EU Member States have until 9 June 2018 to implement the Trade Secrets Directive (2016/943/EU) into their national laws. Whilst the new Directive very helpfully aligns the legal protections conferred on trade secrets across the EU, it also contains specific prerequisites for companies wishing to take advantage of these new protections. Crucially, the Trade Secrets Directive creates a uniform EU-wide definition of a "trade secret" that requires businesses to prove that they have taken "reasonable steps" to keep their commercially valuable information secret. In this article, we examine how the Directive in general and the above obligation in particular will affect the M&A process.
1. What is the Trade Secrets Directive and why was it necessary?
The Trade Secrets Directive aims to protect innovation by simplifying and harmonising the law governing the protection of trade secrets and remedies available for their misuse.
Presently, there is little consistency in Europe on the management of trade secrets. National approaches vary greatly; for example the Netherlands relies on tort law, Malta relies on contract, whilst the UK and Ireland rely on common law. Indeed, only 11 European countries even have a formal definition of a "trade secret". This patchwork system clearly presents a significant challenge to businesses seeking to protect commercially valuable confidential information.
One way the Trade Secrets Directive ameliorates this problem is by harmonising the definition of a "trade secret". To qualify, information will need to be secret in the sense of not being generally known, have commercial value and the owner must have taken "reasonable steps" to protect such information. This is a narrower definition than that currently in existence in the UK. In particular, the requirement for the secret to have commercial value is entirely new, and there is now an increased emphasis upon the secret holder's treatment of the information.
A major practical consequence of this definition is that businesses will need to start considering whether they have taken "reasonable steps" to keep their information secret. This will likely precipitate changes in how the M&A diligence process is conducted.
2. Which sectors will be most impacted by the new Directive?
A trade secret is self-evidently a valuable piece of information that creates competitive advantage think the Coca-Cola recipe or Google's proprietary search algorithm. For a variety of reasons, certain companies often intentionally choose not to rely on conventional intellectual property rights in favour of the more nebulous realm of trade secrets.
Firstly, conventional intellectual property rights may not adequately protect certain types of commercial or technical information, including technical knowhow, business plans and corporate strategies even though these may be very commercially valuable. This is particularly true, for example, in the food and beverage industry (especially in relation to product recipes), as well as more process-driven technology companies.
Secondly, smaller SMEs and start-ups are also more likely to value trade secrets at least as much as other forms of intellectual property, as they often lack the specialised human resources and financial strength to pursue, manage and enforce a portfolio of registered intellectual property rights. Trade secrets are also particularly important in protecting the early stages of innovation, where more formal intellectual property rights might be not yet be available for the nascent product. This means, for instance, that even large engineering companies with comprehensive patent portfolios should have a system to manage trade secrets in order to protect any potential innovations.
Finally, a key advantage of trade secrets is that they offer, in principle, indefinite protection. This is often much more desirable than, for example, the 20 years of protection that a patent would have provided.
The culmination of the above is that the Trade Secrets Directive is likely to have a more pronounced effect on certain key sectors, including the food and beverage and technology sectors, as well as R&D-intensive businesses more generally.
3. What will this mean for M&A transactions in these sectors?
The new trade secret definition will undoubtedly impact the due diligence process. Whilst there is no legal guidance yet as to what kind of measures will meet the "reasonable steps" requirement, an industry-standard secrecy strategy should generally entail a number of organisational, technological and legal measures aimed at keeping sensitive information secret. The adequacy of these measures are likely to come under scrutiny in the due diligence stages of an M&A transaction following the implementation of the Trade Secrets Directive.
Specifically, prospective buyers will likely need to make more detailed enquiries as to what protocols the target business has in place to protect confidential information. Some red flags will include:
- the lack of an overarching policy document outlining how to handle or protect trade secrets and confidential information generally;
- if the business relies heavily on external contractors or consultants, but has little paperwork establishing any confidentiality or non-disclosure obligations, or internal information security training;
- the lack of a formal system for identifying, categorising and labelling trade secrets there is a high risk of information leaks in such cases, especially if there is significant employee attrition;
- the absence of internal information barriers and restrictions on access rights such that an unnecessarily large number of employees may have access to confidential information and/or can freely access it remotely;
- no or little oversight by the general counsel or other senior management over the policing of confidentiality obligations and the monitoring of any leakages thereof; and
- no incident response plan covering data breach.
The seller, in turn, will need to ensure that it is able to prove to potential buyers that they can satisfy this "reasonable steps" requirement. In particular, a seller should check and possibly revise the confidentiality provisions it has in place with employees, external business partners, contractors and consultants, as well as monitor and document compliance with such confidentiality policies, particularly in relation to new and departing employees.
More generally, the seller should ensure that it has paperwork evidencing an overarching "secrecy" policy outlining what information is confidential, what procedures are in place to ensure this, and how employees are trained to handle such confidential information.
Finally, the Trade Secrets Directive may necessitate specific representations and warranties relating to trade secrets within the relevant transaction documents. These will likely require the seller to confirm that it has adequate procedures in place to protect its confidential information. Similarly, buyers might want to ensure that the seller is under a pre-closing obligation to put in place specific confidentiality procedures that directly reference trade secrets (if these are not already present). These may include:
- ensuring that there are confidentiality and non-disclosure agreements in place with all employees, contractors and other parties to sensitive information;
- updating existing confidentiality and nondisclosure agreements to include a direct reference to "Trade Secrets", as defined by the Directive, in the contract definition of "Confidential Information";
- ensuring that any exiting employees return or destroy any trade secrets or other confidential information in their possession;
- ensuring that any trade secrets are clearly identified and marked; and
- ensuring that the target business puts in place risk management and a response plan for promptly responding to and recovering from a breach of its trade secret and/or confidential information.
In conclusion, whilst the Trade Secrets Directive is no doubt a welcome piece of legislation for many, businesses who wish to enjoy the protections conferred thereunder may need to act now to ensure that they can prove that "reasonable steps" have been taken to keep their secrets safe. Finally, as Member States are free to introduce stricter rules under the Directive, national implementation laws should also be carefully reviewed.