Articles

Will your staff steal your clients?

Data theft and misuse is a red-hot topic. But what can recruiters do to protect valuable information and ensure that when employees leave, client lists will not go with them? Brian Gorman investigates

Recruitment companies tend to have little in terms of physical assets. Most don’t even own the premises they occupy. Aside from their fee-earning consultants, the data they have on clients and candidates is their biggest asset.

This poses a danger because a sizeable recruiter’s database can easily be stolen on a few USB sticks (Recruiter, 26 July).

Paul Carratu of forensics firm Carratu International has worked on more cases in the recruitment sector than any other in recent months. “Recruiters have realised they have to do something to stop data theft,” he says.

Carratu says firms make it far too easy for staff to access data, and points to the growing use of iPods, which can download data. “If it was one thing I would advise firms to do, it would be to ban the use of this sort of equipment on company computers,” he adds.

Identifying data misuse

Alleged misuse of data was at the centre of a recent High Court case between two rival London social work agencies (Recruiter, 15 November). It concerned Billy Richard, who worked as a consultant at Social Workline and then joined Action First.

After several days in court, the agencies settled, but the case alluded to how easy it might be for data to be copied or printed, even by unauthorised people.

It may be hard to prove misuse of data. Many candidates register with several agencies. If an agency sees one of its candidates has been placed through a rival agency, it does not in itself mean anything is untoward. It’s a matter of extent.

It may gradually dawn on you that many of your candidates are suddenly being placed through, or being called by, one or more rival agencies. You may start to become suspicious, especially if someone left your firm recently in less than amicable circumstances.

Similarly, staff leaving to set up their own agency may present challenges. A consultant may feel that his own efforts, rather than anything his firm has done, have helped to attract a particular client. He may then feel entitled to take the client with him.

Most recruiters put a clause in contracts to stop staff competing directly for a time if they leave. Contracts should also, as a matter of course, expressly forbid the misuse of data gained during the period of employment.

Enforcing contracts

However, Daniel Naftalin of law firm Mischon de Reya says some firms don’t even take such basic precautions. “When they start out, they’re more concerned about building up the business than with contracts,” he adds.

There is no assumption under the law that a consultant has done anything wrong if they have approached clients or candidates of their former employer. Naftalin says: “There’s a legitimate business interest to protect. But if you don’t protect it, it’s your look-out.”

Even if a firm puts suitable clauses in contracts, it may be hard to enforce them, and may involve taking out an injunction (see news page 12). Stealing a database is illegal, but proving theft may be expensive and time-consuming.

Forensic experts are usually needed to establish the facts. What data was accessed, printed or copied by whom? The experts may also need to access the computers of the company alleged to have misused the data.

Burden of proof

None of this is cheap. To go to court might cost hundreds of thousands of pounds. And the burden of proof may require many instances of data misuse for a case to stand up. Richard Pomerenke of Social Workline estimated his costs at £600,000.

But Naftalin says: “You may decide you have to do something to stop [theft] happening. And you get your costs back if you win.”
Lucy Bristow Appointments claimed victory in a dispute on a similar issue and said the legal action was worthwhile (Recruiter, 22 March).

Naftalin says the problem of data theft is widespread and “is never going to change”. Recruiters should review their systems and contracts, and think about whether they are doing enough to guard information, he adds.

Mishcon de Reya will hold a seminar, “Employees and data theft — fighting the threat within”, on 13 December.

<<Back to News and Events Index