How Should I Inform a Future Employer About an Employee's Data Theft Incident?

I want to draft a letter informing a future employer about a data theft attempt by one of our existing employees. Here is the scenario: a managerial cadre employee had resigned and was serving his notice period. On the second last day of his employment with us, he was found to have passed a couple of confidential data files along with business secrets to his personal email ID.

We now want to inform his future employer about this data theft. Please let me know the ways this can be handled and also send a draft for such a letter.

Regards,
VN.

If the confidential data that can run the business is at an increased risk, it needs to be addressed immediately. Furthermore, taking steps to protect restricted and vital information from being used in a dishonest or illegitimate manner is important. You can always write to the person informing them that they have been caught passing imperative information to their personal emails. You may also need to keep evidence of tracking done as proof of data theft.

You can utilize the "Research" facility at the top for any desired formats or letters as there are thousands of such formats in CiteHR for the betterment of learners.

Good Luck!

While concurring with Sharmila Das about the need to address such a situation immediately, please clarify the following aspects of the situation/case.

1. Was the employee confronted with the issue or proof of passing the company secrets to his personal mail ID? If yes, what was his response? If not, why not?

2. What are you trying to achieve by alerting the future employer? Are you sure that the employee wasn't doing it for them? Typically, such actions lead to the next employer, though this is not a rule.

3. Keeping his action aside for a while, was any valuation of the company secrets he transmitted done? Are you clear about the level of damage this information could do if misused? If yes, please decide on the next course of action based on this aspect.

There are two aspects you also need to take into consideration while handling such issues: the damage potential of the leaked/lifted info and the message the company wants to send to the other existing employees.

All the best.

Regards,
TS

You may inform the future employer about the employee if background checks are done. However, you need to curb this tendency of the employees by sending a strong message across the lines, potentially by taking legal action. If there was a service bond or a confidentiality clause in the appointment letter, you can file a civil suit for damages or file a criminal complaint with the cyber cell of the Police department.

This guy served in the Sales Head position, which by virtue is a very responsible role. You can ascertain the value of the data that he might be in possession of.

1. Yes, the employee was confronted, and we have his written acceptance of the data theft.
2. I do not want him to join his future organization with the sensitive data that was pilfered for the next couple of months. This is the reason why I want to alert his future employer.
3. Yes, we had summoned an urgent meeting where it was ascertained that his actions are likely to cause huge financial damage to the organization.

Regards,
VN.

Please help me draft a legally foolproof letter. I would appreciate it if any of you have a template for such cases.

Thank you,

Regards,
VN.

I'm not understanding the purpose of you informing the future employer. This implies that you have some personal grudge against that particular employee. If so, please stop that right now!

If the future employer is interested in a background check and when it comes to you, you can inform them about it. When the future employer himself is not interested, why are you bothered to intimate them?

You've mentioned that you have taken it in writing from him regarding data theft. So, definitely enough scene would have been created, and this would have already had an impact on his mind. I suppose he would not dare to repeat it in the future because he would have learned enough.

Now the question is, he has already left your organization, he is elsewhere, so why are you interfering in his further career growth without knowing if he would repeat the same or not?

Please do not play with his life. Gone is gone. He might have changed or not changed. He is not harming you anymore. Just let it go. Let him carry on in whatever ways because at the end of the day, he is answerable to his own consciousness, and he would be the one facing embarrassment in the future as well.

Human Beings Will Change, and You Do Not Change

You are not a human being. You need not care about those who are not human beings, especially with human beings who do not have ethics at all. 

Regards,
Bharghavi

Dear Bhargavi,

Thank you for sharing your ideas. We, as members of this forum, are here to discuss things professionally. Spiritualism can be set aside. I have clearly mentioned in the email trail why I want to inform his future employer. Where does the question of grudge come in? As a Senior Manager - HR & Admin, I can't afford to nurture grudges against my employees. It is my responsibility to prevent data pilferage for my organization.

Instead of me being proactive here, you are suggesting that I sit back and wait for the employer to ask for a Background Check? You must be kidding! Dear, he has confidential data with him that should not be allowed to be used at a competitor.

Having it in writing, will that prevent him from using the sensitive data at his new place? What impact on his mind are you talking about? An employee serving in a senior position for so long, if he attempts such an act, I cannot just sit back and say he is answerable to his own conscience! Doesn't his intention to steal the data itself prove that he is indeed going to use it at the competitor's place?

Dear Bhargavi, even though I am a kind person, people who know me would definitely agree. But I prefer to set kindness aside when dealing with such serious acts of misconduct.

Regards,
VN

Frankly, I think Bharghavi gave her opinions based on how she saw the 'readings' of the situation—you need not have come over her like a ton of bricks... no pun intended, please.

In fact, I think it's this variety and range of angles from which the members of this Forum view a subject/topic/issue that makes this Forum so very lively, informative, and more importantly, educative.

Prioritizing Your Actions

First of all, I think you need to make up your mind on what your priority #1 is. Is it [1] Teaching the Sales Head a lesson for what he did to the company? OR [2] Ensuring he doesn't repeat it at the new company too? OR [3] Safeguarding your company's interest AFTER this fiasco?

Let me explain—if you alert the next company, there are 2 possible scenarios that can arise: maybe they would drop this guy OR they would ignore your inputs [especially if they set up the whole thing]. But can you keep tracking him all through to see which company he would join then and keep alerting every company he intends to join [after all, he, like everyone, needs to work]? Is this realistic and practical?

Perhaps, at a subconscious level, you are mixing up what you really want to avoid at the conscious level—thinking through the 'head' and through the 'heart'? Hope you get the point.

Safeguarding Your Company

The way I see it is this: Your First Priority HAS TO BE to safeguard your company AND ensure the message goes down the line within the company that such behavior wouldn't be tolerated AND would invite severe action from the company.

I would suggest you involve your company advocate ASAP in deciding the next step. While by common sense, his admittance in writing is OK, legally it may not be enough—what if he says in court that he was coerced to give the written statement? It takes a lot more evidence to have a watertight legal case. Another reason why involving your advocate right at this stage is better is such issues can take time to get resolved and also be time-sensitive. If you don't have any company lawyer, you can contact any legal member from this Forum I guess—there are quite a few of them who are capable.

And, like one member suggested, refer the case to the Cybercrimes cell—with your advocate involved all through. This step would also bring out any possible involvement of outsiders [not necessarily the new company], IF ANY. With this single step, you would be handling the issue with the focus on your company's secrets rather than on the individual AND ALSO sending a strong message to other employees.

All the Best.

Regards,
TS

Dear VN Sir, Apologies if I've hurt you. My intention was only to tell you that it would be bad on the part of the employee if we are backing him, and I did not concentrate on spirituality. Sorry!

Regards, Bharghavi

By alerting the future employer, I am buying time so that the pilfered data remains unused. Further to your query, he is definitely going to be sacked. I do not wish to keep track of him wherever he goes, but by keeping his immediate future employer in the loop, I am trying to buy time as explained above. Once things are sorted out, how do I care where he joins or not?

A circular has been passed on that very day to all the employees, highlighting that any such offenses would be dealt with severely.

A consultant (legal advisor) had been roped in, on whose advice we decided to draft a letter informing his future employer.

He cannot ever claim that he was coerced, as our IT surveillance team has all the details of the mails being forwarded along with attachments. This information is available with HR & IT with the minutest of details. In fact, it is only after showing him the evidence that he decided to confess and give us in writing.

The cybercrime cell had also been informed, along with a complaint being lodged at the local police station.

I don't know what gives some members the feeling that I am after this guy's life!! Hahaha... On a lighter note... thanks, friends, for sharing. I value your views and suggestions. Bhargavi, you too, please keep contributing :).

Regards,
VN

Looks like things are moving on the right track. However, I am still not "very comfortable" with the idea of you informing his next employer—did you check, from different sources, on whose behest he did this?

I suggest getting it done discreetly rather than your company getting involved—a call can go to them that there's a cybercrime case going on against this guy... or something like that. Just give this a thought.

All the best.

Regards,
TS