TD Bank Trade Secret Suit Highlights Data Theft Risks

How will TD Bank recover from this trade secret lawsuit?

Employees often pose the greatest threat to a company’s proprietary information. In fact, a Symantec study found that half of employees surveyed who had left jobs within the past year took corporate data with them. In New Jersey, TD Bank is currently embroiled in a trade secret lawsuit involving a rival bank and a former employee. TD Bank’s lawsuit alleges that its former loan officer misappropriated sensitive customer information, including tax returns and credit approvals, in the weeks prior to leaving his job. He then sent the information to his new employer, Kearny Federal Savings Bank, so it could be used to solicit the clients.

According to the complaint, Kearny Federal executives “plotted and planned for [employee]’s departure from TD Bank and his employment with Kearny, discussing, in detail, numerous TD Bank clients, customers and deals, and how Kearny could compete for and steal that business.” TD Bank also alleges that its former employee violated a non-solicitation agreement under which he was prohibited from soliciting the bank’s customers during the course of his employment as well as 12 months after he left the position.

The complaint, which seeks a temporary restraining order, includes counts of misappropriation of trade secrets, tortious interference with contractual relationships and prospective economic advantage, unfair competition, unjust enrichment, and civil conspiracy. It also alleges violations of the New Jersey Computer Related Offenses Act, the federal Computer Fraud and Abuse Act, and the newly enacted New Jersey Trade Secrets Act.

To deter a similar trade secret theft, New Jersey businesses can take several key actions to protect their proprietary customer data. One of the most important is to require employees to sign non-disclosure and non-solicitation agreements. Even if a breach were to occur, then the existence of the agreement improves the chances of success in a resulting suit and could allow you to seek an injunction. Think about it – if you don’t have measures in place to protect your intellectual property, why would a court consider such property worthy of protection?

Given the growing risk of employee data theft, it also makes sense to review a departing employee’s computer activities in the months preceding departure. In this case, TD Bank allegedly discovered the theft when conducting a forensic analysis of its ex-employee’s email upon his departure.

Businesses should also be sure to immediately discontinue ex-employee access to documents, databases and cloud storage systems as well as request that all company-owned devices be immediately returned. It only takes a few minutes for a departing employee to transfer a file before waking out the door. In some industries, it may also be advisable (if not required by law or regulation) to notify key vendors, clients, or business partners that the employee is no longer affiliated with the company, so as to prevent any unauthorized disclosures.

As highlighted by the TD Bank trade secret suit, these measures are not foolproof. But they can go a long way to protecting your company’s proprietary data.