Instructions: dismissal of an employee for disclosing a trade secret

An employer, when hiring a new employee, requests his consent to the processing of personal data.

Today we will look at what personal data is, what legal regime is established in relation to personal data and what responsibilities the employer has.

The Labor Code of the Russian Federation (hereinafter referred to as the Labor Code of the Russian Federation) establishes the features of protection, as well as storage, use and transfer of employee personal data in Chapter 14 “Protection of employee personal data”. The rules for working with personal data are contained in the Federal Law “On Personal Data” dated July 27, 2006 No. 152-FZ.

Personal data means any information relating directly or indirectly to a specific or identifiable individual (subject of personal data).

Those. personal data is a huge amount of information that allows you to identify a person, starting from the date of birth, last name, first name, patronymic, and ending with information about the race, nationality of the person, his political views.

You can give an approximate list of employee personal data:

• Full Name;
• Date of Birth;
• address of registration/place of residence;
• information contained in the documents provided during employment: passport, work book, education document, certificate of state pension insurance;
• information about work (insurance) experience;
• information about bringing the employee to financial liability;
• information about the employee’s health status and medical examination results;
• any other information allowing to identify the employee.

Processing of personal data - any action (operation) or set of actions (operations) performed using automation tools or without the use of such means with personal data, including collection, recording, systematization, accumulation, storage, clarification (updating, changing), extraction , use, transfer (distribution, provision, access), depersonalization, blocking, deletion, destruction of personal data.

In terms of Law No. 152-FZ, the employing organization is the operator of personal data, since it organizes and carries out the processing of personal data, as well as performs other actions with personal data.

Consequently, when hiring an employee, the employer, having properly prepared all the necessary documents, will be the operator processing personal data.

What is not a trade secret

Disclosure of not all information will result in dismissal for violating trade secrets. Art. 5 of Federal Law No. 98-FZ of July 29, 2004 “On Trade Secrets” and Decree of the Government of the RSFSR No. 35 of December 5, 1991 contain a list of information that cannot be a secret, for example:

• constituent documents of a legal entity;
• information on the number, composition of employees, the remuneration system, and the availability of available jobs;
• information about violations of the legislation of the Russian Federation and facts of prosecution for committing these violations;
• reporting on financial and economic activities;
• documents on solvency.

Results

So, the processing and distribution of personal data without the consent of its owner is a violation of the law, which entails holding the violator accountable.
However, situations are possible when the legislator exempts a person authorized to work with personal data from the obligation to obtain consent to their processing. For example, if a person simply cannot imagine it due to health reasons. You can find more complete information on the topic in ConsultantPlus. Free trial access to the system for 2 days.

What is a trade secret?

Disclosure of this information, on the contrary, will lead to the dismissal of the employee for disclosing a trade secret:

• about future recruitment of employees; on hiring managers, specialists and negotiations with them;
• on the turnover of the organization’s funds;
• about the cost of production, about the level of profitability;
• about the organization's market strategy;
• about customers, contractors, suppliers, clients, consumers, buyers, competitors;
• about the state of software and computer support of the enterprise;
• on the use of promising technologies, technological processes, equipment;
• documented ideas, inventions, discoveries, individual formulas, know-how.

Art. 3 of Federal Law No. 98-FZ of July 29, 2004 contains a definition of a trade secret as a regime of information confidentiality. Disclosure of classified information means an action or inaction as a result of which data becomes known to third parties without the consent of the owner of such information or contrary to an employment or civil law contract.

IMPORTANT!

A feature of maintaining secrecy in budgetary organizations and government agencies may be access to state secrets, which are not classified as commercial secrets and represent a separate type of confidential information. For example, in such structures there are often official secrets.

Judicial practice on dismissal for disclosure of trade secrets also helps to understand what is recognized as disclosure. For example, an employee sent information to someone else’s email (Appeal ruling dated May 30, 2018 No. 33-23467/2018), reported information about clients (Appeal ruling dated November 26, 2015 in case No. 33-44248/2015), sent information to personal email (Appeal ruling dated September 12, 2018 in case No. 33-39235/2018), copied data onto a flash card (Appeal ruling dated May 30, 2018 No. 33-23467/2018), did not block the computer (Determination dated September 23, 2013 No. 4g/8-7616), posted the information in the cloud (Appeal ruling dated March 30, 2017 in case No. 33-12211/2017). Such violations will result in dismissal for disclosing secrets.

Types of confidential information are collected in the table:

The law on the protection of personal citizens does not contradict the Constitution of the Russian Federation

The Constitutional Court of the Russian Federation decided that the norm of the Federal Law of July 27, 2006 N 152-FZ “On Personal Data” “On Personal Data”, according to which operators and other persons who have access to personal data are obliged not to disclose to third parties or distribute personal data without the consent of the subject of personal data does not contradict the Constitution of the Russian Federation.

The essence of the dispute

To the Constitutional Court of the Russian Federation with a complaint about the inconsistency of the Constitution of the Russian Federation with Article 7 of the Federal Law of July 27, 2006 N 152-FZ “On Personal Data”, according to which operators and other persons who have access to personal data are obliged not to disclose to third parties or distribute personal data without the consent of the subject of personal data, unless otherwise provided by federal law, a citizen applied. The applicant was refused to provide information on third parties who had previously been her colleagues at the educational institution. The citizen considered that this provision contradicts Part 4 of Article 29 of the Constitution of the Russian Federation, since it allows law enforcement agencies to refuse to provide information necessary to protect the violated rights of a citizen.

The court's decision

By ruling No. 1158-O dated May 26, 2016, the Constitutional Court refused to accept the citizen’s complaint for consideration. The judges noted that the Constitutional Court of the Russian Federation has repeatedly indicated that the concept of “private life” includes only that area of ​​human life that relates to an individual, concerns only him and is not subject to control by society and the state if it is not illegal in nature. Therefore, restrictions on the disclosure and dissemination of information relating to personal data are aimed at ensuring a reasonable balance of constitutionally protected values. In this regard, the norm of law challenged by the applicant cannot be considered as violating her constitutional rights in the aspect specified in the complaint.

Evidence base for dismissal for disclosure of trade secrets

When the question arises of how to fire an employee for disclosing a trade secret, proof of the violation will play an important role. An organization may have certain controls in place. But in order to apply them, it is necessary to warn employees, otherwise the dismissal will be considered illegal. Here are the most common:

1. CCTV. It is important to warn and obtain employees’ consent to the processing of personal and biometric data.
2. Control over work on the computer (on the employer’s equipment).
3. View mail. It is important to comply with the provisions of Art. 23 of the Constitution of the Russian Federation. The employer has the ability to view recipients and send letters from corporate mail. If an employee has opened his personal email on his work computer, the employer cannot view it.
4. Internet usage control - filtering web traffic, using recording devices. For example, using work Wi-Fi on your personal phone.
5. Tracking publications on social networks. For example, if an employee uploads a work video of persons from whom there is no consent.

When an employee is held accountable for disclosing a trade secret (in our case, in the form of dismissal), all justifications need to be checked:

1. The organization has information related to a secret protected by law, i.e. a trade secret regime has been established.
2. The disclosed information became known to the employee in connection with the performance of his job duties, and the employee undertook not to disclose it.
3. The necessary local regulations (Regulations on Trade Secrets) have been adopted, a list of information and a list of employees have been approved, additions have been made to employment contracts and job descriptions, the stamp “Trade Secret” has been marked on documents, and conditions for storing documents have been provided.

Responsibility for violation of the law

According to Part 1 of Art. 6 of Law No. 152, in order to process personal information, it is necessary to obtain the consent of the person to whom it belongs. The use of personal data without consent, as a general rule, is a violation of the law and entails bringing the person responsible for its processing to disciplinary, administrative and even criminal liability (Part 1 of Article 24 of Law No. 152).

Thus, an employer can reprimand an official employee of an organization for improper performance of his official duties or reduce the amount of an incentive payment (bonus), provided that this type of punishment is provided for by the collective agreement in force at the enterprise or other local document.

Administrative liability for processing data without the consent of the person to whom it belongs provides for the imposition of a fine on the violator in the amount (Part 2 of Article 13.11 of the Code of Administrative Offenses of the Russian Federation):

• 6–10 thousand rubles. - on citizens;
• 20–40 thousand rubles. - on officials;
• 30–150 thousand rubles. - for legal entities.

ATTENTION! As of March 27, 2021, fines for violations when working with personal data have increased. See details here.

Criminal liability arises for the illegal collection of information about a person’s private life (including personal or family secrets), as well as for unlawful access to computer information containing such information (Articles 137, 272 of the Criminal Code of the Russian Federation).

In addition, the subject of personal data may demand from the violator compensation for moral damage caused to him (Part 2 of Article 24 of Law No. 152).

Roskomnadzor monitors compliance with legislative requirements in the field of personal information.

The Guide from ConsultantPlus will help you competently organize work with personal data of employees. If you do not already have access to this legal system, trial access is available for free.

Dismissal procedure for disclosing trade secrets

For violating the trade secret regime, that is, disclosing confidential information, an employee can be subject to disciplinary action. We strictly follow the procedure for dismissal for disclosing trade secrets in order to avoid negative consequences when going to court.

STEP 1. We record the offense. We reflect the identified violation in a report and draw up an act on the disclosure of trade secrets. The documents record the failure or improper performance by the employee of his assigned job duties. A disciplinary offense must be recorded in an act drawn up in the presence of two or more witnesses.

STEP 2. Collect a commission. To do this, we issue an order to create a commission on internal inspection, indicating the basis for the inspection and the timing of the commission’s work. She must establish the fact of disclosure.

Step 3. We demand an explanation from the employee. Before dismissing an employee for disclosing a secret, he must be asked for a written explanation. Art. 193 of the Labor Code of the Russian Federation allows 2 working days to wait for an explanation. If the employee is absent, the request is sent by a valuable letter with notification to all known addresses or by telegram with personal delivery. Or the notification can be sent by courier. It is necessary to obtain a confirmation of delivery and an inventory of dispatch with a stamp, as well as a certificate from the post office confirming the delivery of the telegram. In case of refusal to serve the request for explanations or absence of explanations, we draw up a statement of refusal. Failure to provide an explanation does not prevent the imposition of a penalty, that is, dismissal for disclosure.

Step 4. We draw up an inspection report. During the inspection, we collect and study documents related to the violation. We check materials related to the establishment of a trade secret regime.

Based on the results of the commission’s work, we issue an inspection report. The employee must be made aware of it. If he refuses, then we draw up an act of refusal.

STEP 5. We hold you accountable. Depending on the results of the commission’s work, a disciplinary sanction may be applied to the violator in the form of a reprimand, reprimand, or dismissal.

In the Labor Code of the Russian Federation, disclosure of a trade secret entails dismissal under subparagraph “c” of paragraph 6 of part 1 of Article 81. When deciding to apply this article to an employee, a number of actions should be carried out aimed at checking whether the organization has established a trade secret regime and whether the procedure for attracting disciplinary liability in accordance with the law.

To dismiss for disclosure, we issue an order and make the necessary entries in personnel documents (personal card, work book).

Journalists must obtain consent to use images and personal data of citizens

If a journalist has not received the citizen’s consent to publish information about him and photographs in the media, then he has violated the law and must compensate the citizen for moral damages. This is what the St. Petersburg City Court decided.

The essence of the dispute

The citizen filed a claim with the district court of St. Petersburg against the Komsomolskaya Pravda Publishing House CJSC to declare the distribution of personal data by the Komsomolskaya Pravda newspaper, as well as his personal image, illegal. In addition, the citizen asked to recover compensation for moral damage from the newspaper’s editorial office and to publish a refutation in the next planned issue of the Komsomolskaya Pravda newspaper. The reason for such an appeal to the court was the fact that the Komsomolskaya Pravda newspaper, registered as an electronic media outlet with the Federal Service for Supervision of Communications, Information Technologies and Mass Communications, published an article on the Internet. This article contained an interview between a journalist and a citizen with the placement of his personal photograph. The article mentions information about the citizen’s personal life, which for the most part does not correspond to reality, as well as his personal data. Since the citizen is sure that he did not give such an interview, did not take any part in the publication of the article, and also did not give anyone permission to publish his image, including in this newspaper, he went to court.

Maintaining trade secrets after dismissal

Trade secrets after the dismissal of an employee also remain a pressing issue. After all, the information in an employee’s head does not go anywhere, and he can pass it on to competitors. Therefore, the employer often includes a clause in the employment contract according to which the employee does not have the right to disclose secret information for 3 years after dismissal. If an employer discovers a violation after dismissing an employee, he can file a statement with the police. But it is unlikely that the case will be initiated and it will be possible to compensate for the damage from the disclosure of the secret. This is justified by the fact that after dismissal the employee has no obligations towards the employer.

This position has been repeatedly emphasized by the Ministry of Labor. For example, Information Letter of the Ministry of Labor and Social Protection of the Russian Federation No. 14-2/B-942 dated October 19, 2017 explains that if an employment contract provides for a clause prohibiting an employee from performing certain actions for any time after dismissal, then such a condition is contrary labor legislation and limits the rights of the employee. For example, you cannot be prohibited from applying for a job in a competing organization. The rights and freedoms of man and citizen can be limited by federal law only to the extent necessary in order to protect the foundations of the constitutional system, morality, health, rights and legitimate interests of other persons, ensuring the defense of the country and the security of the state (Part 3 of Art. 55 of the Constitution of the Russian Federation).

Contents of the obligation

The legislation does not have uniform requirements for the content of the obligation to non-disclose personal information of employees. But special requirements have been established for responsible persons processing personal data without automation. In this case, they must be informed about:

• the fact that they process this type of data without the use of automation tools;
• categories of data to be protected;
• features and rules for their processing established by law and local legal acts of the organization.

It is advisable to include all these conditions in the obligations of other employees who, due to the nature and nature of their activities, gain access to confidential data.

Also, the non-disclosure obligation must contain an open list of information to which the employee has access and which he must not disclose:

• biographical data of citizens;
• their places of work and residence, telephone numbers;
• email addresses, etc.

Material on the topic Roskomnadzor told what to include in the personal data processing policy

Next, you need to provide a place for the employee’s signature confirming that he:

• understands that in order to perform his job duties he is given access to the personal data of other employees or other persons;
• familiarized with the contents of Art. 90 of the Labor Code of the Russian Federation on liability for disclosure of data;
• knows and applies in work local documents (instructions, regulations, etc.) containing requirements for the storage and processing of personal data (these local documents may be different for different categories of employees).

Do you all need to register with Roskomnadzor?

There may be a feeling that for a long time now all employers need to run to Roskomnadzor and register as a personal data operator. However, it is not. Here are the exceptions:

• the collection of personal data of a citizen by the operator is carried out in connection with the establishment of labor relations;
• personal data is collected for the purpose of concluding an agreement, without subsequent transfer and distribution to third parties, it is also provided for the use of personal data only for the execution of an agreement with a citizen;
• processing of personal data that is in the public domain;
• collecting the last name, first name and patronymic of citizens without indicating a telephone number or e-mail;
• personal data is collected for the purpose of allowing a citizen to enter the territory of the operator collecting the data once, or in similar cases;
• collection, processing and storage of personal data is carried out on paper without the use of automation tools. By the way, you can store your paper archive, including personnel documents and personal data, outside the office. This way you can avoid their loss and unauthorized access to information.

In all other cases, registration is required!

Don’t forget that Delis Archive has a “New Year’s” promotion - we give useful gifts to current and future clients!