Keeping it secret…everywhere! Changes to Europe’s confidentiality regime

Every business relies to a greater or lesser extent on trade secrets, from lists of clients to key formulae and methods. Sharing this material with business partners and employees can be risky. If made public it can be difficult or impossible to put the horse back into the stable and stop further disclosure and use. Financial compensation is usually a poor second to keeping the information secret.

Those familiar with an English law environment are used to trade secrets enjoying protection, through both non-disclosure agreements and if that fails, back up from the law of confidence. But the situation is patchy elsewhere in Europe and may not offer such a strong, double layer of protection for trade secrets.

The EU is working on new laws to tackle the uneven coverage of trade secret protection across member states, while at the same time dealing with a perceived non-compliance with international obligations under the TRIPS Agreement. At the same time the initiative is aimed at increasing co-operation between businesses and researchers based in different countries.

While a greater degree of protection around Europe is generally to be welcomed, we highlight issues with the current proposals and make some recommendations about what you should do now.

Uncovering the problem

The EU has identified trade secret protection as a vital part of the protection offered to innovative businesses, in both R&D-based technology businesses and more widely. It can be the only protection for a variety of things, including:

• Inventions prior to patent filing 
• Unpatentable technology 
• Manufacturing processes 
• Formulae 
• Business solutions

Trade secret protection is particularly important to smaller organisations and start-ups, whose technology may be at an early stage of development and whose resources for registered IP protection are limited. At present, if trade secrets are misused in a country with a low level of protection, a competitor may be able to then supply goods or services across other member states within the EU. This presents a clear disincentive to cross-border collaborations. Why would a business want to collaborate with a research organisation, for example, or outsource to a manufacturer, in a country where protection is poor?

Within the EU, the protection of trade secrets ranges from statutory criminal sanctions with lengthy terms of imprisonment for misuse, to protection through contract law and equitable principles of breach of confidence.

During the review process by the EU, a report on the types of protection available across the EU was prepared, available here.

The EU’s plans unveiled

As part of a wider review of intellectual property rights, the EU proposed a directive on trade secrets in 2013.

This gives us a uniform definition for trade secrets, following the international definition in the TRIPS Agreement. Very briefly, the elements are:

• The information is not generally known or readily accessible to those normally dealing with that kind of information 
• The information has commercial value because it is secret 
• Those in lawful control of the information have taken reasonable steps to keep it secret

Note the difference here from the current English position. Instead of a requirement for “commercial value”, English law protects information “having the necessary quality of confidence” – a concept that can be difficult to pin down.

We anticipate that there will be pressure to align with the EU’s definition in confidentiality agreements.

Sanctions and remedies

The draft directive envisages a range of ways to protect the information from unlawful disclosure, to include:

• Interim measures to stop a disclosure before it happens and to prevent circulation of infringing products 
• Final orders to recall products, destroy documents and records 
• Financial compensation payable by a knowing infringer

Interestingly, the draft directive does not deal with criminal sanctions, although these are currently available in many EU countries.

Current status

You can follow the progress of the draft law here.

The draft directive is going through the legislative mill, with extensive amendments already suggested by both the EU Council and Parliament (see here and here).

With that in mind, it is difficult to be certain about exactly where we will end up, although it is likely that the main form of the directive will be as proposed by the Commission.

Problems and areas of disagreement

The limitation period

The first draft of the directive said that action to control misuse of a trade secret should be restricted to a two-year period from when the person whose trade secrets are being misused “became aware, or had reason to become aware, of the last fact giving rise to the action”.

Compare this with the English law position, where there is no strict cut-off under the rules on equity. This short cut-off date has been altered in proposed amendments to six years (EU Council) and three or two years respectively (Parliament) - clearly an area for ongoing debate.
 

The carve-outs

The proposal by the EU is that not all use and disclosure of secret information will be treated as unlawful. The exclusions from protection for information that is independently discovered or created, or available by examining publicly available material are familiar. Exclusions for obtaining information through the exercise of workers’ rights and “in conformity with honest commercial practices” seem very unclear and potentially open to abuse. It is also concerning that specific removal of protection in situations such as “legitimate use of freedom of expression”, and whistleblowing has been proposed.

The abuse provisions

Controversially, the directive provides for action to prevent abusive litigation. This will apply where the trade secret owner has “initiated the legal proceedings in bad faith with the purpose of unfairly delaying or restricting the respondent’s access to the market or otherwise intimidating or harassing the respondent”.

Although one can understand the intention behind this type of provision, it could itself be open to abuse as a tool to be deployed against the owner of the information in a way comparable to the UK’s “threats” provisions in patent and trade mark law.

Expected timeline

The EU has not committed itself to a target date, and several stages of the process remain. Once the text is finalised, EU countries will have two years to update their laws.

What are the implications for business?

While the improvements in countries where there is no protection of trade secrets will be welcome, there are features of the proposals which may dis-incentivise businesses from collaborating cross-border.

Until the directive becomes law and is implemented, we will not know if the protection it offers will be another layer on top of what is already available; in effect a separate right; or whether it will introduce limitations and carve-outs to existing national protection. In their comments on the proposal, member state ministers emphasised that “national law may provide for more far-reaching protection” than the directive requires. But they added that this should still be subject to the same limits and safeguards. We recommend keeping a close eye on this proposal to ensure that you are ready for the changes it will make.

Where business-critical information is to be disclosed you should make sure that non-disclosure agreements are set up beforehand. These need to explain precisely what information is covered, who will receive it and how and what they are to do to protect it. The duration of the agreement should be clear with provision for what should happen at the end of the arrangement. Ensuring that these agreements are subject to a law and jurisdiction that you know makes their effect more predictable. This at least gives you the option of taking action for breach of contract rather than turning to weak or uncertain rules on protection of trade secrets.

While reviewing your trade secret protection, it could be a good time to review your intellectual property policies in general and consider applying for registered protection where that is an option.

To learn more about the details of these proposals and how they might affect your business, contact one of our technology lawyers.