[Question] Disciplinary action warrented?

[renate109]

Hi

An employee, who is employed since 2002, got since a few years more and more unrealiable in terms of quality and quantity of work delivered. The business is small and at first we asked him to check his work and be more focused. However his non-delivery and bad attitude escalated especially since end of last year. We had our suspicions that he does other work during our his work time and even after business hours and these were now confirmed.

We also determined after we investigated files which he stored on our company laptop, but is exclusively used by him, that he accessed and copied internal salary data in the time period from 2004 - 2008. He still has had these stored on that laptop. He also copied and stored a propriety registration tool to register software users of our propriety software. However, we do not have proof that he sold and registered our software and received the money in his account.

Can we still have a dispinary hearing regarding him accessing management PCs somehow and copy confidentials salary information, although this happened years ago (2004 -2008)? However he still had this data stored?

Thanks very much for an answer. Regards Renate

[HR Solutions]

You say "somehow" - perhaps u need to first find out how he did all of this and get proof.

[adrianh]

What outcome are you looking for at the end of the day?

[renate109]

You say "somehow" - perhaps u need to first find out how he did all of this and get proof.

These files are only stored on my computer. He either physically went to my computer in those days and got them, when I was not in the office. During that time we were only three people in the office and he was often on his own in the office. Or he accessed a backup, which might have not been secured.

Regards Renate

[renate109]

Any disciplinary action which is approbriate. I am just wondering if I can still have a hearing/enquiry even though it was done the last time in 2008, but he has had still this files stored on the company laptop he is using.

[HR Solutions]

Renate - if he accessed a backup which might not have been secure - then unfortunately you don't really have a leg to stand on.
Why are you only visiting this now if it happened over 7 years ago. Why not concentrate on what he is doing now ..... is he working well or not / in which case address the current problem.

[Reuleaux]

I agree with HR Solutions on this one. Address the current problem(s) and for goodness sake, follow the correct disciplinary procedures.
Attempting any form of disciplinary action now on something that happened years ago is going to potentially cost you a small fortune at the CCMA.

Good luck!

[renate109]

Renate - if he accessed a backup which might not have been secure - then unfortunately you don't really have a leg to stand on.
Why are you only visiting this now if it happened over 7 years ago. Why not concentrate on what he is doing now ..... is he working well or not / in which case address the current problem.

Thanks for your great advice. I will do so.

[Electrode]

I can only offer you a way to safeguard against the copy of data.

Data theft is common place and can be very serious regarding any company. I would recommend that you find a person knowledgeable in legalities and have a policy drafted and implemented.

A data protection policy must include;

• Acceptable use policy.
  This policy must spell out what the employee may have access to and how he may use the information
  
  
• Data classification policy
  This policy must spell out what data is available to the employee and what data is considered private company data.
  
  
• Retention Policy
  Your retention is all the data that you will keep after the employee leaves the company and what the employee may do with that date that he is allowed to keep. This policy include both the data, e-mail and hardware and today it also include any mobile phone or tablet that was given to the employee as well as the supplied data, software and other devices that may plug into the computer. This include the SIM card that has all the contact information on it. Thumb Drive and external hard drives and any other data storage device like RW CD, RW DVD or any other assets.

It must be comprehensive to work properly and must include protection and safeguards to prevent access, theft of confidential data. General policies must also limit the employee's use of the computer hardware, software or data.

The new policies might have a impact on productivity depending on how invasive your procedure is.

Procedure and disciplinary procedure must be outlined and followed to the letter without exception. This will give you a strong footing to take both disciplinary and legal action in the future.

I would also consider professional advice when you enter into disciplinary action as employees with this type of behaviour will go to the CCMA to strong arm you. Rather be prepared for this eventuality.

[renate109]

Thanks for your great advice. I will do so.

[adrianh]

How do you stop people from copying information onto memory sticks or even taking photographs of products and screens. I don't think that there is a real solution anymore. Everybody has a smartphone with lots of memory and a powerful camera.

[HR Solutions]

How do you stop people from copying information onto memory sticks or even taking photographs of products and screens. I don't think that there is a real solution anymore. Everybody has a smartphone with lots of memory and a powerful camera.

Not only that - but putting the info into dropbox is even easier. All they need to do is open their dropbox account at home and the info is all there.

[adrianh]

True, and with dropbox they are able to quietly download the entire server since cloud data space is no longer an issue.

[Electrode]

What many companies do to combat photography is to force employees to place their mobile devices in a small locker.

You can also by company policy log all traffic on your internet connection. Our network administrator can monitor all traffic including browser history, sites visits and amount of data that was consumed by each user. Our office computers can only access specific websites and even content uploads are limited by size and file type.

Thumb drive, CD or DVD drive can also be disabled. The employee will not be able to access external email or use thumb drives, CD or DVD burner to copy data.

I am not sure what is possible on a standard home network. Perhaps bringing in a professional network administrator maybe a more prudent course of action

[adrianh]

What many companies do to combat photography is to force employees to place their mobile devices in a small locker.

I don't think that this will fly in 99.99% of companies.People carry cellphones, tablets and some have smart-watches. Be that all that it may, cameras can be brought in in pens and all sorts of other objects.

It seems to me that the only thing to do is to give people access to the absolute minimum information, of course that leads to all sorts of problems.