Former owners stayed on as staff - then downloaded company data

Two former business owners stayed on as employees after selling up. Then the data downloads started.

New Zealand's Employment Relations Authority has sent a confidential information dispute to the Employment Court, finding the case too complex and the stakes too high for the Authority to resolve alone.

The determination, issued on October 13, 2026, centres on a post-acquisition employment arrangement that went wrong fast. After selling their business, two former owners agreed to stay on under 12-month fixed-term employment agreements. Those agreements included clauses protecting the company's confidential information, including non-disclosure obligations.

Five downloads in three months

In June 2026, the employer discovered that one of the former owners had downloaded a large volume of company data onto local file storage and an external hard drive - on at least five separate dates between April and June 2026. Some of that data had been emailed to personal email addresses. The second former owner, the determination notes, had logged onto the company's VPN from two unmanaged devices.

The former owners acknowledged the downloads. They confirmed that one of them had downloaded the data and that some of it had been emailed to the other. But they maintained they had not disclosed any of the company's information beyond that, and they agreed to submit their devices to a forensic examination.

The employer moved quickly. It secured interim orders from the Authority across two preliminary determinations - a full forensic review of the former owners' personal devices and accounts, plus the irretrievable deletion of any confidential information found on them.

Then things got messier

A chain-of-custody dispute emerged. Some of the devices containing company data had passed through the hands of the former owners' solicitors and a third party engaged without the employer's agreement. That raised concerns that devices may have already been cloned without authorisation.

The former owners, for their part, raised personal grievances against the employer over their suspension, the uplift of their devices, and the restrictions placed on their access to company systems and premises. The employer disputed those grievances, arguing its response was justified by the evidence.

The push for a higher court

With the forensic examination still incomplete and the dispute widening, the employer applied to have the entire matter removed to the Employment Court under section 178 of the Employment Relations Act 2000 - a provision that allows cases to be escalated from the Authority when certain thresholds are met.

The employer argued this was not an ordinary employment dispute. Its initial evidence was that the data at issue included passwords, reset information, and other highly sensitive material. Third parties whose confidential information might be at risk were not before the Authority. And until the forensic examination concluded, nobody could confirm what data existed on which devices, where it had been sent, or whether all copies had been irretrievably deleted.

The former owners pushed back. The Authority had already granted urgency and handled the interim relief, they argued. Once the forensic work was done, the remaining claims were straightforward employment agreement disputes - squarely within the Authority's jurisdiction. There was no public interest, they said, and nothing the Authority could not determine itself.

The Authority's call

The Authority sided with the employer.

It acknowledged the matter had not yet been fully investigated and that removal is, as the Court of Appeal has recognised, "contemplated in relatively limited circumstances." But two grounds justified escalation.

First, the nature and urgency of the claims warranted removal to a court with stronger tools. The Employment Court has access to formal discovery powers under the High Court Rules - meaning it can compel parties to hand over documents in a structured process - and can take sworn evidence in a court of record. The Authority does not have those powers.

Second, practical realities tipped the balance. The Authority pointed to the volume of preliminary manoeuvres already filed, the "somewhat litigious approach" both parties had adopted, and the distinct possibility that whichever side lost would challenge the outcome regardless. Keeping the matter at the Authority level, it found, risked disproportionate costs.

Neither party had taken up the Authority's earlier encouragement to pursue low-level dispute resolution. Mediation was expected once the forensic examination wraps up.

For HR teams managing post-acquisition transitions, the case puts a sharp edge on a familiar risk: confidentiality clauses in employment agreements are only as effective as the monitoring and enforcement behind them - and when former owners stay on as staff with existing knowledge of sensitive systems, data access controls need to be locked down from day one.

The determination was issued subject to an interim non-publication order prohibiting the identification of the parties. The substantive matter, including the alleged breaches of employment agreement obligations and the former owners' personal grievances, has not been determined on the merits. The proceedings have been referred to the Employment Court.