Employee acting illegally on direction from management

Question

I thought of this when reading the Meta case regarding negative testing.

Say a state has a law regarding data-retention of log files for banks.

A manager instructs an employee to wipe drive of logs. The employee is knowledgeable enough to know that this log, it is for data-retention, but they do not know any laws regarding how long data must be retained, or what needs to be retained (or deleted).

Could employees have charges filed against them for such type of actions? Has this already occurred?

What obligation does the employee need to know of laws if they have some knowledge, but not expert knowledge. e.g. "Sure boss, I will wipe that important drive. vs I do not think it is legal to wipe that important drive. vs I was informed by counsel that it is illegal to wipe that important drive."

How would an employee know that negative testing is illegal in New York? Where in the chain of obedience is the responsibility laid at(corporate officers)?

Answer 1

An employer doesn't have the authority to authorize its employees to violate the law. An employee who personally participates in a crime has both criminal and civil liability for the employee's actions.

Private sector employers have vicarious respondeat superior civil liability for the actions of their employees taken in the scope of their duties. In other words, anything that an employee of a private sector employer is liable for, the employer is also liable for.

Governmental employers do not have vicarious respondeat superior civil liability for the civil rights violations of the employees.

Direct civil as opposed to vicarious civil liability, and criminal liability for an employer (governmental or private) is generally limited to acts carried out by employees of the entity at the direction of senior management or pursuant to a policy, explicit or implicit, of the employer.

This said, it is the nature of large employers to break tasks into component parts spread over many employees in different parts of the employing entity. In some circumstances, an individual employee's role may be such that the employee lacks sufficient information about the overall course of action of the employer to know that their actions are part of an overall course of conduct by the employer that constitutes a crime or tort.

For example, to retreat to an old school example, suppose that there is an employee who sits in front of a shredding machine all day and feeds paper into and clears paper jams, etc. whose job is to shred whatever documents are put in a bin next to his work station. This guy, who makes no decisions regarding what is to be shredded and has no real knowledge of why documents are being shredded, probably doesn't have criminal or civil liability if his labor is used to illegal destroy some documents. For all the shredder guy knows, he could simply be destroying redundant copies of documents to free up space in the filing cabinets while a single archival copy is retained.

Typically, criminal laws require some level of mens rea (i.e. intent) which may be intent to do something in particular, it may be knowledge of certain facts, or what have you. An employee is generally only going to face criminal liability is the employee who carries out the wrongful act on behalf of the employer does so with the requisite knowledge and intent set forth in the criminal statute.

Answer 2

Directions from management doesn’t change the legality of one’s actions. Knowledge of what one is doing can. In your described scenario, unless the employees position placed a duty on them, their ignorance will probably protect them.

Disclaimer: actual innocence is not a 100% guarantee of acquittal, let alone protection from prosecution. If one suspects that records are being illegally destroyed and they either will or have participated in the destruction, they might want to retain an attorney.

Answer 3

Your description doesn't point us to a specific state law, so we can't tell for sure. However, it is highly unlikely that it is a general crime in any state for a person to delete records. A data retention law would impose the obligation on the bank, not on "the bank and all employees". Murder and theft are laws that apply to everybody, but restrictions on commerce generally apply to the business and not to everybody with some relation to the business. The business might get fined, but even if an employee "willfully" deletes data that is supposed to be retained, they cannot be prosecuted. Less slack is cut for government employees, so that a government clerk willfully destroying government records can be a crime. Unless you have in mind some surprising law where personal liability is created, an employee will not be prosecuted for an action in violation of a business regulation. If you have a specific real law in mind, that would be worth discussing.