1. Defining Breach of Confidentiality under New York Law
A breach of confidentiality occurs when a person or entity discloses or uses protected information without authorization, in violation of a legal duty or contractual obligation. Not every leak of private information creates a viable legal claim. The information must have genuine commercial, personal, or professional value, and the party holding it must have taken reasonable steps to keep it private.
New York does not follow the Uniform Trade Secrets Act (UTSA), which most other states have adopted. Trade secret claims in New York proceed under common law, while NDA violations are treated as breach of contract. The federal Defend Trade Secrets Act (DTSA) provides a separate federal cause of action that New York plaintiffs can also pursue.
Information commonly protected under New York law includes trade secrets, customer lists, financial records, medical and legal records, and proprietary business strategies.
When a Disclosure Becomes Actionable
A disclosure becomes legally actionable when the information was protected by contract, professional duty, or law; the defendant accessed it through a relationship that imposed a duty of secrecy; and the plaintiff can show measurable harm, such as financial loss, competitive disadvantage, or reputational damage.
2. Common Types of Confidentiality Breaches
Confidentiality breaches do not follow a single pattern. The source of the breach, the type of information involved, and the relationship between the parties all affect which legal theories apply and what remedies are available.
Employee and Workplace Disclosures
Current and former employees account for a large share of confidentiality breaches in New York. Sharing customer data, pricing strategies, or internal processes with a competitor or the public can constitute employee misconduct with real legal exposure. Depending on the facts, claims may proceed under an NDA, an implied duty of loyalty, or trade secret law.
Third-Party Vendor Breaches
Vendors and service providers routinely receive access to sensitive data. When they mishandle or share that information without authorization, it can result in a data breach and civil liability. Confidentiality provisions in vendor contracts define what is protected and what remedies the affected party can pursue.
Trade Secret Misappropriation
When the confidential information at issue qualifies as a trade secret, the legal exposure is more serious. Trade secret misappropriation may involve outright theft, unauthorized copying, or deliberate exploitation of a company's proprietary assets. Victims can pursue claims under New York common law or the DTSA, with injunctive relief available in both forums.
Professional Duty Violations
Attorneys, physicians, accountants, and therapists owe their clients a legally enforceable duty of confidentiality. Unauthorized disclosure can result in professional discipline, civil liability, and in the most serious cases, criminal charges.
3. Proving a Breach of Confidentiality Claim
Establishing liability is fact-specific, but New York courts follow a consistent framework regardless of which legal theory the plaintiff pursues.
To establish liability, a plaintiff must generally prove:
- The information was legally protected as confidential or a trade secret
- The defendant had access through a relationship that imposed a duty of secrecy
- The defendant disclosed or used the information without authorization
- The plaintiff suffered actual harm as a direct result
Evidence courts look at includes the original agreement, communications showing unauthorized disclosure, records of business harm such as lost contracts or revenue decline, and documentation of the security measures the plaintiff had in place. Courts take those security measures seriously because trade secret status partly depends on whether the holder treated the information as secret.
4. Legal Consequences and Remedies
The consequences of a confidentiality breach in New York range from civil damages to emergency court orders to criminal prosecution, depending on how the breach occurred and what was taken.
Civil Damages
Successful plaintiffs may recover actual damages, including lost profits and any unjust enrichment the defendant gained from the wrongful disclosure. Under the DTSA, courts may award up to double the actual damages in cases of willful and malicious misappropriation, along with attorney's fees.
Injunctive Relief
Courts can issue a temporary restraining order or preliminary injunction to stop ongoing or threatened disclosure. This is often the most time-sensitive remedy when confidential information is actively being misused. Sending a cease and desist letter is typically the first step before seeking emergency court relief.
Criminal Exposure
Intentional theft of trade secrets may qualify as a criminal offense. At the federal level, the Economic Espionage Act covers both commercial trade secret theft and theft for the benefit of a foreign government. New York Penal Law also addresses theft of proprietary business information. Criminal liability requires proof of intentional conduct and typically involves commercially valuable information.
5. Preventing Confidentiality Breaches
Good legal protection starts before a breach occurs. Businesses and individuals that take clear precautionary steps are also better positioned to enforce their rights if a breach does happen.
- Tailored NDAs: Draft agreements that clearly define what is protected, for how long, and what remedies apply. Generic one-page NDAs often leave gaps that courts will not fill.
- Access controls: Limit exposure to sensitive information on a need-to-know basis and log all access activity.
- Employee procedures: Address confidentiality obligations at hire and at departure. Revoke system access on the day an employee leaves.
- Vendor contracts: Include specific confidentiality provisions in all third-party agreements and audit compliance periodically.
- Security documentation: Keep records of the steps taken to protect information. Courts evaluate those measures when determining whether something qualifies as a trade secret.
6. Frequently Asked Questions
Does a breach of confidentiality claim require a written NDA?
No. New York recognizes implied duties of confidentiality in professional relationships such as attorney-client and doctor-patient, even without a signed agreement. A written NDA, however, provides clearer grounds for enforcement and stronger remedies.
How long do I have to file a claim in New York?
Breach of contract claims carry a six-year statute of limitations under CPLR § 213. DTSA claims must be filed within three years of when the misappropriation was discovered, or reasonably should have been discovered, under 18 U.S.C. § 1836(d).
07 Aug, 2025
