contract-law confidentiality
Can party be responsible for unintentional leak of confidential information
<p>Under what circumstances can a party be liable when confidential information they are in possession of is leaked? For example I signed an NDA with my workplace. If they send an email to my personal email address and gmail's servers are hacked (or spyware is on my computer) would I be liable?</p>

<p>Also what if someone lies to me and I believe them. For example they claim to be working on same project I am working on and need to know a detail. </p>

<p>It will depend on the jurisdiction (everything <em>always</em> depends on the jurisdiction), but in general a party will be liable if they deliberately leaked the information, or if they were negligent in allowing the information to leak.</p>

<p>You have three example cases here.  (I use "they" and "you" below to refer to the employer and the employee.)</p>

<p>Firstly, <strong>they send the information to your gmail account, and gmail is hacked</strong>.  In this case, the only <em>possible</em> negligence on your part, is giving them the gmail account rather than your work account as the destination address.  It is very unlikely there is any case to answer under the NDA.</p>

<p>Secondly, <strong>they send the information to your gmail account, and your laptop has spyware</strong>.  This rather depends on the operating procedures established by your employer.  If the rule is that you may only access office information from a work-supplied machine, but you actually accessed it from your home PC, then this might count as negligence.  Note that when I say "the rule", I don't just mean "that is what it says in the employees' handbook but everyone ignores it"; I mean "that is actually enforced by the employer".  If you are allowed to access information from your home PC, then your employer would need to show you were negligent in allowing malware to be installed; that would probably be difficult.</p>

<p>Thirdly, <strong>you are socially engineered into revealing the information</strong>.  This is the most tricky.  It would depend on how aware you should have been that this information was likely to be under targeted attack.</p>
