HR Matters: When Employees Leak Confidential Information

'Does an organisation need to prove that an employee clearly leaked confidential information to a third party to justify the employee's dismissal? Would the reality that the employee's actions could have potentially exposed confidential customer information to a third party be sufficient to justify his dismissal?
Please see details of our featured case below

Abdul H.M. Salleh     
           v
Hong Leong Bank Berhad    
[Industrial Court Award No. 1457 of 2021]

Overview

This update addresses the following questions:

1. What is the test adopted by the Industrial Courts in evaluating whether an employee has been forced to resign or if his/her resignation had been a negotiated voluntary resignation?, and
2. What is the test for proving an employee has breached his confidentiality obligations to his employer?

In our feature case, the Claimant commenced employment with the Bank with effect from 20 December 1999 and his last held designation with the Bank was as a Special Grade Clerk. Sometime in October 2019, it was brought to the Bank's attention that the Claimant had on numerous instances since December 2018, entered his office at Level 6, Hong Leong Tower, Jalan Damanlela, Bukit Damansara or other floors in the building during the weekends or public holidays without prior notification or approval from his line manager. As the Bank was of the position that these actions were highly irregular and suspicious as those were not the Claimant's working hours i.e. 8.45 a.m. to 4.45 p.m., a meeting with the Claimant was arranged on 15 October 2019 to seek the Claimant's clarification on the matter.

Further investigations was carried out by the Bank to discover the extent of the Claimant's actions whereby a letter dated 15 October 2019 was issued against the Claimant, relieving the Claimant of his duties with full pay until further notice to facilitate the investigations. In its further investigations, the Bank discovered inconsistencies in the Claimant's explanation to the Bank during the meeting, inter-alia as follows:

1. That the Claimant had entered the Bank's premises and his department whilst accompanied by individuals who are not employees of the Bank;
2. Contrary to the Claimant's allegations that he had entered the Bank's premises and his department to complete his duties, the Claimant was found to not have logged on to the Bank's system on several occasions; and
3. That the time in which the Claimant entered the Bank's premises and his department was highly suspicious as the Claimant would only exit sometime at night or the next day as discovered on one occasion.

As a result of such inconsistencies, the Bank decided to issue a show cause letter dated 21 November 2019 to the Claimant. The Claimant responded to the show cause letter where he, amongst others, admitted that he entered into the Bank's premises and had also admitted that he was accompanied by an individual of the name Muhammad Asraf bin Mohd Malek who did not have any authority or permission from the Bank to enter the Bank's premises.

Upon perusal of the Claimant's reply, the Bank found the same to be unsatisfactory. In fact, from the Claimant's reply, the Bank also discovered further misconduct where the Claimant had admitted to taking home the door remote access without approval for the purpose of gaining access to his department on the weekends. In view of the same, the Bank scheduled a meeting on 6 January 2020 whereby the gravity of the Claimant's actions was explained to the Claimant. Pursuant to the explanation, the Claimant tendered a letter of resignation dated 6 January 2020 whereby the Claimant effectively resigned from the Bank to avoid disciplinary action, letter of which was accepted by the Bank vide Letter dated 07.01.2020.

Following this, the Claimant alleged that he had been forced to resign by the bank.

What the Industrial Court Held

The Industrial Court held in favour of the bank, holding that the claimant had voluntarily resigned. The court stated the following in coming to this conclusion:

Quotation/Citation 1

“The Industrial Court has in numerous cases, held that resignation to avoid disciplinary action does not amount to a forced resignation. [34] This principle was illustrated in the case of AZFFANIZAM ABD HALIM v. PRINCE COURT MEDICAL CENTRE SDN BHD [AWARD NO. 11 OF 2021] where the Industrial Court ruled as follows:

‘This Court must also state here that there are occasions where an employee may feel that he had committed misconducts which he is fully aware to be very serious in nature upon discovery by the Company and that in the event the Company proceeded with disciplinary action, it may very likely lead to a dismissal and a subsequent bad record. In order to avoid this disciplinary action, the employee may even choose to tender his resignation. As such where an employee tenders his resignation in order to avoid any disciplinary action, that resignation of the employee cannot be taken to mean that he was forced to resign.’

A claim of forced resignation is on the premise that the Claimant either resigns, failing which he would be terminated. As the Claimant himself confirmed, Simon did not give such an ultimatum to him and that he had instead resigned on his own volition after deliberating on the matter. This can never be a case of force resignation but clearly shows a person who has resigned voluntarily.”

Quotation/Citation Two

On another note, it is also crucial to examine the Claimant's post resignation conduct, which does not support his claim of forced resignation. In this connection, the Claimant resigned on 6 January 2020 whereby the Bank issued a letter to acknowledge receipt of his resignation. In the Bank's letter (COB-1, Page 25), it was expressly mentioned as follows:-

‘As you are aware, an investigation is currently being conducted into an alleged misconduct committed by you and you have tendered your resignation. This letter serves to put on record that you have resigned to avoid possible disciplinary action.’

It is important to note that the Claimant, however, made no attempts to dispute the contents of the letter or to provide his version of events. He did not complaint against Simon of any wrongdoing during the investigation either…
…This Court is guided in this relation by the case of AIMAN SHAFIQ ABDULLAH @ MANIRAMAN CHINNIAH v. YAMAHA ELECTRONIC MANUFACTURING (M) SDN. BHD. [2011] 2 ILJ 1 wherein the Industrial Court dismissed an employee's allegation of forced resignation as the Claimant had merely filed a police report one month after the purported incident which is immediately before his complaint with the Industrial Relation Department. The Court observed in the following words:-

‘It is not uncommon for this Court to come across instances where workmen have claimed that they had signed documents through coercion. Whilst the Court sympathies with cases where workmen are coerced into signing documents, the Court has to be wary of such claims of coercion lest they be afterthoughts. It is for this reason that the law places the burden of proof upon the one who claims coercion. The burden is therefore upon the Claimant to show that he had been coerced into resigning. In considering such claims, the Court must reach a rational decision which must not appear to have been overweighed by sentiment or sympathy one way or the other. ....Another feature that cannot be ignored is the fact that the Claimant had lodged his complaint with Bukit Aman almost a month after the alleged incident at the police station (i.e., the relevant dates being 16.3.2007 against 10.4.2007 [see exhibit 'CLE 3 - CLB 8 ']). This would be at or about the time of his complaint to the Industrial Relations Department. Taking that into account it is perhaps unwise to discount the clear probability that the complaint to Bukit Aman was made as an afterthought and as an underpinning of his complaint against the Company.’
The Claimant in the case before this Court did not even take any steps to this effect. Applying the same principle in the case of Aiman Shafiq to the instant case, the Claimant's post-resignation conduct is consistent with that of a reasonable person who had resigned on his own accord. This Court is satisfied that based on the above evidence, the Claimant had voluntarily resigned from the Bank.” 

In coming to its findings, the court also addressed the issue of whether the claimant’s actions amounted to a ‘breach of confidentiality’ wherein it said:

Quotation/Citation Three

“The Claimant's actions had placed a security risk to the Bank, which carried grave consequences. By virtue of the Claimant's actions above, the Bank viewed the Claimant's actions to be significantly serious and would have ordinarily warranted dismissal, had the Claimant not resigned. The Bank, being a Financial Institution, is under an obligation under the Financial Services Act 2013 to maintain secrecy of the information under Section 133, which reads as follows,
‘133 Secrecy No person who has access to any document or information relating to the affairs or account of any customer of a financial institution, including- (a) The financial institution; or (b) any person who is or has been a director, officer or agent of the financial institution, shall disclose to another person any document or information relating to the affairs or account of any customer of the financial institution.
As for the Personal Data Protection Act 2010, Section 9 of the PDPA 2010 clearly provides for the need for the Bank to protect the personal data of its customers, as follows:- "(1)A data user shall, when processing personal data, take practical steps to protect the personal data from any loss, misuse, modification, unauthorized or accidental access or disclosure, alteration or destruction by having regard- (a) to the nature of the personal data and the harm that would result from such loss, misuse, modification, unauthorized or accidental access or disclosure, alteration or destruction; (b) to the place or location where the personal data is stored; (c) to any security measures incorporated into any equipment in which the personal data is stored; (d) to the measures taken for ensuring the reliability, integrity and competence of personnel having access to the personal data; and (e) to the measures taken for ensuring the secure transfer of the personal data.’
As an employee of the Bank, it is imperative that the Claimant act in the interests of the Bank, and to ensure compliance with the law. Yet, the Claimant placed the Bank's obligation at significant risk in allowing Asraf to enter the Bank (Allegation 2) and in fact, had allowed Asraf the use of his computer (Allegation 4). This was a significant misconduct, which cannot be tolerated.” 

How Your Organisation Can Benefit From This Case

The Burden of Proof is On The Employee To Demonstrate Coercion or Duress in Proving a Claim of Forced Resignation

This case decision illuminates the court’s view that when it comes to proving forced resignation, it is the employee that shoulders the responsibility to prove that he/she was forced to resign. In finding that the employee was unable to prove duress or coercion, the court observed that:

• The employee did not indicate any elements of being forced to resign in his resignation letter, and
• Did not at any point raise his dissatisfaction with his superior or the bank when the bank wrote back to acknowledge his resignation.

Breach of the Personal Data Protection Act Is Recognised Under The Law as a Breach of Confidentiality

The Industrial Court in this feature case also affirmed that an employee’s actions of breaching any provisions of the Personal Data Protection Act (as well as the Financial Services Act – with respect to companies in financial services) can be treated a breach of confidentiality meriting his termination from service.
Further, the breach of confidentiality needn’t be explicitly proven and as long as the employee’s actions exposed the organisation to a potential breach of its customer data, this potential breach alone can justify the employee’s dismissal (particularly for those organisations operating in the financial services sector).