Technological know-how, business concepts and strategies, information on customers and suppliers: confidential information is the currency of today’s knowledge-based economy, and not just for technology firms. In recent years, European business has had a growing need for better protection of confidential trade information, due to factors including globalisation and digital networking, outsourcing and longer supply chains.

This applies even more in the IoT/‘Industry 4.0’ environment we live in. On collaborative platforms, one manufacturer’s products are connected to the products and systems of third parties. This creates a digital memory, which includes know-how. We are also seeing increasing use of cloud technology and digitalisation and, as a result, confidential business information has become particularly vulnerable to misappropriation by others.

For years the European Commission has flagged a significant need to catch up with the pace of developments in this area, particularly when compared to the USA, and has identified a lack of uniformity in the protection regimes of member states. On 5 July 2016 the directive on the protection of undisclosed know-how and business information (trade secrets) (2016/943/EU) finally came into force. On the whole, it marks a considerable improvement in the legal protection offered for confidential information and know-how. The uniform minimum standards mean more legal certainty and a level playing field for businesses operating in the EU.

What’s new?

Along with providing up-to-date and effective measures for the enforcement of rights, largely tailored after the existing model for intellectual property rights, the directive also aims to make sure that confidentiality is maintained in court cases. Exceptions have been made for the protection of freedom of expression, for the purposes of whistle-blowing and for employees whose ‘mobility’ should not be limited with respect to ‘experience and skills honestly acquired’. Independent discoveries and reverse engineering also continue to be permitted – thus, there will not be an ‘exclusive right’ in trade secrets, but rather protection from their unlawful acquisition and from their unlawful use and disclosure.

The criteria for availing of legal protection have also become stricter, signalling a tightening of the legal position from the perspective of – for example – German and Austrian law. In the future, trade secret holders will have to prove that the trade secrets had been subject to ‘reasonable steps’ to keep them secret. In other words: businesses have to actively protect their confidential information and evidence this in the event of a dispute.

What action do businesses need to take?

Businesses are advised to review the ways their internal processes deal with confidential information and know-how.

This process raises a number of questions.

  • Is everyone at the business clear about what information is to be treated confidentially as ‘trade secrets’?
  • Is there a coherent strategy for the protection of IP and know-how? Where does the business depend on confidentiality, and where does it not?
  • Have employees been given appropriate training?
  • Are different grades or levels of access rights, technical protective measures and IT security precautions in place?
  • Is there a policy on the classification, documentation and storage of trade secrets?
  • Do the non-disclosure clauses in agreements with staff, contractors, customers, suppliers and co-operative partners have to be redesigned or redrafted?

The directive has to be implemented by the member states within a deadline of two years; however, businesses should not wait until the deadline expires to optimise their system of compliance.

Reviewing and implementing changes can take a substantial period of time and, ideally, the new legal framework and its implications should be factored into contractual agreements from this point onwards.

Questions left open

The fact that the directive only provides for minimum standards means that the member states could also introduce stricter rules. There are also a number of uncertain terms in the directive, which will inevitably cause difficulties when it comes to their interpretation. In particular, it remains to be seen how the courts will get to grips with the difficult balancing act they are now faced with. The challenge will be to balance the provision of more effective legal protection, as set out in the directive, against the politically sensitive exceptions granted (freedom of expression, investigative journalism, whistle-blowing and employees).

The ECJ will certainly have the last word on this.