The EU Trade Secrets Directive entered into force on 5 July 2016. What does this mean for UK businesses?
The Impact of Brexit
The UK's vote to leave the EU will affect the extent to which the Trade Secrets Directive becomes part of UK law. While the UK remains part of the EU, the Directive must be implemented into national law. EU member states have until early June 2018 to do that. The UK will remain a member state of the EU until the formal withdrawal process is complete. The process is triggered by the UK giving the European Council notice of its intention to withdraw from the EU under Article 50 of the Treaty on European Union. The UK and EU then have two years to negotiate the terms of the UK's exit. The UK will leave the EU when those negotiations are complete or two years after giving notice, whichever is the sooner. Theresa May, the UK's new Prime Minister, has indicated that an Article 50 notice will not be given until the end of 2016, at the earliest.
Given the uncertainty around when Article 50 will be triggered, and how long the exit negotiations will take, it is possible that the UK could still be a member of the EU in June 2018, the date by which the Trade Secrets Directive has to be implemented. The UK may go ahead and implement the Directive as usual or decide not to implement given its impending EU exit. If the Directive is implemented into UK law, the legislation could be repealed at a later date, or retained. Much depends on the will of the current and future governments and the UK's chosen alternative to EU membership. At the moment, very little is known.
In light of that, this note intends to brief UK businesses on the Trade Secrets Directive in case it is implemented into UK law. Even if the Directive is not implemented in the UK, it will be in implemented in other EU member states and so this briefing will be of interest to those UK businesses that transact across European borders.
Five Key Points
- The Directive aims to help businesses protect their trade secrets from misuse. It introduces a harmonised, minimum level of protection for trade secrets across Europe.
- The Directive prohibits the unlawful acquisition, use or disclosure of trade secrets and bans dealing in goods which result from trade secrets theft.
- The usual remedies of injunctions and damages will be available to trade secrets holders where a trade secret has been misused. The confidentiality of the trade secret will be preserved during legal proceedings.
- Assuming it is implemented in the UK and subject to seeing implementing legislation, the Directive is unlikely to make much practical difference in the UK as we already have a well-developed judge-made law of confidentiality.
- It continues to be important for businesses to use day to day confidentiality processes, including confidentiality clauses and agreements, marking documents as confidential, using passwords and encryption and limiting access to trade secrets on a `need to know' basis.
Please read on for a more detailed analysis of the Directive.
What Is the Trade Secrets Directive?
The Directive is a piece of EU legislation, originally proposed by the European Commission. Following analysis of the EU market, the Commission concluded that trade secrets theft was on the rise and that joint innovation between businesses based in different EU countries was being stifled. It attributed this to the different levels of protection for trade secrets across Europe. Some countries provided strong protection, some moderate protection and others almost no protection at all. The objective of the Directive is to introduce a harmonised, minimum level of protection for trade secrets across Europe, to counter trade secrets theft and encourage cross-border innovation, with knock-on economic benefits for the EU market.
Who Will Be Impacted By the Directive?
The Directive will impact all businesses that hold trade secrets. Typically, this includes formulas, recipes, unpublished inventions, industrial processes, business plans, operating procedures, business methods, customer information, financial information, improvements to products or processes and pricing data. The Directive will, therefore, be relevant to most businesses. Although the Directive is not specifically targeted at employers, it will be of interest to them in light of the particular problems posed by ex-employees misusing trade secrets.
The Directive refers to "trade secrets" but many businesses will refer to their business critical data as "confidential information". "Trade secrets" and "confidential information" can be used interchangeably. The term used will not affect whether the data is protected by the Directive.
What Is a Trade Secret?
The Directive defines "trade secret" as information which:
- "is secret in the sense that it is not ... generally known among or readily accessible to persons within the circles that normally deal with the kind of information in question;
- has commercial value because it is secret; and
- has been subject to reasonable steps under the circumstances by the person lawfully in control of the information to keep it secret".
This definition would appear to cover highly secret information akin to the Coca-Cola formula but otherwise has ambiguities. What does commercial value mean? It is also uncertain what "persons within circles that normally deal with" means. It appears to be a narrower group than the "information coming into the public domain" test currently used by the UK courts. However, defining a trade secret in this way leaves room for arguments about deemed knowledge and defining the circle of persons to whom this test is applied.
Taken as a whole, the definition of trade secret seems to focus on whether the information has been kept secret rather than its inherently secret nature. The requirement that information must have been "subject to reasonable steps under the circumstances to keep it secret" means that businesses must continue to use, or put in place for the first time, the usual commercial confidentiality processes. This could include, for example, using non-disclosure clauses or agreements (NDAs), marking documents as confidential and limiting access to the information. The Directive does not set out what "reasonable steps" are required, and whether a business has indeed taken reasonable steps will be assessed on a case by case basis. It is clear that the Directive does not do away with the need for NDAs. Indeed, in some respects, it increases their significance.
What Will Be Prohibited?
The Directive prohibits the unlawful acquisition, use and disclosure of trade secrets.
The acquisition of a trade secret will be unlawful if it results from unauthorised access to, appropriation of or copying of any documents, objects, materials, substances or electronic files containing the trade secret or from which the trade secret can be deduced. This would catch hacking, downloading electronic data onto a personal storage device and removing or copying hard copy documents, provided the initial access to the information was unauthorised. This underlines the importance of having confidentiality processes in place.
It will also be unlawful to acquire a trade secret via any other conduct which is contrary to "honest commercial practices". The Directive gives no indication of what this means but it would appear to be a broad catch-all category covering conduct which a court considers ought to be unlawful but which does not fall within "unauthorised access, appropriation or copying". Acquisition of a trade secret via independent discovery, reverse engineering or any honest commercial practice (again undefined) is permitted.
The use or disclosure of a trade secret will be unlawful where the trade secret was initially acquired unlawfully, or is being used or disclosed in breach of a confidentiality agreement or other contractual duty limiting its use. This definition emphasises the importance of always disclosing secrets to third parties using an NDA. Any misappropriation of those secrets will then be automatically unlawful.
What About Goods Resulting From Trade Secrets Misuse?
The European Commission was concerned that goods resulting from trade secrets theft were being imported into those EU countries with weak trade secrets laws and circulated throughout Europe under free movement principles. Accordingly, the Directive provides that it will be unlawful to produce, sell, import, export or store infringing goods (goods the design, characteristics, functioning, production process or marketing of which significantly benefits from trade secrets theft) where the person knows, or ought to know, that the goods are infringing. How "significantly benefits" is defined will be critical in assessing whether this aspect of the Directive is an effective weapon for trade secrets holders against infringing goods.
Are Whistleblowers Protected?
There is a carve-out in the Directive to protect whistleblowers acquiring, using or disclosing a trade secret "for revealing misconduct, wrongdoing or illegal activity provided that the whistleblower acted for the purpose of protecting the general public interest". The Directive does not limit what a whistleblower can do with the trade secret for this purpose or require them to reasonably believe they are acting in the public interest. This suggests that the scope of this defence could be broad. Ultimately, it will be for the courts to decide what is in the public interest.
Who Can Sue?
The Directive provides that trade secrets holders (including licensees) have six years to bring proceedings where their trade secrets have been misappropriated. Where the misappropriation is threatened, the courts will be able to grant interim injunctions, prohibiting misuse of the trade secret and any future dealings in infringing goods. Similar orders on a final basis, and damages, will be available where the trade secret has already been misused.
The prospect of losing the confidentiality of trade secrets during legal proceedings can deter businesses from bringing proceedings to protect them. For this reason, the Directive sets out procedures to prevent the disclosure of trade secrets during litigation. However, for the most part, these procedures are already available in the UK courts.
Will the Directive Make Any Practical Difference in the UK?
Probably not much. The UK already has a well- developed law of confidence to protect trade secrets. This has been developed by judges over time. Implementation of the Directive in the UK (assuming it happens) will put trade secrets protection on a statutory footing. Any legislation is likely to codify the existing law (to the extent that it is consistent with the Directive) and amend it (to the extent that it is not).
The impact of the Directive is more likely to be felt in those EU countries which currently lack legal protection for trade secrets. The intention is that businesses with a European footprint, or with crossborder commercial joint ventures, should find it easier and cheaper to protect their secrets across an EU with harmonised laws. However, as the Directive has to be implemented by each member state (leaving scope for differences) and gives member states discretion to implement more stringent laws if they wish, there will be inconsistencies from country to country. UK businesses should be reassured that their secrets will be protected to broadly the same degree across the EU but should expect some local differences to exist.
How Will the Directive Interact With Confidentiality Agreements?
The rights under the Directive will co-exist with contractual confidentiality provisions. It will still be important to use NDAs to impose more stringent obligations on a recipient of confidential information than the Directive, and to give an additional right of action for breach of contract if the information is misused. The benefit of a breach of contract action is that it avoids some difficult questions under the Directive, such as whether the acquisition of a trade secret was in accordance with an honest commercial practice. Also, as already mentioned above, having an NDA in place will in some cases actually help a trade secrets holder enforce their rights under the Directive.
How Should We Be Preparing for the Directive?
How the Directive is implemented in the UK will be crucial in determining whether it provides a better regime for businesses than the existing law of confidence. Until more information emerges about whether and how the Directive will be implemented, to be in the best position to take advantage of the Directive, it would be prudent for businesses to consider:
- What are your trade secrets? Put in place a process for identifying your trade secrets in accordance with the new definition in the Directive. Undertake a confidentiality audit/health check and create a register of your key trade secrets.
- What steps do you currently take to protect your trade secrets? Would these be sufficient to satisfy the new requirement to take reasonable steps to keep them secret?
- What else could be done? For example, ensure confidential documents are marked as such. Password protect electronic files and keep hard copy documents secure. Access to both should be limited on a need to know basis, under clear duties of confidentiality. Use encryption where appropriate. Your internal policies should be robust enough to demonstrate to a court that reasonable effort was taken to protect your trade secrets internally. Some of these processes will simply not be practically possible for some businesses. Ultimately, it will be a trade-off between the inconvenience of having these processes in place and the need to protect data central to the business. However, where the trade secrets are particularly valuable to the business, the inconvenience is likely to be worthwhile.
- Ensure you have non-disclosure agreements in place every time you disclose confidential information to a third party. You should also have express contractual provisions in place with your employees. For example, your contracts of employment should include appropriate confidentiality wording and post-termination restrictions.