Reply to: Legal question: Dispute with client

[TheCyclingProgrammer]

OP needs legal advice, but IMO he should pursue the client if they really have been going through his personal Dropbox and contacting his other clients. To me, that is far more damaging to OP than his actions have been to his client (assuming that none of the data he stored on his Dropbox has been compromised).

He may (or may not) have contravened the client's security policy, but not only are the client's actions potentially criminal, they may have damaged OPs relationship with his other clients. He may have a better case for damages against the client than the client do against him.

[jmo21]

Although this all sounds completely wrong, I think you need to improve your own secure practices when using IT. Since this has happened, why haven't you changed your online dropbox account password? Why didn't you uninstall all that stuff from your work PC before leaving clientco? Is there anything else they may have access to? can they get into your gmail/hotmail through the use of stored passwords on your web browser? have you changed those passwords?

He should have changed his password, but if the PC was taken away for analysis, it wouldn't necessarily have been connected to the web, and a password changed wouldn't have stop a PC admin getting access to the local Dropbox folder.

Sounds like he synced his entire Dropbox instead of just one folder for that clients docs.

But again, OP, you asked your manager. He said it was ok. Have you got this in writing/email?

[DirtyDog]

Although this all sounds completely wrong, I think you need to improve your own secure practices when using IT. Since this has happened, why haven't you changed your online dropbox account password?

That wouldn't help remove the copy which is already on the PC.

Why didn't you uninstall all that stuff from your work PC before leaving clientco?

He was off sick and then terminated - at what point would you do the uninstall?

[LisaContractorUmbrella]

Hi all,

I need a bit of legal advice please. I am currently working for an Umbrella company for client X via agency Y. My umbrella company have a contract with the Agency Y, I do not have a contract directly in any way with Client X.

Client X terminated my contract early on the grounds of "unacceptable performance and behaviour". This is a complete lie, I basically called in sick one day and they used that as an excuse to get shot of me (they were essentially doing a clean sweep of all the contractors). I'm not bothered by this as by then I had already handed my resignation in and agreed a leaving date with HR.

However since my termination they sent my work PC off for forensic examination. To cut a long story short I had my personal dropbox linked to my work PC with documents and diagrams that I was working on for Client X. Because of a blocked USB port policy this was the only way for me to work at times since documents I had been working on at home I needed to work on in the office. I made my manager aware at the time that this was not ideal and that it was the only way I could still work when I was at home.

They have now claimed that I breached Systems Usage and Confidentiality Policies (amongst over things) by having work documents on my dropbox. However I was never made aware of these policies when I started or my tenure there nor did I nor any 3rd party sign my agreement to them on my behalf. They are now trying to pursue me for the costs of the investigation plus damages. Under the contract with my Umbrella and Agency there is a clause which states:

"Any media (whether magnetic, paper, or other) on which any notes, correspondence, memoranda or other records are made relating to the affairs of the Client shall immediately become the Client's property, and on termination of this Contract shall be handed over in their entirety to the Client with no copies being retained".

Now I have no problem handing over the documents I was working on to Client X at all. But surely they cannot try and claim that I breached policies that I knew nothing about?

Agency Y are trying to wash their hands of the situation by saying this is between me and the Client (which I completely disagree with).

Where do I stand?

Cheers

You are an employee of your umbrella company and they have signed a business to business contract with the agency. In this instance, the liability for any costs rests with the umbrella company as they have signed the contract containing the confidentiality clauses and therefore have legal responsibility; this should be covered by the professional indemnity insurance that they have in place covering their employees. I would imagine that the umbrella company will also have a clause in the employment contract that they have with you which will cover professional misconduct and I would imagine that they will terminate your employment with them.

My advice would be to pass this back to your umbrella company and let them deal with it.

[Dominic Connor]

Been on the other side of this

I have a sideline of expert witnessing and have seen this issues around people retaining "stuff" as they move from one firm to another. This gets gothic as the head of security at one bank asked me "who is playing you in the movie of this ?".

It is also more expensive than you can possibly imagine, the grief is astonishing, as are the politics.

I have to say up front that I'm not a lawyer, not even slightly, if you think legal advice from a some pimp on the Interweb is kosher then good luck to you but...

Do not get egos involved in this, he is no more a solicitor than I am, the difference is that unlike Mr. Sinclair, I was not kicked out.

The forensics on your ex-PC are questionable, I'd bet good money that non-forensics people have used/touched it since. That puts a small hole in anything they say. Forensics are usually not that expensive, they can be of course, but I suspect this is all part of some attempt to intimidate you, I can't yet see why.

Damages are rarely punitive in English courts, they must prove harm (on the balance of probabilities) and the role of the courts is to get them back to about the same place they were before you did the bad thing, not to punish you.

This of course begs the question of whether you did a bad thing, this is currently unclear to me.

As NLUK says, the client behaviour is so odd as to strike me as unlikely, certainly as described it may well fall under the Computer Misuse Act, which is criminal.
Having worked with forensics people, I'd be mildly surprised if they accessed his DropBox or any other cloud service, this is at best legally questionable and could get them into a bad place. The odds are that the client did the access which can leave the individual concerned in deep piss.

He does need to speak to a solicitor, my view is that once they see he's properly advised and represented by means of stiff letter of rebuttal, there's >50/50 they will just go away.

Contrary to popular belief, very nearly every piece of data in any firm is of little value to a 3rd party, a good % isn't even valuable to them, so there has to be a strong motivation since even if they "win" it will still cost them money and time.
One of the first questions a good lawyer will ask if you are thinking of suing someone is "can they pay", which is questionable in this case.

If this is as the OP says then there is something going on that he hasn't told us and maybe doesn't even know.

Option 1 is internal politics, someone senior has got upset, then spent serious money on forensics and to admit that the OP didn't do anything wrong would make him look stupid.

Option 2 is the OP has done something he shouldn't or gave the impression he has.

Option 3 is that something bad has happened elsewhere in the client and this is a symptom.

[SueEllen]

They have committed a criminal offence by doing this and I would write to them immediately to tell them this and demand that they cease and desist.

However, it's pretty poor practice on your part to leave your dropbox accessible like that...

They won't listen to him because he's been too tight to call in a solicitor.

If he had done that from the beginning when the umbrella tried to wash their hands off him he wouldn't be in this mess.

[Wanderer]

Just to give an update. I have just found out that the client has accessed my personal Dropbox account AND had a dig through my files.

They have committed a criminal offence by doing this and I would write to them immediately to tell them this and demand that they cease and desist.

However, it's pretty poor practice on your part to leave your dropbox accessible like that...

[CheeseSlice]

Just to give an update. I have just found out that the client has accessed my personal Dropbox account AND had a dig through my files. Not only that but some of the clients that I was doing work for (when I did run my own consultancy company) they have emailed saying I have documents of theirs! (which I had an agreement with them saying that I could in regards to providing support further down the line).

Surely this breaks all kinds of laws?!

Although this all sounds completely wrong, I think you need to improve your own secure practices when using IT. Since this has happened, why haven't you changed your online dropbox account password? Why didn't you uninstall all that stuff from your work PC before leaving clientco? Is there anything else they may have access to? can they get into your gmail/hotmail through the use of stored passwords on your web browser? have you changed those passwords?

[SueEllen]

I don't know about anyone else's situation but I am finding some of this a bit hard to swallow. Some of I guess you could put down to a one off problem i.e. not getting to see the security policy but all this breaking in to your dropbox, emailing other clients, having their permission to store stuff on the cloud. It's all sounding very strange to me.

It's not that strange the former client is being spiteful.

They realise they probably can't get the money back from the poster and that he doesn't have the money to fight them in court so they are just being nasty because they can.

I've come up against some spiteful companies but I can be as nasty as them.

[SueEllen]

Just to give an update. I have just found out that the client has accessed my personal Dropbox account AND had a dig through my files. Not only that but some of the clients that I was doing work for (when I did run my own consultancy company) they have emailed saying I have documents of theirs! (which I had an agreement with them saying that I could in regards to providing support further down the line).

Surely this breaks all kinds of laws?!

If you had done what was already suggested and got your own solicitor involved then you may have had a leg to stand on. Now you haven't - instead of wailing here go and get yourself a solicitor and sort the issue out.

Also you have learnt an important lesson for the future about online security.

[northernladuk]

Because the client has emailed the other clients basically saying I have files / diagrams, etc. I got an email from an old client today essentially saying the same thing.

I keep my documents in quite an organised structure broken down by client ID and the name of the company.

I had agreements with my old clients stating that some of the work was being held in Cloud storage to which they agreed was fine (some of the clients are very small non-financials).

I don't know about anyone else's situation but I am finding some of this a bit hard to swallow. Some of I guess you could put down to a one off problem i.e. not getting to see the security policy but all this breaking in to your dropbox, emailing other clients, having their permission to store stuff on the cloud. It's all sounding very strange to me.

[eek]

Just to give an update. I have just found out that the client has accessed my personal Dropbox account AND had a dig through my files. Not only that but some of the clients that I was doing work for (when I did run my own consultancy company) they have emailed saying I have documents of theirs! (which I had an agreement with them saying that I could in regards to providing support further down the line).

Surely this breaks all kinds of laws?!

It may do and probably does but you won't have the money to pursue them so don't try. We can't help you here beyond moral support so go and get legal advice and keep us informed...

[ap2013]

Because the client has emailed the other clients basically saying I have files / diagrams, etc. I got an email from an old client today essentially saying the same thing.

I keep my documents in quite an organised structure broken down by client ID and the name of the company.

I had agreements with my old clients stating that some of the work was being held in Cloud storage to which they agreed was fine (some of the clients are very small non-financials).

[northernladuk]

Just to give an update. I have just found out that the client has accessed my personal Dropbox account AND had a dig through my files. Not only that but some of the clients that I was doing work for (when I did run my own consultancy company) they have emailed saying I have documents of theirs! (which I had an agreement with them saying that I could in regards to providing support further down the line).

Surely this breaks all kinds of laws?!

If it does are you really in a position to start firing shots off? How have the other clients found you have documents of theirs on your drop box?

[ap2013]

Just to give an update. I have just found out that the client has accessed my personal Dropbox account AND had a dig through my files. Not only that but some of the clients that I was doing work for (when I did run my own consultancy company) they have emailed saying I have documents of theirs! (which I had an agreement with them saying that I could in regards to providing support further down the line).

Surely this breaks all kinds of laws?!