The Trade Secrets Directive: New protection for businesses?


Recent years have seen an increasing demand for alignment of EU law to ensure businesses can protect their innovative work and preserve competitive gains, and despite the Brexit vote we feel this Directive is still highly relevant. The protection of confidential information is seen as essential to foster innovation and economic growth. This has led to the Trade Secrets Directive (Directive), which was adopted on 26 May 2016 by the European Council and will need to be implemented by all Member States by the end of 2018.

The date that the Directive comes into effect means theoretically the UK could revisit its position. However, as the Directive will be most likely be welcomed by the UK business community, and in many respects codifies existing English law, there is no obvious reason for it to be resisted, and English courts may well look for comparable steps to protect secrets to have been taken as a precondition for granting relief.

The Directive contributes to the commitment to create a single market in the EU for Intellectual Property Rights (IPR). In fact, every IPR starts with a secret. Writers do not disclose the plot they are working on (a future copyright), car makers do not circulate the first sketches of a new model (a future design), companies do not reveal the preliminary results of their technological experiments (a future patent), companies hold on to the information relating to the launch of a new branded product (a future trade mark).  It is these early stages that need protecting.

As we discuss below, the Directive will influence market practice and align the protection of trade secrets across multiple jurisdictions. In order to ensure convergence, UK businesses should comply with standards equivalent to those under the Directive in order to ensure the protection of trade secrets is met despite any moves from the UK to leave the EU.

What is the current position?

Currently the position across the EU varies greatly. As it stands, only Sweden has specific legislation on trade secrets.  In comparison, the Netherlands relies on tort law, Malta relies on contract, whilst the UK and Ireland rely on common law.

Even a uniform definition of "trade secrets" does not exist within in the EU. As it stands, there are only 11 countries which have a definition of a trade secret. These definitions can be found in the Swedish trade secrets law, the Italian and Portuguese Codes of Intellectual Property and the unfair competition laws of Bulgaria, amongst others.

The challenges to businesses to protect their trade secrets across such a "patchwork" is obvious.  This divergence has prompted the calls for alignment and confirmed protection across the EU.

Why is the EU implementing the Directive?

A trade secret is self-evidently a valuable piece of information that creates competitive advantage.  One only has to think of classic examples of trade secrets such as the Coca-Cola recipe, Google's proprietary search algorithm, the New York Times Best-Seller list's methodology and the Krispy Kreme recipe. Of course, these products have a clear competitive advantage because of their trade secret.

In 2013, when the Directive was originally tabled, 1 in 4 European companies reported at least one case of information theft. Unsurprisingly 80% of companies believed the EU should address legal protection against theft of trade secrets. Research for the Directive found that due to the risk of misappropriation with ineffective legal protection, incentives to undertake innovative activities were affected.

By its nature a trade secret is a particularly nebulous area of law. By contrast with IPR, trade secrets are not disclosed to the world at large. Trade secrets must be protected from competitors by instituting special procedures for handling them, as well as technological and legal security measures. Use of the right sort of contractual measures can effectively continue to protect secret information, not expiring like a patent or copyright. 

Protection of a trade secret precedes other IPR protection as an initial stepping stone. The Directive will roll out a minimum level of protection that every Member State has to institute. 

When is the Directive being implemented?

At long last, on 14 April 2016, the EU finally agreed the Directive.  Following the so-called "Panama Papers" episode, there was a fear that whistleblowers and journalists might be inhibited under the terms of the Directive, but that did not prevent the Directive going ahead.

As explained above, on 26 May 2016 the Council approved the Directive for roll-out. The Member States will have two years to implement the Directive into national law, i.e. by the end of 2018.

The US Approach

On 11 May 2016, the Defend Trade Secrets Act (DTSA) was signed and is effective immediately. Until now, trade secrets in the US have been protected only at state level. Interestingly, this takes the EU into closer alignment with the US enabling a greater commonality of approach in these areas.

The EU and US have both similarly qualified the definition of a trade secret. In both definitions the information must be kept confidential and have a commercial value because of the confidential nature of the information, which further emphasises the global desire for protection of confidential information. We would expect lessons to be learnt from the application of the law in each area.

What does the Directive say?

The Directive covers unlawful acquisition, use and disclosure of trade secrets. An EU wide definition of "Trade Secrets" is included in Article 2 of the Directive as follows:

'Trade Secret' means information which meets all of the following requirements:

a)         it is secret in the sense that it is not, as a body or in the precise configuration and assembly of its components, generally known among or readily accessible to persons within the circles that normally deal with the kind of information in question;

b)         it has commercial value because it is secret;

c)         it has been subject to reasonable steps under the circumstances, by the person lawfully in control of the information, to keep it secret. 

[emphasis added]

What are reasonable steps to keep matters secret?

This is an area that will need to be developed as each country develops the definition. Merely labelling it a trade secret will not be enough. The US experience indicates that it will be necessary to show true protective steps have been taken, failing which the trade secret will not be protected.

The "commercial value" requirement is likely to remove claims for the secrecy of private life, save, perhaps, where a celebrity could claim commercial value in aspects of their private life which they have marketed.

What amounts to unlawfully acquiring a trade secret?

Factors to consider are laid out in Article 4 of the Directive. They include "unauthorised access" to the trade secret and "any other conduct which is considered contrary to honest commercial practices".

This open-ended definition of "any other conduct" is likely to cause a steady stream of national litigation and references to the ECJ in order to determine what this means.

Who can be liable? Is there "secondary" liability?

Article 4(4) makes acquiring a trade secret unlawful "whenever a person knew or ought, under the circumstances, to have known that the trade secret had been obtained directly or indirectly from another person who was using or disclosing the trade secret unlawfully".

This goes a step further, allowing so-called secondary liability claims, where the recipient knew that the trade secret was unlawfully obtained from another. Employers will need to protect themselves from the over-zealous and wrongful activities of employees.

Are there defences? 

There is a protection, in Article 3, if persons have acquired the trade secrets lawfully through "(a) independent discovery or creation; (b) observation, study, disassembly or testing of a product or object that has been made available to the public or lawfully in the possession of the acquirer; (c) the right of worker or workers' representatives to information; and (d) any other practice which is in conformity with honest commercial practices."

As part of the Directive's aim is to foster competition and innovation amongst the Member States the above provisions allow for lawful acquisitions of trade secrets. The defences are in place in order to prevent exclusive rights to know-how or information, protected as trade secrets, over and above what is necessary.

It is a potential defence on the basis that one has "reverse engineered" the alleged trade secret information and therefore did not misappropriate it (as per (b) above). This clarification of reverse engineering and parallel innovation must be guaranteed, given that trade secrets are not an IPR. Notably, the Directive's recitals refer to the need to prevent "parasitic copying" and "slavish imitations": reverse engineering is a defence, therefore, but not so as to deter innovation.

Is there greater protection for "whistleblowers"?

The Directive prevents retaliation against whistleblowers "for revealing misconduct, wrongdoing or illegal activity, provided that the respondent acted for the purposes of protecting the general public interest".

This differs to previous definitions, such as in English law, which provided that the disclosure had to be "necessary". So, the Directive permits disclosure of a trade secret which is merely accidental or incidental.  On the other hand, it introduces a public interest requirement albeit this is probably a low threshold to prove.

What are the remedies?

The measures proposed in Article 12, Injunctions and corrective measures, Article 13, Conditions of application, safeguards and alternative measures and Article 14, Damages, are consistent with the UK approach.

A key development is that Article 16, Sanctions for non-compliance with this Directive, imposes sanctions on any person who fails or refuses to comply with any measure adopted pursuant to Article 9, Preservation of confidentiality of trade secrets in the course of legal proceedings, Article 10, Provisional and precautionary measures and Article 12, Injunctions and corrective measures. These could include recurring penalty payments and the sanction must be effective, proportionate and dissuasive. We wait to see  how the Member States will introduce these as effective remedies.

What might the impact be in EU jurisdictions? Are there early indications?

Currently France has proposed a trade secrets law, with a specific offence of violation of information protected by trade secret. The Directive may impact the suggested text and ensure France create a single set of rules.

In Germany, there are a number of different potential actions included in the German Act against Unfair Competition. The new Directive will clarify on (i) when trade secrets can be used; and (ii) how trade secrets are to be treated in legal proceedings.

In Belgium, there is no single act for the protection of trade secrets and if the owner takes court proceedings, the confidential information is publicly available. The Directive will ensure protection of confidentiality during and after legal proceedings.

In the UK, the Directive will be welcomed. In most cases it may likely codify existing practice, but will still require the refreshing of contractual terms, policies, procedures and the steps taken to protect.

The real impact will be on businesses operating cross-border in the EU. The Directive will assist by creating a minimum standard of harmonisation, and the domestic laws of many countries will change so as to comply.

Actions and practical tips

Assess the impact of the new Directive in all of your EU locations as soon as possible.

  1. Identify your trade secrets and where they are created.
  2. Ensure your confidential information is properly identified as such.
  3. Assess your EU wide approach.
  4. Review your employment contract protections and ensure they sufficiently cover trade secrets.
  5. Ensure precautionary measures are in place to minimise liability when hiring employees from a competitor. 
  6. Review your training procedures.
  7. Identify your current protective mechanisms, to include:
    • appropriate provisions in employment contracts;
    • usage of NDAs;
    • appropriate policies and procedures;
    • security systems;
    • IT systems; and
    • document management systems.
  8. Monitor best practice in terms of demonstrative steps.
  9. Make sure employees adhere to honest commercial practices and safeguard yourself against those who do not.
  10. Ensure that your employees have access to an internal "whistleblowing" facility to forestall external disclosure.
  11. Monitor the policies implemented at a national level and take appropriate action accordingly.
  12. Keep a watching brief on Brexit developments and how they may impact the Trade Secrets Directive and adapt plans if necessary.

If you are in doubt and require advice, please contact Jonathan Exten-Wright.