She sent three emails that morning - then handed in her notice
A business development manager who emailed her employer's entire client list to her personal address has been ordered to pay $4,800 in penalties.
The Employment Relations Authority issued its determination on October 20 in a case brought by General HVAC Solutions New Zealand, an HVAC services company, against a former business development manager.
The facts were not in dispute.
On July 7, 2025, the worker sent three emails from her work address to her personal address. The emails had spreadsheets attached, and contained what the Authority accepted was the company's entire active account list, details of new accounts, customer order history, and details of call cycles and territories. Later that same day, she resigned. Her notice was paid out in lieu, and her last day was July 8.
Four days later, the company discovered the emails. It wrote to the worker requiring her to provide certain urgent undertakings - that she had deleted the information and would not use or share it. She provided the first undertaking the same day. A second, broader undertaking followed about three weeks later, after she told the company she was travelling and could not respond immediately.
"The lowest point of my life"
The worker did not deny what she had done. She accepted that her actions breached the confidential information clause in her employment agreement.
Her evidence, though, painted a picture of someone in crisis. She told the Authority she had been deeply unwell at the time of her resignation, was receiving care from her GP, and was experiencing persistent sleep disturbances and suicidal thoughts. She described the period as "the lowest point of my life" and said she was not thinking clearly when she sent the emails.
She also pointed to something from the start of her employment. She said her manager had pressured her to compile a list of client details from her previous industry experience. She said this contributed to a sense that the information was, in some way, her own.
She told the Authority she never used the information for any purpose and never shared it with any other person or organisation. Although the company said she had gone to work for a competitor after resigning, her evidence was that she was unable to work and left that role after a short time. At the time of the hearing, she was in receipt of MSD assistance and had limited financial means.
Three emails, one breach
The company argued each of the three emails was a separate breach of the employment agreement, which would have exposed the worker to a maximum penalty of $30,000. The Authority disagreed.
It found it was "artificial" to treat the emails as three standalone breaches when the worker's motivation and state of mind remained the same, the actions were similar, and everything took place over a single morning. The Authority treated the conduct as a single breach, capping the maximum penalty at $10,000 under section 135 of the Employment Relations Act 2000.
How the number landed at $4,800
Working through the factors required by section 133A of the Act, the Authority found the breach was significant and held the potential for serious damage to the company. It found the worker's actions were intentional - she meant to send the emails to herself - but weighed that against the fact that no actual loss flowed from any misuse or sharing of the information. The company's losses were limited to the management, IT, and legal time it spent identifying and addressing the breach.
On the other side of the ledger, the Authority accepted the worker had responded promptly, cooperated with the company, and provided undertakings. It accepted her evidence about her mental health and her remorse. It noted there was no history of similar conduct.
Setting a starting point of 60 percent of the maximum - $6,000 - the Authority then applied a 20 percent discount for the worker's inability to pay and her personal and health circumstances, bringing the penalty to $4,800. The full amount was ordered to be paid to the company.
On costs, the company sought $4,500, the Authority's daily tariff for a one-day investigation meeting. The Authority found a full day's tariff was too high given the hearing was short and the issues limited, and awarded $2,250 instead - half a day's tariff.
In total, the worker was ordered to pay $7,050 within 28 days.
For HR teams, the case is a practical reminder that exit-day data transfers will be pursued even when the information is never used - but also that penalty outcomes will turn on whether the data was actually exploited, the employee's personal circumstances, and whether a single morning's conduct gets treated as one breach or several.
The determination was issued by the Employment Relations Authority on October 20, 2026. It is a final determination.
