Investigations & evidence · employee and leaver enquiries
The pattern repeats itself: files funnelled into a personal cloud account, a USB stick used at some ungodly hour, and a laptop returned to you looking suspiciously like new. As for digital evidence of all of it, this is usually left behind. We then recover it (lawfully) through prompt, secure handling and examination of the device to an evidentially acceptable standard. This will allow you to present a credible written report to both HR and your legal representatives.
A quiet word, in confidence
0800 6890668
| What's needed | The practical effect | Our answer to it |
|---|---|---|
| UK GDPR / DPA 2018 | A lawful basis is needed for accessing even a device owned by the company. This would typically be under the 'legitimate interests' legal basis, but it must always be proportionate and properly documented. | The scope remains as narrow as possible: the data collected is based only on the level of justification for suspecting wrongdoing. |
| The ICO's monitoring guidance, October 2023 | By default, transparency is required. However, a Data Protection Impact Assessment (DPIA) needs to be completed if the risk level is high. | First we review your company's policies. Then, we determine if an assessment is necessary and let you know. |
| Covert examination | There are to be very few occasions when this can happen, i.e. when criminal activity or a serious breach of professional conduct is suspected, and then only with senior authorisation | We will not commence the process until we see that signed document in front of us. |
| ACAS expectations | All disciplinary actions must be based on a reasonable and impartial investigation. | Our examination is carried out independently; no one edits the findings of our examination. |
| How tribunals weigh it | The probative value of the material collected is weighed against the method used to collect the material. | Custody records that support and enhance the evidence rather than undermine it. |
When you instruct us on a new matter, we will first hold a confidential conversation about what has occurred, which devices/accounts matter and what the evidence needs to establish. Following this, you will receive a single written quote, fixed prior to any examination commencing, and the initial scope of works does not incur any cost.
Once your laptop, desktop computer or loose hard drive is placed behind a write blocker, it will be imaged in a matter of days. This imaging process occurs before any reissue or rebuild process takes place and before anyone else who may have access to your equipment destroys evidence.
This image has details of activity relating to USB connections, synced data from the cloud, history of webmail access, patterns of deletion as well as any use of wiping tools. This information will be put together in one timeline indicating what left, at what time it left, and via which route.
We create a clear and detailed written report regarding your case. It is created in a format suitable for both HR and legal purposes. Throughout this report we have considered guidance provided by the ICO in their 2023 monitoring guidance and the standard expected of a fair investigation according to ACAS.
You get everything: the report, all of the exhibits and the files behind each exhibit, as well as the hashes, the continuity record and our working notes. If at some time in the future a tribunal or another expert wishes to verify anything, they will be able to follow the entire chain of evidence from start to finish.
A single number that has credibility: in a 2013 Symantec/Ponemon study, approximately half of recent former employee respondents admitted to keeping confidential information from their previous employers. More recent percentages are mostly generated by vendors and have varied significantly. Bench experience is simpler; if an employer already believes data walked, then artefact agreement typically follows.
The initial tip-off was a competitor's pitch deck that landed on the desk of an employer in Barnstaple. Next came a series of digital timelines which told a story in itself: a single folder collecting all of the documents, access to a personal cloud account by signing in, then finally the uploads were completed, all twenty days prior to any resignation letters being sent in. Undertakings shut it down quickly.
Yes, generally speaking: provided that a lawful basis for examination existed and that employees were aware that an examination could occur based upon an acceptable-use policy. Covert examinations are relatively rare. They require authorised permission at the senior levels and are limited to situations involving possible criminal conduct by the employee, or serious breaches of employee discipline.
Rarely. The ICO's October 2023 advice states that covert monitoring can only take place under extraordinary conditions (suspected crime being the classic case), with senior approval of the monitoring, with limited scope for the monitoring and with a formal record of the monitoring.
Just put the device in a safe place and don't touch anything. Don't shut down their accounts or remove any of their contents, and have the device imaged prior to anyone in your organisation looking into it. The reason for this is that even if you merely browse through the files, you will destroy the traces as to how the information was removed.
When tribunals assess the usefulness of materials versus the methods used to obtain them, these three elements will make the difference between a folder full of screenshots and evidence which actually carries real weight: a lawful basis for obtaining the material; the scope of the investigation or access remaining proportionate; and evidence collection activities being properly documented as part of a chain of custody.
When recorders overwrite on a loop, all recorded evidence will weaken and time limitations expire, so open your case now. The first review is completely free and confidential.