This month’s problem concerns:

We have recently discovered that an employee has been transferring company documents to their personal email address. When challenged, they said they need the documents because they are preparing a discrimination claim. How do I handle it?  

It is relatively common for employees to send internal documents to their personal email accounts during workplace disputes in anticipation of bringing a claim.

While the employee may feel that they have a genuine need to “gather evidence”, sending company documents outside of your secure internal system to a personal email account can expose you to significant risks, particularly around data protection compliance and protecting your confidential information and intellectual property.

As a starting point you should verify the nature, sensitivity and volume of information that has been transferred, particularly to determine whether any of the material is proprietary, confidential or contains personal data belonging to your other employees or customers. Your IT team may be able to audit their system use to establish the full scope of their activities.

If the employee is forwarding copies of their own documents, such as their own employment contract or payslips, this would not usually pose a concern. If the employee is sending themselves confidential and sensitive information without approval, this will almost certainly constitute a breach of your internal procedures around confidentiality, IT and communications and data protection. This can be the case where, for example, the employee is going through a redundancy process and sends themselves information about the company’s performance or future planning. The severity of any breach of your policies will naturally depend on the employee’s role, volume and sensitivity of the documents.

If the employee has sent themselves information which contains personal data belonging to third parties’, you should consider whether there has been a “data breach” for the purposes of the UK GDPR. The ICO define a data breach as “a security incident that has affected the confidentiality, integrity or availability of personal data”. This includes a situation where personal data has been accidentally disclosed, accessed or passed on without proper authorisation. This may trigger your legal obligation to report the breach to the ICO, or in more serious cases, to the impacted individuals. You should complete a risk assessment without delay, as reports to the ICO must be made within undue delay and within 72 hours of you identifying the breach.

This will inform your assessment of whether their actions amount to misconduct (or indeed, major or gross misconduct) under your disciplinary procedure. As always, you should consider the specific circumstances and avoid taking a “one size fits all” approach. Like any other potential disciplinary action, the first step is to establish the facts, and you should hold an investigation meeting with the employee. You may need to suspend them during this process, which could involve pausing their system access.

It will be important that your communications with the employee are carefully worded, as the employee may argue that any disciplinary action is actually in response to their wider discrimination-based complaints. This could risk additional claims for constructive unfair dismissal and/or victimisation.

If the employee insists that they are gathering material for a potential tribunal claim and are entitled to do that, you can advise them that any relevant information would be provided within the tribunal process, and they are not permitted to retain documents on the basis that they anticipate bringing a claim. You should ask them to confirm that they have deleted the documents. While this is obviously not a guarantee, you could refer to their agreement later if needed.

In more serious cases, you may consider whether you need to initiate legal proceedings based on the employee’s breach of the express and implied terms of their contract of employment. The latter include a “duty of fidelity” which, among other things, includes a duty not to misuse confidential information during employment. You would ask the court to make an order for the “delivery up” of the relevant documents. Time is usually of the essence when bringing these claims, so you should consider obtaining advice without delay.

This specific issue was considered in the English High Court case Brandeaux Advisers (UK) Ltd v Chadwick. In this case, an employee sent a large number of documents containing their employer’s confidential information to a personal email address. The High Court accepted that they had only intended to “arm themselves” for a future claim, and that they had only shared them with their solicitor.

The High Court rejected the employee’s argument that they had an implied contractual right to use or disclose confidential information for the purpose of preserving their own legal rights or because it was relevant to potential legal or disciplinary proceedings. The Judge indicated that:

“I am doubtful if the possibility of litigation with an employer could ever justify an employee in transferring or copying specific confidential documents for his own retention, which might be relevant to such a dispute. If such a dispute arises, in the ordinary course the employee must rely on the court's disclosure processes to provide the relevant documents: even if the employee is distrustful whether the employer will willingly meet its disclosure obligations, he must rely on the court to ensure that the employer does…”

The employee could also seek early disclosure of relevant information by submitting a subject access request, and you would need to consider the request in line with your statutory obligations and the ICO guidance.

In short, while this employee has indicated that they intent to bring a discrimination-based claim, this does not entitle them to gather evidence outside of the formal tribunal process by transferring documents to themselves without approval or in breach of your internal policies. That said, your response should be proportionate and carefully reasoned to reduce the risk of additional claims.