Last month’s Employment Law Commentary discussed the high level of international attention now being paid to protecting trade secrets from misappropriation, with recommendations for practical steps that companies may take to prevent misappropriation. This month’s issue follows on with a discussion about how to build a workforce culture of data security protecting not only trade secrets, but also personal information and third-party confidential information in the possession of most businesses. As illustrated by Edward Snowden’s activities, no organization is immune from the insider threat posed by a determined individual. Even well-intentioned employees pose an inside risk when they fall victim to sophisticated “spear-phishing” attacks. The perennial risk from insiders, currently put in the spotlight by Snowden and spearphishing, allows businesses to educate employees about prevention of data breaches while appealing to both employees’ personal interest in their privacy, as well as the corporate interest in confidentiality.

An Overview of Snowden’s Activities -

Whatever one’s belief may be about where Snowden belongs on the traitor/hero spectrum, his activities highlight the risk posed by an insider with privileged access normally given to IT professionals. Snowden’s revelations have raised citizens’ concerns about the privacy of their personal data, corporate concerns about deterring similar breaches of confidentiality in the future, and similar concerns on the part of the U.S. and foreign governments. In 2014, businesses now have an opportunity to educate their employees about data security in a manner that appeals to both their personal interest in privacy of personal information, in addition to their duties to protect corporate confidentiality.