Ex-Employee Took Your Client List? What a Malaysian Company Can Do

Is a client list confidential information?

Often it is. Malaysian courts ask whether the information has the necessary quality of confidence, whether it was given to the employee in circumstances creating an obligation of confidence, and whether it was used without authority, following Coco v A N Clark (Engineers) Ltd [1969] RPC 41.

A list the business has built up over time, with the decision makers at each client, what they buy, what they pay and when their contracts renew, is not available to the public and usually meets that test. So do internal pricing, margin and quotation data, and the records kept in a CRM system.

A list of company names that anyone in the industry would know, or contacts the employee brought with them or remembers from years of dealing, is much harder to protect. The Federal Court in Dynacast accepted that a former employee may use their own knowledge and experience, including knowledge of potential customers, and that setting up a competing business is not in itself unlawful.

What should the company do in the first 48 hours?

Evidence of copying is easiest to secure immediately, and it is the foundation of any court application. In the first two days:

• suspend the employee's access to email, CRM, shared drives, cloud storage and business messaging accounts;
• collect company laptops and phones and do not use them, so that a forensic copy can be taken;
• export audit logs showing downloads, CRM exports, email forwarding rules and transfers to external drives or personal accounts;
• identify the clients and prospects affected, with the dates of any recent contact or lost business;
• note who else may have been involved, inside or outside the company;
• take advice before interviewing the employee or confronting anyone.

Do not log in to the employee's personal email, social media or devices. Accessing a computer or account without authority may be an offence under section 3 of the Computer Crimes Act 1997, and evidence obtained that way can undermine the company's case.

Should you send a letter of demand first?

Often, but not always. A letter of demand can ask the former employee and their new business for written undertakings to stop using the information, return or deliver up all copies, disclose who received it and confirm which clients have been approached. Prompt undertakings can resolve the matter at a fraction of the cost of litigation.

Where there is a real risk that evidence will be destroyed once the employee is warned, the company may instead apply to court without notice for a search order, known as an Anton Piller order, together with an injunction. These applications require strong evidence and full and frank disclosure to the court, including facts that help the other side.

What orders can the court make?

The court can make orders at an early stage to protect the position until trial, and final orders after trial:

• an interim injunction restraining the use or disclosure of the information or dealings with identified clients, applying the approach in Keet Gerald Francis Noel John v Mohd Noor @ Harun bin Abdullah & Ors [1995] 1 MLJ 193;
• a search order allowing the company's solicitors to enter premises, under strict safeguards set by the court, to preserve evidence;
• orders for delivery up or destruction of documents and data, and an affidavit identifying everyone who received them;
• after trial, a permanent injunction, damages or an account of profits, and costs.

When it seeks an interim injunction, the company normally gives an undertaking to compensate the defendants if the injunction later proves to have been wrongly granted. The orders sought should be no wider than the evidence supports.

Can the company also sue the new employer or the new business?

Yes, where the evidence supports it. A business that knowingly receives and uses another company's confidential information can be liable for breach of confidence, and the people behind it may face claims for inducing breach of contract, conspiracy or dishonest assistance.

Those claims depend on what the new business and its owners knew. Proof that they received the client list knowing where it came from, or encouraged the employee to bring it, is very different from a business that simply hired someone experienced. The claim should be pleaded separately against each defendant, with the facts that support it.

Can the company make a police report?

Sometimes. Under section 130 of the Personal Data Protection Act 2010, it is an offence for a person to knowingly or recklessly collect or disclose personal data held by a data user without the data user's consent. Customer records containing names, phone numbers and email addresses of individuals are personal data. Unauthorised access to company systems after the employee has left may also fall under the Computer Crimes Act 1997.

A criminal complaint does not recover the company's losses or stop the information being used, and it is handled by the authorities on their own timetable. It should be coordinated with the civil claim rather than used instead of it.

What mistakes weaken a claim?

Claims of this kind most often fail or shrink because of avoidable mistakes:

• describing the information only in general terms, contrary to the particularity the Federal Court required in Dynacast;
• claiming that everything the employee knew was confidential, which invites the court to reject the whole claim;
• waiting weeks before applying for an injunction, which undermines the urgency the application depends on;
• relying on a non-compete clause that is void under section 28 of the Contracts Act 1950;
• obtaining evidence unlawfully;
• dismissing an employee without a fair inquiry, which can lead to an unfair dismissal claim under section 20 of the Industrial Relations Act 1967 alongside the civil case.

How can a company prevent this happening again?

Prevention costs far less than litigation. The most effective measures are:

• employment contracts with clear confidentiality, return of property and conflict of interest clauses, and a narrow non-solicitation clause instead of a non-compete;
• access to client data limited by role, with alerts on bulk exports and forwarding to personal accounts;
• a written exit process covering device return, account closure and a signed confirmation that no copies have been kept;
• regular reminders to staff about confidentiality and about disclosing outside business interests.

We draft and review these documents as part of our employment contracts and HR compliance work. For the wider picture, including how these claims are defended, see Ex-Employee and Competitor Disputes in Malaysia.