Travel Counsellors Ltd v Trailfinders Ltd

This dispute was about customer information moving with staff from one travel business to another. Trailfinders said former sales consultants took client details from its systems when they left and that the competitor they joined, Travel Counsellors Ltd, received and used that information.

The case mattered because the incoming business did not just employ the individuals. The trial judge found it expected people from the travel industry to bring customer contact lists with them and then loaded those contacts into its own systems. That turned the case from a simple employee exit dispute into a wider warning for any business that benefits from information brought in by new hires, franchisees or contractors.

For ordinary businesses, that is the practical hook. Many disputes about confidential information start with a departing employee. This one also focused on the recipient business and what it should have done when information arrived. If your business recruits from competitors, buys books of business, runs a franchise network or asks new joiners to upload contacts into a CRM, the same risk can arise in a much less dramatic setting than a court case.

The Court of Appeal was not deciding whether every customer relationship belongs to a former employer forever. It was dealing with a narrower but important point: when a business receives customer information in circumstances that should raise concern, can it avoid responsibility by not asking questions? The answer was no.

The judgment identifies two Trailfinders systems. “Superfacts” held a wide range of client information and was especially useful when a client called, because the software recognised the number and displayed related information on screen. Staff accessed it with unique logins and passwords.

“Viewtrail” was client-accessible. At the relevant time, a client could access details online using a booking reference number and surname, or through a hyperlink sent by a Trailfinders sales representative. The trial judge found that one former employee had built a contact book containing names, contact details and booking reference numbers that could be used to access customers’ Viewtrail accounts.

That detail matters for business owners because confidentiality disputes often turn on what the information looked like in practice. A rough memory of who your regular customers are is different from a structured list containing names, email addresses, phone numbers, booking references and other account details. The more organised and system-derived the information is, the harder it is to say it was simply carried in someone’s head or gathered from public sources.

The court also noted that some information may be confidential even if not every item in a list is protected. That is important in real business life. A spreadsheet can contain a mix of remembered contacts, public details and confidential internal data. The presence of some non-confidential material does not make the whole exercise safe.

The key issue on appeal was not whether some of the information was confidential. TCL did not challenge that point. The real question was whether TCL, as the recipient of information from former employees of a competitor, came under an equitable obligation of confidence.

The Court of Appeal considered the correct test. In broad terms, an obligation of confidence can arise where the recipient knows, or has notice, that the information is confidential. The court then addressed a practical business question: if the circumstances would make a reasonable person suspect that some of the information may be confidential, is it enough for the recipient to stay silent and avoid asking questions? TCL argued that more was needed. The court rejected that approach.

This is what gives the case its wider business value. Many SMEs do not deliberately set out to misuse a rival’s information. The risk often comes from informality: a manager says “send over your contacts before day one”, a franchise network offers to upload a recruit’s old customer list, or a salesperson arrives with a spreadsheet and nobody asks where it came from. The legal issue was whether that kind of passivity can still create responsibility. The court said it can.

The judges also made clear that this was about primary liability for misuse of confidential information by the recipient business. They rejected the argument that nothing short of blind-eye knowledge would do in this context. Instead, the standard was objective: what would a reasonable person in the recipient’s position have understood and done?

The Court of Appeal dismissed TCL’s appeal. It held that if the circumstances are such that a reasonable person in the recipient’s position would realise the information, or some of it, may be confidential to another business, that reasonable person may be expected to make enquiries. If the recipient does not do that, an obligation of confidence can arise.

The court accepted the trial judge’s view that TCL ought to have appreciated that at least part of the contact information brought by the former Trailfinders employees was likely to have been copied from Trailfinders’ customer data. The quantity of information mattered.

The court also relied on findings that TCL encouraged people from a travel background to bring old customer contact lists, did not warn them about breach of confidence risk, and did not ask about the source of the information before loading it into its systems.

The court rejected several narrower arguments from TCL. It said it was not necessary for all the information received to be confidential. It was enough that some of it was likely to be. It also said it was not necessary to prove the recipient had actual knowledge or blind-eye knowledge for this issue. If a reasonable recipient would have made enquiries, but did not, that was enough for the obligation to arise.

On misuse, TCL accepted limited use by storing the information in its systems and using it to send marketing emails. The Court of Appeal left questions about the extent of use and damages to a later inquiry. So the decision is strongest as a liability warning: once risky information is received and used, even in limited ways, the business may already be in difficulty.

This decision is highly relevant if your business recruits from competitors, runs a franchise network, or asks new joiners to bring leads or customer contacts. The court was not saying that every customer relationship belongs to the former employer forever. But it did make clear that a business cannot safely accept a structured customer list without checking where it came from and whether it can lawfully be used.

For SMEs, the risk often appears in ordinary onboarding steps: importing a spreadsheet into a CRM, asking a recruit for their client book, or sending a welcome campaign to contacts they provide. If the list is large, detailed, or looks like it came from a business system rather than memory or public sources, your business should treat that as a warning sign and pause before using it.

A useful way to read the case is to separate personal relationships from business records. A salesperson may know many customers and may be able to contact some of them from memory or through lawful personal channels. That does not mean they can hand over a structured list copied from a former employer’s systems. The court’s reasoning shows why format and context matter.

A long, organised list with titles, names, email addresses, phone numbers and other details is more likely to trigger questions than a handful of remembered contacts.

The case is also relevant beyond travel. Similar issues can arise in recruitment, real estate, financial services, professional services, trades, software sales, healthcare and any business where repeat custom depends on account histories and relationship data. If your business benefits from incoming contacts, you need a process that distinguishes lawful relationship-building from risky transfer of someone else’s confidential information.

The practical lesson is to build a process that catches risky information before it is used. This is not only about legal drafting. It is also about training, systems and record-keeping. A short written process can make a major difference if a dispute later arises.

If your business receives customer information from incoming staff, franchisees or contractors, make sure someone is responsible for checking source, permissions and intended use before the data goes live in your systems.

Start with a simple rule: no imported customer list should be uploaded automatically. Ask where it came from, whether it was copied from a former employer’s systems, whether any part came from internal databases, and whether the person has authority to share it. Record the answers. If the explanation is unclear, incomplete or evasive, do not use the list until the issue is resolved.

Then look at your own behaviour. The facts against TCL included encouragement to bring old customer contact lists and a failure to warn about breach of confidence risk. That means your recruitment materials, franchise brochures, manager scripts and onboarding emails all matter. Avoid language that could be read as inviting people to bring competitor customer data.

A safer approach is to require new joiners to confirm that any contacts they provide can lawfully be used and do not include confidential information belonging to another business.

This case also shows the value of internal controls for the business trying to protect its own customer information. Trailfinders relied on the fact that customer information sat in identified systems with controlled access. For a small business, that kind of evidence can help show the information was treated as confidential and not left open to the world.

Review both sides of the problem: how you stop your own information leaving, and how you avoid receiving someone else’s protected information. Contracts, policies and system settings should work together.

On the protection side, think about what would help you prove confidentiality if a dispute arose. Clear confidentiality wording in employment and contractor terms, individual logins, password controls, restricted exports, prompt removal of access on exit and records of what was returned can all help show that customer information was treated as confidential in practice.

On the receiving side, your documents should make clear that new joiners must not provide third-party confidential information and that any customer data they do provide will be checked before use.

These controls are not just for large organisations. A small team with a shared spreadsheet and informal onboarding can still face the same legal issue. The court’s reasoning rewards businesses that ask sensible questions and keep sensible records.