Link to Act Fast to Protect Your Intellectual Property Act Fast to Protect Your Intellectual Property
When an employee leaves, most employers focus on the logistics: returning equipment, revoking access, and wrapping up final pay. But for many organizations, there is a critical step that too often gets skipped: a forensic review of the departing employee’s computer and electronic devices. Depending on the nature of your business, this oversight can be costly.
Employees often have access to some of a company’s most sensitive assets: proprietary business information, client lists, financial data, strategic plans, confidential communications, and other potential trade secrets. When an employee departs, particularly one headed to a competitor or launching a competing venture (and they normally don’t disclose their plan), the risk of data exfiltration is real.
A forensic review of a departing employee’s devices and accounts can reveal whether sensitive files were copied to external drives, uploaded to personal cloud storage, emailed to personal accounts, or otherwise removed from the company’s systems. While forensic reviews are common when there are disputes with former employees or competitors, waiting until then to do the review can be a significant mistake. Catching this activity early preserves evidence that can otherwise be destroyed and allows the employer to take swift action to demand the return or destruction of confidential information, as well as seek injunctive relief or other remedies.
Link to An Often-Overlooked Benefit: Protection Against Employment Claims An Often-Overlooked Benefit: Protection Against Employment Claims
In addition to protecting intellectual property, forensic computer reviews also can serve as a powerful defense tool when departing employees bring claims of their own against their employer. Under the after-acquired evidence doctrine, an employer that learns of an employee’s misconduct after termination can use the information to its benefit. If the misconduct is of the type that would have led to termination had the employer known about it at the time, the date of that “discovery” can be used to cut off the employee’s entitlement to back pay and may bar reinstatement or front pay entirely.
A forensic review frequently uncovers exactly the kind of conduct that satisfies this standard: violations of company policy, misappropriation of company resources, accessing or sharing confidential information without authorization, inappropriate communications, or other misconduct. Indeed, the landmark McKennon v. Nashville Publishing Co. case that created the after-acquired evidence doctrine involved a former employee who admitted in her deposition that she had copied and removed confidential information. With certain high-level employees who have employment contracts, a forensic review also can uncover conduct that satisfies the contractual definition of “cause” in the agreement, which can save the company significant costs and expenses.
This makes the timing of the forensic review important. Usually after-acquired evidence is uncovered in litigation, like it was in McKennon. By then, the damages can still be high, whereas a prompt off-boarding review could potentially cut off all damages.
Link to Practical Takeaways Practical Takeaways
Employers looking to implement or strengthen a forensic review process should consider the following:
- Confer with counsel about the best way to incorporate computer forensic review into your off-boarding process, particularly for remote or hybrid employees.
- Consider quiet monitoring options, such as data loss prevention tools to identify unusual downloads or file transfers.
- Assess company policies and procedures and revise, if needed, to expressly prohibit certain kinds of computer activities such as the use of cloud drives, personal email account access, and non-company storage devices.
- Revoke system access as quickly as possible in connection with departures and communicate to departing employees that they are not authorized to access company information.
- Review exit interview procedures to include questions about the use of personal devices, retained historical information, cloud storage, and off-platform communications.
- Consult with legal counsel before taking any adverse action based on discovered misconduct to ensure the response is measured, legally defensible, and consistent with past practices.
A forensic review at off-boarding is not about distrust; it is about due diligence. The costs involved are modest when you compare them to losing valuable trade secrets to a competitor or an unchecked employment lawsuit.
If you have questions about implementing a forensic review process or how after-acquired evidence may apply to a pending or threatened claim, Bradley’s Labor & Employment attorneys are available to answer any questions that you may have.