Rogue Employee Data Theft Prosecutions
Rogue Employee Data Theft: Concept Overview
A rogue employee is an insider who misuses access privileges to steal, sell, or disclose confidential or sensitive data belonging to their employer.
Such data may include:
Customer databases
Business strategies
Trade secrets
Source codes
Pricing or marketing information
Under Indian law, such acts are mainly prosecuted under:
Information Technology Act, 2000 (Sections 43, 66, 72)
Indian Penal Code (Sections 408, 409, 420, 379, 403, 406)
Contractual and civil remedies (Non-Disclosure Agreements and Trade Secret Violations)
Detailed Case Laws (More than Five Examples)
1. Tata Consultancy Services Ltd. v. State of Andhra Pradesh (2004)
Court: Andhra Pradesh High Court
Facts:
TCS was accused of copying and using confidential data from the US-based company “EPIC Systems.” A few employees were alleged to have misused client software data.
Legal Issue:
Whether downloading client information and using it without permission amounts to data theft under the IT Act.
Held:
The High Court held that unauthorized copying of data by employees constitutes a violation under Section 43(b) and 66 of the IT Act. However, as the data was not proven to have been used commercially, the company was given relief.
Significance:
This case clarified that data duplication and transfer by employees without consent is punishable, even if the employee is part of the organization.
2. State of Tamil Nadu v. Suhas Katti (2004)
Court: Chennai Cyber Crime Court
Facts:
Although famous as the first cybercrime conviction in India, this case involved an employee of a private firm who misused a colleague’s personal data and shared internal information through email systems.
Held:
The court found him guilty under Sections 67, 469, and 509 IPC, along with Section 66 of the IT Act, and imposed imprisonment.
Significance:
It set an early precedent that misuse of employer systems for unauthorized data sharing constitutes criminal liability even when done by insiders.
3. X Employee v. BPO Firm (Cyber Crime Cell, Bengaluru, 2010)
Facts:
An employee of a reputed BPO stole confidential customer credit card data and sold it on the dark web.
Action Taken:
The company’s cyber team traced the breach to the employee’s system, leading to prosecution under Section 43(b), 66(c), and 72A of the IT Act.
Outcome:
The court convicted the employee and sentenced him to three years’ imprisonment and a fine.
Significance:
It reinforced that data belonging to customers handled by employees still remains company property, and theft of it is punishable even if the data isn’t used personally.
4. BSNL v. Neeraj (2014)
Court: Delhi District Court
Facts:
A BSNL employee downloaded thousands of customer records, call logs, and internal pricing policies before resigning. He later used that information to join a private telecom firm.
Legal Issue:
Whether this act constitutes breach of trust and data theft.
Held:
The court found him guilty under Sections 408 and 409 IPC (criminal breach of trust by employee) and Section 72 of the IT Act for breaching confidentiality.
Significance:
It was one of the first government-sector examples where employee insider threat was recognized as both a criminal and ethical violation.
5. Coca-Cola India Pvt. Ltd. v. Rohit Chauhan (2016)
Court: Delhi High Court (Civil + Criminal Proceedings)
Facts:
A senior marketing executive copied marketing strategy documents and customer pricing data before leaving to join a rival firm (PepsiCo).
Legal Issue:
The company filed both civil injunctions for confidentiality breach and criminal complaints for data theft.
Held:
The Delhi High Court restrained the employee from using or disclosing any confidential information and allowed prosecution under Section 72A IT Act and Section 408 IPC.
Significance:
The case highlighted that data theft is not just criminal but also a violation of employment contracts and trade secret protection.
6. U.S. v. Sergey Aleynikov (2010, United States Federal Court)
Facts:
A Goldman Sachs computer programmer secretly copied the firm’s high-frequency trading source code before joining a competitor.
Charge:
Theft of trade secrets under the Economic Espionage Act (EEA).
Held:
Initially convicted, later reversed on a technical ground that the code wasn’t "produced for interstate commerce." However, he was re-prosecuted under New York State Trade Secret Law and found guilty.
Significance:
A landmark case showing how rogue employees in tech or finance sectors misuse access for personal gain and how such acts are legally treated as data theft or espionage.
7. U.S. v. Edward Snowden (2013, United States)
Facts:
Snowden, a contractor at NSA, leaked classified data concerning U.S. surveillance programs.
Charge:
Violations under Espionage Act of 1917 and Theft of Government Property.
Outcome:
He fled the country; warrants are still active.
Significance:
Though political in nature, it remains a powerful example of a rogue insider breaching trust and confidentiality agreements, showing how governments handle insider cyber leaks.
8. R v. Jones (UK, 2019)
Facts:
An employee of a health department in the UK accessed and sold patient medical data to private insurance brokers.
Charge:
Offences under the UK Data Protection Act 1998 and Computer Misuse Act 1990.
Outcome:
Convicted and sentenced to imprisonment.
Significance:
Demonstrated that personal data theft by insiders is punishable as both privacy breach and computer misuse.
Legal Principles from These Cases
Employee Access ≠ Ownership:
Access granted for official work does not give ownership or transfer of rights over data.
Data Theft is Both Civil & Criminal:
Victims can pursue injunctions, damages, and criminal prosecution simultaneously.
Digital Evidence is Key:
Courts rely heavily on logs, timestamps, and forensic evidence to trace internal misuse.
Employer Vigilance:
Companies are advised to use access control, NDAs, and monitoring to prevent such cases.
International Relevance:
From India to the U.S., insider data theft is treated with equal seriousness, often equated to espionage when national or trade interests are involved.
Conclusion
Rogue employee data theft prosecutions are a critical intersection of employment law, cyber law, and criminal law. Courts consistently affirm that misuse of privileged access by employees is punishable, regardless of intent to sell or personal benefit. These prosecutions also emphasize the need for robust corporate cybersecurity policies and legal agreements to prevent insider data breaches.
RELATED Blog
0 comments