Key Takeaway

• An employee’s transfer of confidential company information to a personal electronic device may violate the federal Defend Trade Secrets Act (“DTSA”) if the company has a policy restricting such transfers and can show that an “improper” or “illegitimate” purpose motivated the employee.

According to New York federal courts, employees who transfer confidential corporate information to personal electronic devices may be committing misappropriation under the DTSA if:

1.  the company directed the employee—through a formal company policy or a contract provision—not to share the information outside of employer issued-devices; and
2. the employee transferred the information outside of an employer-issued device for an “improper or illegitimate purpose.”

In eShares, Inc. d/b/a Carta, Inc. v. Jerry O. Talton, III, 22-CV-10987, 2024 WL 1348829 (S.D.N.Y. Mar. 29, 2024), plaintiff-employer (“Carta”) alleged that, a few hours before it placed its Chief Technology Officer on administrative leave, the CTO bulk-downloaded highly confidential Carta documents to a Carta-issued laptop, and then exported those documents to a non-Carta-issued personal electronic device. While the CTO did not have a contract prohibiting information transfers, Carta’s Data Policy explicitly forbade employees from sending or transferring restricted data outside the company.

In its decision denying the CTO’s motion to dismiss the DTSA claim, the Court held that Carta’s Data Policy satisfied the first requirement, that the company directed the employee not to transmit company information to his personal devices. The Court also held that, although a “close call,” the timing of the CTO’s export and download of the information—mere moments before he was placed on leave—satisfied the second element, that the employee might have transferred the information for an “improper or illegitimate purpose.”

Similarly, in a prior post, we reported that a New Jersey court found that a company sufficiently alleged a DTSA claim that a former employee misappropriated company trade secrets when he e-mailed them to his own personal device, as he was subject to a confidentiality agreement and had to adhere to strict computer security measures. Click here to read the prior post.

Employees must take great care to acquaint themselves with company data policies and not transfer confidential company files to personal devices if prohibited. Conversely, employers must clearly instruct all employees that any such transfers would violate corporate policy.

If you have any questions regarding the information covered in this blog, please contact Daniel Hoffman, John Baranello, Michelle Cho, or your primary attorney at Moses Singer.