to apply, the database must have originality in the selection or arrangement of its contents whilst, for the database right to apply, the database must be the result of ‘substantial investment’.

It is, of course, possible that a database will satisfy both conditions so that both copyright and the database right exist.

The database right is established in the same way as copyright, i.e. by evidence of origination and ownership.

 

[JElder]

VeryMark is dead on - the actual database is copyright, and there are also Data Protection Act issues for him using for something other that it was built for.

It is better if there was a clause in the contract saying he could not do this - but in any case a court battle would be long and expensive.

You will have to

a) Make sure all customers know he is not working for you
b) do some great customer service, keep in touch and try not to lose too many.

 

[mobyme]

stuffed - get on the phone and get smoozing

I don't think I can get myself to say this ........ he's right.

 

[gatty2010]

An ex-employee who we terminated their contract of employment recently has begun a job at a rival company.

This ex-employee is now ringing our customers - their direct lines - and trying to sell exactly what this customer has historically purchased from us.

Now this person got a new job in double quick time without any reference being asked by us. Which we though was a bit odd at the time. We now know why.

I've put 2 & 2 together and it's pretty obvious this person has:
a) Copied our database - they had access from home due to the nature of their job
b) Taken our database to this rival company and been employed on the basis of having details on all our customers

This person was employed in a senior role and was privvy to very commercially sensitive data (business practices, intellectual property, trade secrets etc).

Our database contains customer details, invoices, trading history, etc. It's an absolute gold mine in the wrong hands. It also contains credit card details and bank account details.

I must stress that this is not a security breach as such - i.e. unauthorised access to the data. Rather this person had authorised access to this data whilst employed by us. And has copied it.

Is it possible to take out an injunction against this person and the company they know work for to forbid them from contacting our customers?

I know it's difficult to prove, but is the defence along the line of "well I remembered several hundred contact names, phone numbers and e-mail addresses in my head" actually plausible? I know you cannot make somebody forget what they have learned whilst in the employ of an organisation. But this is very different.

So is there any legal action we can take or are we stuffed?

of course, U should ask your layer to get more helpful info. I think so, Sorry for not giving U any advice!

 

[Cobby]

The problem you have in the first instance is proving they they have your database. The company themselves might not have it or know about it, and simply see their new employee as extremely efficient!

 

[Chris Ashdown]

The problem you have in the first instance is proving they they have your database. The company themselves might not have it or know about it, and simply see their new employee as extremely efficient!

In which case a solicitors letter asking them to stop this action and return the copy may be rather upseting to them knowing he is likely to act the same way when he leaves them so forcing them to let him go
Would you trust someone who had done this before or are you so hard up you would employ him

 

[Beadons]

I seem to remember computer experts can tell if such information has been accessed normally and also if it has been copied without permission, if you can show this then you should be able to take steps too limit the damage.

At my last Association of British Investigators meeting, a talk was given by a lady called Jan Collie who explained exactly how easy it is to prove this in court. I don't know how much she charges, but she knows her stuff and also has Expert Witness Status for court purposes.

Her website is http://www.thedigitaldetective.ltd.uk/

Good luck.

 

[KM-Tiger]

An ex-employee who we terminated their contract of employment recently has begun a job at a rival company.

Might be a coincidence, but I received an email from a supplier today on this very subject.

If it's not a coincidence, then I think you've done the right thing to inform customers. I've not had a call, but would have been suspicious anyway. I suspect most will remain loyal to your company.

 

[brownie]

At my last Association of British Investigators meeting, a talk was given by a lady called Jan Collie who explained exactly how easy it is to prove this in court.

She will have been referring to documents not data as in this instance, it isn't possible in this instance to prove anything.

 

[internetspaceships]

In which case a solicitors letter asking them to stop this action and return the copy may be rather upseting to them knowing he is likely to act the same way when he leaves them so forcing them to let him go
Would you trust someone who had done this before or are you so hard up you would employ him

Dear Chris,

sadly it's more than likely to be the latter.

Speaking personally, I've actually terminated an employment interview when a potential recruit offered to bring his current employer's database with him.

Regards

Jon

 

[Flying Hippy]

Hi,

Im no legal expert but its just an idea you maybe able to go down the route of Data Protection Act even if they had access. Access is only for work purpose which relates to your business.

Also is this B2B selling or B2C ?

 

[Beadons]

She will have been referring to documents not data as in this instance, it isn't possible in this instance to prove anything.

No she was referring to data and data theft, especially when a customer steals/copies the customer database for use in their next business. I certainly learnt a few things and she certainly knows her stuff.

For obvious reasons, I'm not going to reveal what she said, on a public forum.

 

[brownie]

No she was referring to data and data theft, especially when a customer steals/copies the customer database for use in their next business. I certainly learnt a few things and she certainly knows her stuff.

For obvious reasons, I'm not going to reveal what she said, on a public forum.

Unless you know exactly how the database was copied, you cannot assume what you have been led to understand is correct. For example, if the data was exported as a CSV then imported into another database system there would be no forensics showing where the data had come from.

 

[patientlady]

It also contains credit card details and bank account details.

Whilst it easier to sell to new customers with 'inside' information, I think most of your customers will stay loyal to you. Customers stay loyal to the company rather than the salesperson. Could this person not have still contacted all your customers without this database? I know all my customers, and could probably tell you every price they pay.
Your customers will not like this ex employee contacting them.
Just a thought, should you have customers credit card details on a database?

 

[pnc02]

Unless you know exactly how the database was copied, you cannot assume what you have been led to understand is correct. For example, if the data was exported as a CSV then imported into another database system there would be no forensics showing where the data had come from.

you might be able to prove it, given sufficient IT expertise. The export may well have issued a SQL statement which may be captured in a SQL log, against the user profile.

 

[Cobby]

you might be able to prove it, given sufficient IT expertise. The export may well have issued a SQL statement which may be captured in a SQL log, against the user profile.

You can happily show what information an employee has accessed and if they happened to have accessed all of it within a couple of weeks of their departure, it will certainly look suspicious. This doesn't actually prove anything other than the employee accessed information.

There is no "sufficient IT expertise" in the world that can change this.

 

[bigmouth241]

How long ago do you suspect the copying took place? It may still be possible to capture the point of copying through logs.

To protect from this in future, consider deploying some sort of EndPoint security like GFI EndpointSecurity - will control who can \ cant plug in external devices like USB sticks - the most common way of copying a DB.

The ex-employee may well have committed offences under the Computer Misuse Act, Data Protection Act.

You'd be well advised to consult a legal advisor...

(& if you need help with the IT aspect, of course, drop me a line )

 

[brownie]

control who can \ cant plug in external devices like USB sticks - the most common way of copying a DB.

Other methods I have come across are uploading the data to file sharing sites or into Gmail accounts, etc.