Trade secrets: Have you the proper safeguards in place?

As we have already written, TSA comprehensively regulates the area of trade secrets (and in this respect also changes the provisions of the Companies Act and Employment Relationship Act), whereas it also sets anew the conditions which a trade secret must fulfil in order to enjoy legal protection, and determines legal measures available to trade-secret holders in cases of violation.

As opposed to previous regulation of trade secrets pursuant to the Companies Act (ZGD-1), information which the company has not denoted as trade secret in a special resolution shall no longer be considered as trade secret. This is so, even if it is obvious that the company would incur considerable damage if such information were disclosed to an unauthorized person. The legislator has, in so doing, followed the argument that the company which does not adequately protect its trade secrets cannot enjoy legal protection. It is precisely the obligation of the holder of trade secrets to adequately ensure their protection which is the main novelty of the new Act.

Pursuant to TSA, a trade secret is now considered the undisclosed know-how and business information which meets all of the following requirements: (i) it is a secret, which is not generally known among or readily accessible to persons within circles that normally deal with such kind of information; (ii) it has a commercial value, and (iii) the trade-secret holder has taken reasonable steps to keep it secret. 

The crucial element in deciding whether an information even qualifies as protected trade secret, is thus the assessment whether the company adopted all reasonable steps to protect the information as a trade secret. In this respect, TSA stipulates that it is assumed that the condition of reasonable steps is fulfilled if the holder designated the information as trade secret in writing, and notified thereof the persons who come into contact with this information, especially company members, employees, members of company bodies and other persons.

It follows from the above that the holders of trade secrets shall have to first (i) determine which information and knowledge they wish to protect as trade secrets, and then (ii) check whether they have (already) adopted necessary measures for their protection and (iii) adopt such measures, if necessary.

In case of companies and other enterprises, it is thus advisable that, in the first phase, they establish an internal registry which outlines the information and knowledge which shall represent/constitute a trade secret, and also designate how important respective trade secrets are for the company, who comes into contact with such information, and consequently what level of protection is required for respective information. In addition to this, it is also advisable to prepare a risk assessment for the instance that some of this information is disclosed. Only after the making of such analyses, a company can adopt the most sensible plan of trade secret protection. 

Given the provision of second paragraph of Article 2 of TSA, which establishes the presumption of fulfilment of condition of reasonable steps in case of written determination of business secrets, we advise companies, as a first measure for protection of trade secrets (after analysis of current state), to adequately denote trade secrets in written form. With intention of proving diligent protection of trade secrets, it is also advisable to adopt adequate internal acts of a company, eg. Rules or Policy on protection of trade secrets. Such internal rules may already contain a detailed list of trade secrets or at least the manner in which trade secrets may be identified. In addition, such internal rules may also regulate rather comprehensively the area of trade secret protection (from the presentation of measures which employees must respect, to presentation of consequences in case of violation, etc). It is necessary to acquaint with such internal acts all persons which may have access to trade secrets, i.e. especially shareholders, members of bodies of a company, employees and also all other persons, particularly business partners to which certain trade secrets are disclosed. We also advise that you acquire signed statements from all such persons that they are acquainted with provisions of such internal rules and with the fact that they must protect the trade secrets of the company.

In addition to the internal rules, we also advise that the persons which have access to trade secrets (i.e. all above-listed persons) or at least to the most sensitive trade secrets, are required to sign an additional confidentiality agreement with which they confirm that they are acquainted with internal rules and with how trade secrets of a company are denoted / identifiable, that they are required to protect them and that they accept all necessary consequences in case of violation. In the jurisprudence of US courts, which is rather extensive in this area, the courts, when assessing whether a company took all reasonable steps to protect its trade secrets, give most weight to the question whether the company required its employees and business partners to sign confidentiality agreements, or whether such agreements are a part of other contracts/agreements with such persons.

The fact that such contractual protection of trade secrets is particularly important stems also from Article 5 of TSA, which stipulates that the use or disclosure of trade secret is unlawful if the person violated a confidentiality agreement or any other obligation of harbouring of trade secrets with its use or disclosure of trade secrets.

In terms of measures of written protection of trade secrets we also advise that the obligation of protection of trade secrets be included in the employment agreements with employees and other agreements with members of company bodies, and that all documentation which represents trade secret be clearly denominated with the sign “TRADE SECRET” and possible addition that the disclosure of trade secrets is strictly forbidden and may cause important legal consequences.

We should emphasize that the legal presumption that the holder adopted all reasonable steps for protection of trade secrets if it designated the secrets in written form, is merely a rebuttable presumption. This means that, in case of dispute, the alleged infringer could attempt to prove that merely a written denomination of business secrets in given circumstances did not represent sufficient response for protection of trade secrets, and that he/she thus assumed in good faith that the divulged information was not a trade secret.

We therefore advise companies to adopt certain other measures apart from written ones. In this notice we present some of the measures and standards which have proven to be the most important in assessing the notion of taking of reasonable steps in the jurisprudence of the US courts, which have for some time been assessing the same standard of “reasonable steps” which has now been included in the EU directive no. 2016/934 on protection of trade secrets. In line with US jurisprudence, the following criteria are considered to be the most important when assessing whether a company adopted all reasonable steps to protect its trade secrets:

• whether a company restricted access of employees to the most sensitive information, whereas the company should follow the principle that employees should have access only to those trade secrets which they necessarily require for performance of their work;
• whether a company adopted measures of physical and electronic protection of trade secrets (eg. that it keeps its most important documents in a physically separate space, that it adequately protects its IT system, that it makes sure that the passwords for access to respective documents are protected and are not freely available to employees, that the IT system is being subject to regular maintenance and upgrades, etc.);
• whether a company performed a risk assessment to identify and prioritize the vulnerability of trade secrets;
• whether a company designated one or more persons within the company to be responsible for the subject of trade secrets and for carrying out of the policy of protection of trade secrets of the company;
• whether a company has performed or is regularly (eg. at least once a year) performing the education of employees regarding protection of trade secrets (where the employees may also be acquainted with the fact why it is very important that this be protected, as well as with the consequences they may incur if they divulge trade secrets, and with the entire rules of protection of trade secrets), and whether it has regularly verified the protection of trade secrets by its business partners and has communicated to them its expectations regarding safeguarding of trade secrets;
• whether a company is regularly monitoring the efforts for trade-secret protection in the company, and whether a company has adequately adjusted its trade-secret-protection plans to the development of the business of a company.

In any event, we advise that you adopt the above-listed measures for trade secret protection also because appropriate preventive measures may prove to be a substantially smaller cost than later action and enforcement of rights in judicial proceedings. In so doing, it is necessary to also follow the principle of proportionality, namely that the more important the trade secret is (i.e. the larger that damage which can occur from its disclosure), the more stringent measures need to be adopted for its protection. 

In case of additional questions with respect to the above presented, and in case that you require assistance in preparing the written documentation for protection of trade secrets, we remain at your disposal.