Safeguarding trade secrets

May 2023  |  COVER STORY | BOARDROOM INTELLIGENCE

Financier Worldwide Magazine

May 2023 Issue

Every organisation holds a body of information which, if disclosed, may damage its competitive strength, reputation or market value. Trade secrets and other confidential information are key to an organisation’s success and distinguish it from competitors.

Most forms of intellectual property (IP), such as patents, copyrights and trademarks, when they are disclosed to the general public, can be granted different forms of legal protection. Trade secrets, however, may not necessarily benefit from similar protections.

Trade secrets are varied and may include, for example, commercial data such as customer lists, product information such as recipes, or technological information such as source codes. Today, many firms are built on these kinds of ‘intangible capital’.

Assets in the form of brand, customer data, business plans, engineering specifications, product formulas, software algorithms and organisational capital account for as much as 90 percent of the S&P 500’s total assets – up from just 17 percent in 1975, according to a report commissioned by CMS and The Economist Intelligence Unit. As the report notes: “Privileged access and secrecy are inherent to the value of many of these assets, making them by definition ‘trade secrets’. Whether or not firms identify them as such, these assets are vulnerable to employee leaks, competitor theft and cyberattacks – risks that continue to grow as more business is conducted online and across borders, and as more employees work remotely. Yearly, the cost of trade secret theft reaches up to US$1.7 trillion.”

It can be a challenge for organisations to find the right balance between allowing the company to use a trade secret in its best interests while effectively preventing its public disclosure. But getting this balancing act right is key to gaining the maximum value from trade secrets in an increasingly competitive corporate landscape.

For Robert Milligan, a partner at Seyfarth Shaw LLP, trade secrets are vital to many companies in today’s business world. “Whether it is a secret formula or recipe, proprietary algorithm, company business strategy information or confidential customer list, trade secrets drive the success of many valuable companies,” he says. “Reputational harm, significant loss of market share, layoffs and bankruptcy can be realities when companies have their trade secrets misappropriated. While litigation against rogue actors can rectify some of the harm, prudent companies focus on proactive measures that position them to avoid losing their secrets in the first place.”

Recent years have seen a growing emphasis placed on the importance of trade secrets. Organisations are increasingly recognising the value of their IP, and growing more concerned about the risks surrounding it. In Aon’s 2022 Executive Risk Survey, valuing and protecting IP ranked ninth among the top risks worrying executives, up from 16th in 2021.

For certain companies, trade secrets are central to their success. More generally, they are growing in prominence due to a combination of factors. These include, among others, increased trade secret litigation, growing interest in trade secrets by tax authorities, increased activity among cyber criminals attempting to misappropriate trade secrets, companies embracing open or collaborative forms of innovation and sharing trade secrets with one another, the changing nature of employment toward remote or hybrid working, developments in technology, trade wars, and IP reforms weakening some other forms of IP.

Setting defences

Companies should take steps to safeguard their trade secrets to the extent possible. As threats come in many forms, both internal and external, it is imperative to develop best practices for protection.

A trade secret management plan will allow a company to identify core company secrets, to articulate a framework of appropriate measures to protect them across the organisation, and to nominate individuals responsible for executing and overseeing the plan. Part of the plan needs to outline how the company will respond in the event a trade secret has been stolen or otherwise misappropriated. This aspect may need to be adapted so it is specific to each jurisdiction. Companies must also consistently evaluate the plan and regularly test it to ensure it remains effective and fit for purpose.

First, companies must have a clear grasp of any information they hold which they consider to be a trade secret. According to Mr Milligan, companies need to ensure they have a good understanding of what information may qualify as a trade secret and assess the value of that information to the company’s success. “Once it has identified the information that generates significant value or has the potential to generate significant value to the company, the company should assess how it protects the information,” he suggests. “For example, does it limit access to employees and third parties who have a need to know? Does it require non-disclosure agreements with anyone who has access to its trade secrets? Does it mark such documents as confidential or otherwise limit electronic or physical access?”

Implementing both administrative and technical measures to protect trade secrets will strengthen a company’s case in any legal pursuit following loss or theft.

Administrative steps include appropriate policies and training. Management should conduct regular training sessions to make employees aware of the nature and classification of confidential information. Indeed, education should be tailored for incoming and exiting employees, as well as vendors and suppliers in certain cases, to ensure that all parties are aware of the risks surrounding trade secret data. Further, access to that information should be limited to a ‘need to know’ basis. Robust, fit for purpose policies and procedures should be in place.

Prudent companies create a culture of confidentiality within their workforce, whereby employees understand the importance of trade secrets to the organisation and have a clear understanding of why it is essential they maintain the secrecy of that information, explains Mr Milligan. “Staff training is an important mechanism to protect trade secrets,” he continues. “Apart from technology solutions, such as encryption and online monitoring, well trained employees who understand the importance of trade secrets to the company and the necessity of keeping information secure are paramount. Employees are the eyes and ears of the company and can prevent trade secret theft by identifying rogue actors and policy violations to help keep valuable information in-house.”

Companies should seek to foster a culture that embraces trade secret protection at all levels of the organisation, across all departments. It should be recognised as an internal compliance issue, with potentially serious reputational, financial and legal implications.

From a technical perspective, measures include various access controls and security features which make it difficult to steal trade secrets stored in digital formats. An essential part of that effort is accounting for metadata — those pieces of data which, if exposed, might be assembled by outsiders to reveal valuable confidential information, including trade secrets. Given the increase in cyber threats, such as hacking, electronic espionage, malware, and so on, companies need to be proactive.

“Courts expect companies to stay abreast of the latest changes in technology and require them to employ reasonable measures to protect company secrets from leaking,” notes Mr Milligan. “Reasonable measures, be they legal or contractual, may include special confidentiality agreements in place with those individuals given access to the trade secrets, non-compete clauses in employment contracts, and robust contract provisions with respect to trade secrets shared with third parties.”

As Mr Milligan points out, bring your own device (BYOD) policies are a key component of evaluating a company’s overall policies and reasonable security mechanisms. “Companies often have to balance the convenience of allowing accessibility to company data on personal devices with the potential risk to core secrets of allowing such accessibility,” he says. “Companies typically employ technological measures like two-factor authentication and encryption to secure valuable company data.”

Malicious actors can assume various forms and cause significant damage. “The ingenuity and depravity of criminality often rears its head when malicious actors target valuable trade secrets,” says Mr Milligan. “Whether it is a sophisticated spear-phishing campaign, ransomware attack or rogue actors embedded in an organisation using data exfiltration tools, prudent companies stay abreast of the latest schemes, continually assess their vulnerabilities and formulate measured action plans to protect their most valuable assets.

“We have also noticed an increase in sophisticated rogue actors attempting to obtain trade secrets by targeting a company’s executives and professional advisers, such as law firms, accountants and investment bankers, who may have access to such secrets to perform their services for the company,” he adds.

Legal matters

Global legal and economic trends suggest that companies are becoming more reliant on trade secrets than patents. This is partly due to time and financial savings; there are no filing fees, legal fees, or patent translation fees attached to trade secrets. They need only be designated as a secret, which takes effect immediately, in contrast to a patent application which may take years.

Companies therefore need to familiarise themselves with the legal constructs around trade secrets for applicable jurisdictions in which they operate, where confidential data is maintained and may potentially be disclosed. Laws are not uniform in their definition of what constitutes a trade secret and the requirements for protecting that information.

In the US, the Defend Trade Secrets Act of 2016 elevated trade secrets and introduced a number of protective and remedial measures at federal level, including the ability to file trade secret misappropriation actions in federal court. The definition of a trade secret requires that the information “is the subject of efforts that are reasonable under the circumstances to maintain its secrecy”.

In the EU, the 2016 Trade Secrets Directive, which came into force in 2018, harmonised member states’ approach to trade secrets regulation. It has brought trade secret protection across the bloc closer to positions taken in other key territories, such as the US and China. The Directive brought the definition of trade secrets in line with international standards, and did away with previous restrictions by codifying commonly accepted permitted uses of trade secrets. It also fundamentally improved the rights of trade secrets holders in litigation by introducing more practical measures to ensure the secrecy of certain information in litigation, and added clarity on certain civil remedies like the right to request destruction and recall of infringing products.

In the UK, trade secret legislation has evolved over the last five years. Until 2018, there was no legal definition of a trade secret, with the term ‘confidential information’ used to describe what would today be referred to as a ‘trade secret’. As with other jurisdictions, there is no registration process in the UK for trade secrets and, thus, by definition, there is no requirement to disclose the information to the public in exchange for protection. Instead, trade secret protection arises as a consequence of how the secret information is treated. Governance and protection of UK trade secrets is set out in the Trade Secrets (Enforcement etc.) Regulations 2018, which was derived from an EU directive and remains in place despite Brexit.

According to the UK regulations, a trade secret means information which is secret in the sense that it is not, as a body or in the precise configuration and assembly of its components, generally known among, or readily accessible to, persons within the circles that normally deal with the kind of information in question, has commercial value because it is secret, and has been subject to reasonable steps under the circumstances, by the person lawfully in control of the information, to keep it secret. However, in the UK, there has been no judicial guidance to date as to what the courts would consider to be ‘reasonable steps’.

Litigation landscape

Given the importance of trade secrets to modern business, it is unsurprising that related disputes are on the rise. Intellectual property theft and misappropriation, breach of applicable binding agreements, and corporate espionage are increasingly common themes.

“Trade secret disputes between employees and companies are regular and consistent, particularly in jurisdictions that do not allow non-competes or that have significant technology bases such as California,” points out Mr Milligan. “Trade secret law is the main protection against rogue actors in these jurisdictions and there can often be something worth fighting over.

“There have been several large trade secret jury verdicts in the past year awarding millions of dollars in damages and large attorneys’ fees,” he continues. “While there have been large damages awards, courts generally require plaintiffs to identify their trade secrets with specificity and often put reasonable limitations on discovery so that aggressive plaintiffs do not intrude on an employee’s right to compete fairly, or unnecessarily intrude on a competitor’s own secrets as part of a fishing expedition in litigation.”

Going forward, it seems likely that trade secret litigation will continue to rise. As many states and perhaps even the federal government look to limit non-competes, more companies will rely upon trade secrets and related litigation to pursue rogue actors who compromise and exploit such assets.

“Expect more trade secret litigation as more companies look to trade secrets, rather than patents, to protect valuable intellectual property,” says Mr Milligan. “As reasonable secrecy measures are part of the definition of a trade secret, prudent companies will look at their agreements and policies to make sure they cover their most valuable secrets, provide appropriate remedies and comply with applicable law, as well as employ effective employee training measures.”

Against this backdrop, companies need to know their trade secrets in fine detail and take appropriate steps to maintain their secrecy and avert misappropriation. Failure to do so can have significant financial and reputational consequences.

© Financier Worldwide

BY

Richard Summerfield