Protecting your secret: what the new trade secrets directive means for you

A trade secret is a valuable piece of information for an enterprise that is treated as confidential and that gives the enterprise a competitive advantage. This can include recipes (such as for Coca Cola or Krispy Kreme), certain production methods or Google's proprietary search algorithm.

Businesses are increasingly being exposed to the misappropriation of trade secrets, be it from competitors or ex-employees.

Historically, any person who has had a trade secret taken by another company has had to rely on the law of confidence which has been developed by the Courts. However, from 8 June 2018, the Trade Secrets (Enforcement, etc.) Regulations 2018 (SI 2018/597) came into force (the Regulations). The Regulations derive from EU Legislation and are being implemented so as to harmonise the UK's position on trade secrets with that of the EU. Such changes will continue after Brexit.

So, what steps are you taking to protect your trade secrets?

What do the Regulations mean?

The content of the Regulations are largely reflective of the current English law of confidence, which has developed through case law to establish the protection of confidential information which is disclosed in circumstances where the recipient of the information is aware of its confidential nature. For example, Regulation 3 seeks to set out the relationship between the protection of trade secrets under the Regulations and under the law of confidence. This Regulation states that "the acquisition, use or disclosure of a trade secret is unlawful where the acquisition, use or disclosure constitutes a breach of confidence in confidential information". Further, the remedies available for a breach of the common law duty of confidence will be available where there is a breach of the Regulations.

The new Regulations codify the general provision under the current law. However, they do introduce some key differences which will affect how to protect trade secrets.

What is a trade secret?

Regulation 2 sets out the definition of trade secret:

"information which

(a) is secret in the sense that it is not, as a body or in the precise configuration and assembly of its components, generally known among, or readily accessible to, persons within the circles that normally deal with the kind of information in question,

(b) has commercial value because it is secret, and

(c) has been subject to reasonable steps under the circumstances, by the person lawfully in control of the information, to keep it secret."

Reasonable Steps

In its definition of a 'Trade Secret', the Regulations state that in order for a trade secret to be protected under the Regulations, it must have been 'subject to reasonable steps under the circumstances, by the person lawfully in control of the information, to keep it a secret'.

This is a new requirement under the Regulations and one that businesses will have to comply with in order to benefit from the protections as set out in Regulations, with the Court required to take into account 'the measures taken to protect the trade secret' when considering whether or not to enforce the rights.

The difficulty that trade secret holders will face is determining the extent by which they will be required to protect their trade secrets in order to be protected by the new Regulations. It is not clear what is meant by 'reasonable steps' under the Regulations and it is likely that this will not be known until a case is brought before the Courts under the Regulations, in which measures taken by trade secret holders will be scrutinised. What is clear is that businesses will be required to have appropriate checks and balances to prevent such information from being leaked or stolen.

Possible considerations for your business to protect its trade secrets are considered in practical steps below.

What practical steps can you take?

The following measures are a good starting point to make sure that you are actively protecting your business's trade secrets:

• Non-Disclosure Agreements (NDA): when entering into any form of disclosure with a third party, ensure that you have an NDA in place which restricts their use and disclosure of any confidential information. It is also important to ensure that any NDA places obligations on a third party to ensure that similar restrictions are placed on any further persons to whom the information is disclosed, such as employees and contractors.

• Trade Secret Audits: these are likely to be seen as a key factor in deciding if a business has taken 'reasonable steps' to protect their trade secrets. A Trade Secret Audit involves a review of the business' trade secrets to identify where the trade secrets are stored and who has access to them. It would also be advisable to keep an updated inventory of all identified trade secrets. For example, if a trade secret such as a recipe is stored in a physical copy, how is access to this monitored and which individuals in the business have this access? These audits can apply to both physical and electronic storage and access can allow a business to identify where there is risk in relation to its trade secrets and how these can be minimised.

• Employee Training: in conjunction with Trade Secret Audits, it is important for employees to understand the significance of protecting a trade secret and how misuse of the secret can affect the business. This can be achieved by giving regular training to employees so that they understand this, particularly if they have access to elements of trade secrets and especially if they work from outside of the office and have access to trade secrets whilst doing so. A Court is likely to find that allowing employees to physically remove trade secrets from the workplace, or access them electronically with unsecure methods, is not a 'reasonable step' in protecting a trade secret.

• Protective Measures: in carrying out a Trade Secret Audit, it may be discovered that trade secrets are not secure and so it may be necessary to use various measures to protect the information including physical, technical, or contractual measures. If an audit were to find this, the business would need to consider what extra steps need to be taken; for example Coca-Cola famously protect their secret formula in a vault at the 'World of Coca-Cola' in Atlanta. Further to this, it is rumoured that only two Coca-Cola employees have access to the recipe and they must not travel together at any given time. Whilst the protection of a trade secret may not need to be as extreme as in the Coca-Cola example, it is important to consider what further measures are needed to protect the information. Reviewing contracts with employees and contractors would be a sensible step together with understanding how third parties store and secure any confidential information provided. Finally, it is advisable to restrict access to documents and ensure that any devices are password protected.

• Procedures: establish a procedure to identify any newly created trade secrets to ensure that they are logged and measures are taken to ensure that the information is safeguarded. Such information should be marked as "confidential". Further, if a trade secret is stolen or leaked, ensure that you have a procedure in place to deal with it and that you are able to identify the breach by, for example, logging access to any documents and keeping records of documents printed. Finally, access should be limited to the confidential information perhaps on a "need to know" basis and any visitors to the premises should sign in and, if necessary, be asked to sign a confidentiality agreement.

When should you make changes?

The Regulations came into force on 9 June 2018 and any breaches of the Regulations may be brought before the Courts from that date. It is not yet clear if the Courts will consider the Regulations retrospectively, for example, if a trade secret is leaked prior to the Regulations coming into force and reasonable steps to protect this trade secret were not in place at that time.

It is likely that, in a situation such as this, a claim will still be able to be brought under the English law of confidence. However, it is advisable that businesses take the above actions, and any other steps they consider necessary, as soon as possible.

What we can do to protect your Trade Secrets

Foot Anstey can support you and your business in protecting your trade secrets by advising on the strength of the protection that you currently have in place and assisting with identifying further measures which need to be taken to protect your rights. In particular, we are able to provide Trade Secret Audits on your business to advise if we believe that you are currently complying with the 'reasonable steps' requirement under the new legislation and, if not, provide you with advice on the recommended changes you could make in order to comply.

Further to proactively protecting trade secrets, we frequently assist clients with enforcing confidentiality obligations, most notably where employees have left businesses and taken information with them. Please do get in contact if this has happened to you or your business.

I would encourage businesses to take steps to review what trade secrets they have and how they are protected. This will place businesses in a far better position to enforce their rights in the future.

If you would like some more information about how to protect your trade secrets, or whether you have suffered a breach of your trade secrets or confidential information, please get in touch with Paul Cox (Partner) at [email protected] or on 02380 172212 or Rachel Warren (Senior Associate) at [email protected] or on 01392 685210.