The Advocate | Issue 379 | November 2026

The Employment Relations Authority recently considered the case of a departing employee forwarding sensitive client information to a personal email address in the case of General HVAC Solutions New Zealand Limited v Gunning [2026] NZERA 776.

  

Ms Gunning was employed by General HVAC Solutions New Zealand Limited (“GHS”) as a Business Development Manager from April 2024. 

On 7 July 2025, Ms Gunning sent three emails from her work email address to her personal email address. The three emails included “substantial amounts of information regarding GHS’ existing and new customers, its active customer account details, its entire client list, and current call cycles and territories”.  

On the same day, following sending those emails to herself, Ms Gunning resigned from her employment. She negotiated with GHS that she be paid in lieu of notice and her final day of employment be 8 July 2025. 

After Ms Gunning’s employment ended, GHS found the emails Ms Gunning had sent to herself and wrote to her confirming its view the emails were a breach of her obligations in her employment agreement that applied during and after her employment ended, and required assurances and undertakings as to the information, including that it had been deleted. 

Ms Gunning provided the requested undertakings and said that she had sought legal advice. GHS then required a further undertaking that Ms Gunning would not use any of the information or share it with any third party, which Ms Gunning confirmed. 

GHS applied to the Authority seeking penalties for Ms Gunning’s breaches of her employment agreement and costs, as it viewed this a necessary step to achieve deterrence of similar actions by Ms Gunning and its other employees. 

In the Authority, Ms Gunning accepted that she had breached the confidentiality obligations contained in her employment agreement. However, she claimed that any penalty be moderate. Ms Gunning gave evidence that she was not thinking clearly at the time, that she deeply regretted what she did, and that she never used or shared the information. Ms Gunning’s evidence in the Authority was that when she started employment, she was asked by her Manager to compile a list of client details from her previous industry experience, and this contributed to a sense that she viewed the information as being her own.

The Authority determined the information Ms Gunning sent to her personal email was confidential information of GHS. Further, that in sending the information to herself, she had acted in breach of the confidentiality obligations contained in her employment agreement.  

The Authority then considered the matter of penalties. GHS argued that there were three separate breaches giving rise to liability to penalties, being for each email that was sent. However, the Authority took the approach penalties should be considered for a “ single ‘globalised’ breach ”. It accepted the submission that Ms Gunning’s actions were properly considered a single action or ‘ single course of conduct ’, therefore only liable to a single penalty up to $10,000. This confirmed the principle in Xu v McIntosh [ 2004] 2 ERNZ 448 at [44] of imposing a global penalty: 

“… particularly where one of the breaches is not especially serious or where all the breaches arise out of a single transaction or if they consist of a repetition of the same breach.”

Applying the key principles in determining the quantum of the penalty to be imposed, the Authority turned to the object of the Employment Relations Act 2000, provided by section 3:

“… the first object of the Act is to build productive employment relationships through the promotion of good faith behaviour, and by recognizing the mutual obligations of trust and confidence. By breaching her employment agreement, Ms Gunning’s actions run contrary to both her statutory and common-law obligations to her employer.”

Further, the Authority considered the need for deterrence:

“… there is a need for deterrence on a general basis, and a specific basis. GHS has a legitimate right and interest in protecting its confidential and commercial information, and should be able to expect that its employees take their obligations under its employment agreement seriously.”

The Authority then turned to the significance of the breach:

“… the breach was significant, and held the potential for significant damage and loss to GHS. In saying this, I acknowledge Ms Gunning’s undertakings and that she did not use or share the information that she took. However, the breach itself remains significant.”

The Authority considered the breach was deliberate, and that there was loss suffered by GHS in terms of its management, IT and legal time and expenses in identifying and rectifying the breach. All of these factors, balanced against  the steps Ms Gunning took to remediate the breach, and that there was no past similar conduct on Ms Gunning’s part, the Authority considered the appropriate starting point for a penalty was $6,000. Following applying a discount of 20% for Ms Gunning’s inability to pay, and her personal and health circumstances, the penalty was reduced to $4,800. The entire penalty was awarded to GHS. 

This case serves as a useful reminder of ensuring employment agreements contain robust confidentiality clauses, and that quick action is taken where confidential information is discovered to have been removed. 

The decision also reinforces that removing confidential information when leaving employment is a serious breach warranting penalties, even where the information is not used or shared. However, balanced against the need for deterrence, the Authority will consider and carefully assess the employee’s circumstances, remediation efforts, and ability to pay when determining an appropriate penalty.