Who Is Liable for Breach of Confidentiality?

A breach of confidentiality occurs when private or sensitive information is disclosed, used, or accessed without proper authority. In England and Wales, liability for such breaches can arise in a wide range of situations, including employment relationships, business dealings, professional services, and contractual agreements such as non-disclosure agreements (NDAs).

Determining who is legally responsible depends on how the duty of confidentiality arises, the nature of the information, and the circumstances of the disclosure. Liability may rest with individuals, companies, employees, directors, or third parties.

What Counts as Confidential Information?

Confidential information is not limited to formal secrets. It can include any information that:

• Is not publicly available
• Has commercial, personal, or professional value
• Was shared in circumstances implying confidentiality
• Is protected by contract, law, or professional duty

Common examples include:

• Business plans, client lists, and pricing strategies
• Personal data protected under data protection law
• Medical or legal records
• Trade secrets and intellectual property
• Internal communications within a company

Legal Bases for Confidentiality Duties

Liability for breach of confidentiality in the UK typically arises from one or more of the following legal sources:

1. Contractual Duty

Confidentiality clauses in contracts or NDAs create legally binding obligations. Breach occurs when a party discloses or misuses protected information contrary to the agreement.

2. Equitable Duty of Confidence

Even without a written contract, courts may impose a duty of confidence where:

• The information has the necessary quality of confidence
• It was shared in circumstances implying confidentiality
• There is unauthorised use or disclosure

3. Statutory Duties

Certain statutes impose confidentiality obligations, particularly:

• Data protection legislation governing personal data
• Financial services and regulated industry rules

4. Employment Duties

Employees owe implied duties of fidelity and good faith to their employer, which include maintaining confidentiality during and after employment.

Who Can Be Liable for Breach of Confidentiality?

1. Employees

Employees are among the most common parties held liable.

They may breach confidentiality by:

• Sharing client lists with competitors
• Taking confidential documents when leaving employment
• Disclosing internal business information on social media
• Misusing personal data

Liability can arise during employment and after termination, particularly where information qualifies as trade secrets or highly sensitive business data.

2. Employers

Employers can also be liable for breaches committed within their organisation.

This may occur where:

• Employees disclose confidential information in the course of their work
• The employer fails to implement adequate data protection or security measures
• Systems are inadequate, leading to accidental disclosure

Employers may also face liability under data protection law if personal data is mishandled.

3. Companies and Business Entities

A company can be directly liable where the breach is committed by:

• Senior management
• Employees acting within the scope of their duties
• Systems or policies that result in unlawful disclosure

Companies may also face liability if they knowingly benefit from confidential information obtained unlawfully.

4. Directors and Senior Officers

Directors may be personally liable in certain circumstances, including:

• Breach of fiduciary duties owed to the company
• Misuse of confidential corporate information for personal gain
• Authorising or permitting unlawful disclosure

Even where actions are taken on behalf of a company, personal liability may arise if duties are breached independently of corporate responsibility.

5. Third Parties

Third parties who receive or use confidential information can also be liable, particularly if they:

• Know or should reasonably know the information is confidential
• Induce or encourage a breach
• Use the information for commercial advantage

This is common in cases involving competitors, consultants, or recipients of leaked data.

6. Professional Advisers

Solicitors, accountants, financial advisers, and consultants owe strict duties of confidentiality to clients.

Liability may arise where they:

• Disclose client information without consent
• Use client information for personal or commercial gain
• Fail to protect sensitive records adequately

Professional regulators may also impose disciplinary sanctions in addition to civil liability.

7. Agents and Contractors

Independent contractors and agents may be liable if they are bound by contractual confidentiality clauses or if an equitable duty arises.

Businesses frequently extend confidentiality obligations to:

• IT service providers
• Marketing agencies
• Outsourced HR or payroll providers

8. Vicarious Liability

An organisation may be held responsible for breaches committed by employees if:

• The breach occurs in the course of employment
• The act is closely connected to authorised duties

This means businesses can face claims even if senior management was not directly involved.

Types of Breach of Confidentiality

Liability can arise from different types of conduct, including:

• Direct disclosure of confidential information
• Unauthorised copying or removal of documents
• Cybersecurity breaches leading to data leaks
• Accidental disclosure through negligence
• Use of confidential information for competitive advantage
• Failure to protect information with reasonable safeguards

Remedies for Breach of Confidentiality

Where liability is established, several legal remedies may be available.

1. Injunctions

Courts may order an injunction to:

• Prevent further disclosure
• Stop use of confidential information
• Require return or destruction of materials

2. Damages

Financial compensation may be awarded for:

• Loss of profits
• Loss of business opportunity
• Reputational damage
• Costs of mitigation

3. Account of Profits

A court may require the defendant to surrender profits made from misuse of confidential information.

4. Delivery Up or Destruction

Confidential materials may be ordered to be returned or destroyed.

Defences to Breach of Confidentiality Claims

A party accused of breach may rely on several defences, including:

• The information was already public
• No duty of confidentiality existed
• Consent was given for disclosure
• Disclosure was required by law or regulation
• Public interest justification (in limited circumstances)

Time Limits for Bringing a Claim

Time limits depend on the type of claim:

• Contract claims: generally 6 years from breach
• Equitable claims: typically 6 years, though subject to equitable principles
• Data protection claims: generally 6 years for compensation claims, with shorter internal complaint timelines in some contexts

Early action is often necessary where ongoing disclosure is occurring.

How Confidentiality Disputes Are Handled

Typical steps in resolving disputes include:

1. Identifying the source and nature of the confidential information
2. Establishing whether a duty of confidence exists
3. Gathering evidence of disclosure or misuse
4. Sending a formal letter before action
5. Seeking interim injunctions where urgent harm is occurring
6. Pursuing litigation in the High Court if unresolved

Many cases are resolved through negotiation or settlement due to urgency and reputational risk.

Common Situations Leading to Liability

• Employees joining competitors and sharing internal data
• Businesses leaking client data through inadequate systems
• Consultants reusing confidential strategies for other clients
• IT breaches exposing customer information
• Directors using company secrets for personal ventures

Final Thoughts

Liability for breach of confidentiality in England and Wales can arise in multiple ways and affect individuals, employees, employers, companies, directors, and third parties. The legal basis may be contractual, equitable, statutory, or implied through employment and professional relationships.

Courts take breaches seriously due to the potential harm to businesses, individuals, and data protection rights. Remedies can include injunctions, damages, and orders to prevent further misuse of information. Understanding who may be liable depends on the role played in the disclosure and whether a duty of confidentiality existed in the first place.