The importance of a phishing policy for the employer
My colleague Lauren Pols informed last week in an article about the difference in protection between businesses and consumers when they fall victim to phishing. In summary: consumers do enjoy protection, while businesses do not. They will therefore never be able to hold the bank liable for their damages.
So if, as the owner of the business, you fall into the trap yourself and suffer damage, you will likely never have it compensated, unless you have cyber insurance.
However, it also happens that the business becomes the victim while the mistake was made by an employee. So what if an employee clicked on a link in a phishing message, resulting in damage to the employer? The employer might then be inclined to take action against the employee. Is this possible? Much depends, in our opinion, on the policy that the employer maintains in this regard.
The rule is indeed that an employee is only liable for their fraud, their gross negligence, and for minor negligence if it occurs habitually rather than occasionally. This is a mandatory rule, which means that it cannot be deviated from by contract, except through a collective labour agreement declared universally binding by Royal Decree. It is therefore up to the judge to determine whether the mistake made by the employee in clicking on the phishing link falls under the category of “gross negligence”. In case law, this gross negligence has already been defined as “an unintentional but so gross and extreme error that it is inexcusable”. It is important to know that the extent of the damage plays no role whatsoever in this assessment.
When will the judge rule that the erroneous click constitutes such a gross and extreme error that it is inexcusable? This is a difficult assessment and will, on the one hand, depend on the phishing email itself. If it was fairly obvious that the email was a phishing email, this works against the employee. On the other hand, account can also be taken of the efforts the employer itself made to avoid such situations, including efforts to inform employees about the importance of being very cautious with suspicious emails. If the employer pursues a decisive policy in this regard and regularly informs and trains staff, while also indicating how important it is for the business that this policy be strictly followed, this can work in the employer’s favour. The employer can also express, in the work regulations, the importance it attaches to following the policy. The judge is therefore not obliged to follow this, but can infer from it the importance that the employer itself attaches to it.
Whether the court will rule that the employee’s mistake, in the case of such a decisive employer policy, constitutes a gross and extreme error, is therefore by no means certain. However, if the employer is unable to demonstrate in any way that such a policy exists, the chances that the employee will be held liable are rather slim. After all, how gross and extreme can an employee’s mistake be, if the employer itself cannot show how much importance it attaches to avoiding that mistake?
When the employee can then be held liable, the damage can be recovered from the employee, possibly through deductions from wages.
Another question is whether this can also give rise to dismissal for serious cause? Such a dismissal is only possible when there is a serious failing that makes any professional cooperation immediately and definitively impossible. This assessment again falls to the judge and differs from the concept of “gross negligence” in liability law. Indeed, courts have already ruled that an employee was liable while the mistake made was not grounds for dismissal for serious cause, and vice versa. Again, however, it remains difficult to justify that cooperation has become definitively and immediately impossible if the employer cannot demonstrate that it made efforts to thoroughly inform the employee.
Every employer should therefore have a decisive policy against phishing and computer fraud in general. This goes beyond written guidelines to be followed by staff and must above all also be embedded in the IT infrastructure. Indeed, if the employer cannot demonstrate having invested (sufficiently) in IT security, this can also influence the court’s assessment.
But the most important aspect of such a policy is prevention. By training staff on this issue, the chance of falling victim to an employee’s mistake becomes ever smaller. And prevention is still better than cure.
If you need assistance in this area, please feel free to contact us at contact@alisadvocaten.be.
