"Directive on the protection of undisclosed know-how and business information (trade secrets) against their unlawful acquisition, use and disclosure" (Directive). The Directive was published in the Official Journal of the EU on 15 June 2016 and will come into force on 5 July 2016 after which Member States have two years to incorporate the provisions into national law.
Despite some last minute protests, mainly concerned with potential negative impacts of the Directive on the freedom of press and free speech, and most notably on investigative journalism and the rights of whistleblowers, the European Parliament had approved the text of the proposed Directive with a strong majority in April 2016. The introduction of the Directive can also be seen as part of a global trend since the U.S. have recently introduced a similar law, the Defend Trade Secrets Act of 2016.
Why the Directive matters
Simply put: ensuring a minimum degree of protection across the entire EU will enable businesses to pursue trade secret theft more easily across borders, particularly in a landscape where those secrets can be spread across the globe in an instant, such as by e-mail or upload through the Internet. In the current landscape, where trade secret protection varies wildly from jurisdiction to jurisdiction, multinational businesses have found it hard to combat infringements efficiently and to take a uniform approach to protecting their secrets. Creating a safer environment will encourage collaborative innovation and sharing of valuable know-how between businesses throughout the European Union.
The Directive will provide for a minimum standard of EU-wide trade secret protection, aligning the current system of disparate levels of protection in the individual EU countries. Trade secrets protection thereby fills a legislative gap and is well attuned to protecting the soft skills of our information-driven society and of the ever-larger service economy. It also makes it easier for businesses to make an informed choice of whether they should opt for patent protection for a piece of novel technology, or whether there is more value in keeping it a secret.
It is rare for a piece of legislation to directly touch as many industries as this Directive: food and drink, IT and telecommunications, oil and gas, automotive, engineering, pharmaceuticals and perfumery, chemical, rubber and plastics, electrical and electronic components, financial services, including fintech and hedge funds. The list goes on…
The Directive in a nutshell:
• provides a uniform definition of the term "trade secret";
• provides rules for the protection of trade secrets and
confidential information of EU companies;
• includes common measures against the unlawful acquisition,
use and disclosure of trade secrets;
• is meant to have a deterrent effect against the illegal
disclosure of trade secrets;
• will not impose any limitation to employees' use of the
experience and skills honestly acquired;
• includes special rules for "whistle-blowers" - who in 'good
faith' reveal trade secrets for the purpose of protecting the
general public interest;
• includes rules to ensure freedom of expression and
investigative journalism in this context;
• provides rules for civil regress and damage.
The Directive provides a clear benefit in defining a trade secret and how to protect it. But it requires the taking of reasonable steps to protect it. Corporations or individuals must carefully choose and document these steps to benefit from protective measures or they will not have enough evidence something is a trade secret in a litigation case.
What is a "trade secret"?
The core provisions of the Directive provide a harmonized definition of a trade secret, which comprises three cumulative requirements:
• information that is not generally known among the persons
that deal with that kind of information,
• that has commercial value because it is secret, and
• reasonable steps taken by the owner to protect the secrecy
of the information.
Put into an everyday context, trade secrets account for some or all of the brand value of everyday products, luxury goods and industrial compounds. "Famous" trade secrets range from the formulas for Coca-Cola and Chanel No. 5 (and many other luxury fragrances) to WD-40, as well as KFC's secret recipe, Michelin rubber tyre compounds and even The New York Times' “Best Seller List” rating system.
In reality trade secrets are present in almost every business sector. Consider the changing nature of industrial research: great breakthroughs are rare and innovation occurs through minor, step-by-step advances which are key to maintaining competitive advantage. Traditional pillars of intellectual property protection for knowledge, including patents and copyright, are insufficiently suited to deal with this area since large parts of research and development fall outside the scope of patentable subject matter, and copyright does not protect ideas themselves, but only the particular form in which they are expressed.
By way of further examples: algorithms developed by hedge funds or fintech companies cannot be patented as such and are typical examples of valuable confidential business information. Other protectable items include drawings, prototypes, manufacturing processes and genetic materials, as well as customer and supplier lists, even business methods.
Trade Secret Infringement
The Directive, in essence, defines infringements as the acquisition of a trade secret as well as the use or disclosure of a trade secret without the consent of the trade secret holder shall be considered unlawful. In addition, the production, offering, importing or exporting of goods is also considered unlawful if the person knew or should have known that the trade secret was used unlawfully.
Exceptions, including reverse engineering and "whistleblowers"
The Directive establishes a non-comprehensive framework of exceptions of permitted trade secret use. Importantly and in contrast to some current national laws, the Directive expressly permits reverse-engineering of publicly available products. A "whistle-blower" safe-harbor provision has also been introduced. This allows the disclosure of trade secrets if it is in accordance with the legitimate use of the right of freedom of expression and information or for the purpose of revealing illegal activities of the trade secrets holder, provided that the disclosure was necessary and in the public interest. This does, however, not permit the disclosure of any kind of information as this is not necessarily in the public interest.
The importance of protective measures
Trade secret protection under the Directive does exist automatically but requires some active steps from the trade secret holder. As defined above, businesses in future must actively take steps to protect the secrecy of something and be able to demonstrate they did so to benefit from protection in the event of a dispute. Commercially valuable information will not benefit from trade secret protection unless it is treated like a trade secret.
Notably, businesses will now have to take reasonable protective measures even in jurisdictions which did not require this previously. The steps companies should take will vary depending on the nature of the trade secret. Therefore, first and foremost, companies need to identify the “crown jewels” within their know-how that they need to protect, determine who has a need to know those crown jewels, and define what level of protection is required to ensure that they are not disclosed involuntarily.
More generally, it will be critical for businesses to review their current protective measures and possibly to install additional layers of protection in order to be able to rely on trade secret protection. Moreover, it will be material to supervise and document compliance with the protective measures in order to have sufficient evidence in case trade secret litigation will be initiated.
Practical steps businesses may wish to take include reviewing IT infrastructure, HR and supplier policies. What are the threats coming from cybercrime? Are hard drives and relevant emails encrypted? Do corporate policies limit access to valuable proprietary information on a need-to-know basis? Do home office policies incorporate the right levels of IT security? Are employees effectively trained to stop them "bragging" about new projects and indiscretions in public places? Do employment policies and supplier agreements contain appropriate confidentiality clauses?
Perhaps long overdue, trade secret protection is being improved and harmonised in the EU and elsewhere. However, trade secret protection comes with a clear instruction: you must treat your trade secrets as valuable and secret, and ensure you can prove you have done so.
The full text of the Directive can be found on the EUR-Lex website here