Human Resource Blog

Employee copied owners payroll and social security numbers

the question is , the employee did copy our payroll and and all employees and owners social security numbers was on it, I am the owner and the employee had permission to copy her papers on our copier, while we were gone she found the payroll and copied it and put the origional back where it was at, she claimed she happened to see it, but we know that is not true, she said she did it because she wanted to know what salary was being paid. she also said she HAS HAD IT FOR A WHILE. the first decision is to press charges and to fire her, we feel our credit is at risk! we are a strong company but what real actions would take place to prevent identity theft in the future? all staff is at risk

You can certainly report this possible identity theft to the police. However, if the employee merely copied the information and did not pass it on to anyone else, then what she did is unethical and shows very poor judgment in not keeping company records confidential — but it is not necessarily illegal. Still, knowing that the police have been called (and hopefully, being questioned by them) will convince her that this was a bad idea.

Obviously, you should require that the employee return the copy of the payroll to you. (This is mostly symbolic, since she may have made additional copies.) Second, you should improve your security. Payroll, employee files and other confidential records should be stored in a secure, locked file cabinet. The file cabinet should be locked at all times when not in use. If you were permitting this employee to copy her own personnel record (which there is seldom a need to do, legally) you should have taken it out of the file cabinet and then locked the file cabinet again. (If the office is poorly organized or in a mess, that should be corrected as well.)

Third, take disciplinary actions. You may want to fire this employee. (At most companies, even reading payroll records to find out what other people make is failure to keep business documents confidential — a serious violation of company policy punishable by termination.) Some employers would be tempted to keep this employee on staff, so they can keep an eye on her. In that case, you might want to suspend her for 3 or more days without pay. Be sure to document any action with a written reprimand, because we are fairly sure you will be terminating this employee in the future.

However, you should also take action against the manager who failed to keep this payroll information secure, by leaving it out where anyone could see it and walking out of the office. In a few states, including Texas, the employer has broken the law, when anyone outside the company learns an employees social security number. This was very, very poor judgment and if you were the one who failed to establish a policy to keep this information secure, you need to kick yourself.

We all hope that every employee will act in an honest and ethical manner at all times, but you can never make that assumption. So you need to establish HR and payroll policies that protect company information from dishonest employees. The best practice is not to use social security numbers to identify employees (and in fact, in several states it is illegal to do so.) You may want to update your payroll to computerized records, or to revamp the system to eliminate social security numbers.

You may also want to send a memo out to employees that unfortunately, there was a security problem and their social security number was copied. This will allow them to alert their bank and be especially vigilant about identity theft.  

At a well-run company, this violation would have been impossible. You may want to hire an HR consultant, or to hire a business manager with extensive HR and accounting experience to clean up your procedures.