26 October 2020
Protecting Your Client Lists and Confidential Information
Best Practices for the Protection of your Business’ Client Lists and other Confidential Information
As a business owner, how can you best protect the confidentiality and non-use of your sensitive information? What happens if an ex-employee contacts your clients, soliciting their business?
Most businesses secure a competitive edge from their client lists, which are deserving of protection. Article 2088 of the Civil Code of Quebec provides a wide protection to the employer’s confidential information:
The employee is bound not only to perform his work with prudence and diligence, but also to act faithfully and honestly and not use any confidential information he obtains in the performance or in the course of his work.
These obligations continue for a reasonable time after the contract terminates and permanently where the information concerns the reputation and privacy of others.
That said, an employer cannot simply rely on this provision to prevent the use or disclosure of client information, or any other business-related confidential information. Tribunals made it clear that this rule must be interpreted narrowly, to balance the right of the employee to find another job with the employer’s right to protect its confidential information.
In addition, when attempting to enforce this provision, it is the responsibility of the employer to prove that the information is in fact confidential (and being used in violation of Article 2088 C.C.Q.). In a recent judgement, an employer unsuccessfully petitioned the court for a provisional injunction to stop its former employee from soliciting its clients. The judge referred to a Court of appeal case that provided the extend of the employer’s burden to demonstrate the confidentiality of its information, namely:
- the extent to which the information is known only to employees engaged in the business;
- the extent of the measures taken to protect the secrecy of the information;
- the value of the information to the business and its competitors;
- the extent of the efforts and investments made to develop the information;
- the difficulty with which the information can be acquired by others;
- the extent to which the employer has treated the information as confidential.
Clearly, it is not enough to simply tag something as confidential. Employers must demonstrate that they have treated their information as such in their day to day operations.
In order to protect your confidential information and to maximize your chances of obtaining relief from the tribunals, you must have a solid employment contract in place and take specific actions to demonstrate that information is confidential. More specifically:
Each employee should sign an agreement containing the following provisions:
- A clear definition, with specific lists, of what you consider to be your business’ confidential information
- Rules that apply to the use (and non-use) of confidential information by employees;
- A non-solicitation provision, if appropriate, that prohibits the employee from soliciting clients, suppliers and other employees; and
- Clear consequences and legal rights in case of a breach.
Internal procedures should be implemented to demonstrate that the information is treated as confidential:
- Information should be marked as confidential;
- Access to confidential information should be restricted and given strictly to employees that need the information as part of their work, or to the highest levels of management;
- Confidential information should be password-protected;
- A record should be kept stating the nature of the confidential information, how the information was obtained and compiled; and
- A company policy on confidential information should be accessible at all times and integrated in every employee’s onboarding documents.
Feel free to contact our corporate lawyers to assist you with the protection of your business’ confidential information.