A harmonized trade secrets protection regime is coming to Europe and the US. Until now, there has been a fragmented approach to trade secrets across Europe, with some countries having specific trade secrets legislation and others relying on unfair competition, tort, or contract law. Trade secret protection in the US has been somewhat less fragmented, as almost every state has adopted some version of the Uniform Trade Secrets Act ("Uniform Act") (New York and Massachusetts being notable exceptions). On May 11, 2016, the President signed into law the Defend Trade Secrets Act ("US DTSA"), which creates a federal cause of action with substantive elements that are very similar to the Uniform Act. For practical considerations regarding the US DTSA, see our recent publication.

In November 2013, the European Commission proposed a new trade secrets directive with the aim of harmonizing the law and thereby encouraging European cross-border investment, competition, and innovation. Following much debate, the "Directive on the protection of undisclosed know-how and business information (trade secrets) against their unlawful acquisition, use and disclosure" (the "EU Directive") was finally adopted by the European Parliament on April 14, 2016 and by the Council on May 26, 2016. EU Member States have two years from adoption to implement the EU Directive into their national laws.

In this alert, we outline the EU Directive's key provisions and discuss its potential impact on companies operating in Europe (with a particular focus on implications for Germany and the UK). We also provide recommendations for companies doing business in Europe and compare the EU Directive with the US DTSA.

SCOPE OF THE EU DIRECTIVE

The EU Directive sets out rules on the protection against the unlawful acquisition, use, and disclosure of trade secrets. But it specifies only a minimum harmonization of trade secrets protection in the EU. In other words, while the EU Directive generally provides for uniform protection, Member States can implement higher standards. The EU Directive does not address criminal sanctions, but does provide for civil rights and remedies. Member States remain free to maintain existing criminal sanctions.

WHAT IS A TRADE SECRET?

Under the EU Directive, a "trade secret" means any information that: (i) is secret in the sense that it is not, as a body or in the precise configuration and assembly of its components, generally known among or readily accessible to persons within the circles that normally deal with the kind of information in question; (ii) has commercial value because it is secret; and (iii) has been subject to reasonable steps under the circumstances, by the person lawfully in control of the information, to keep it secret. In short, a trade secret is information that is not generally known, has commercial value and is protected by the trade secret holder to keep it secret.

This is consistent with the definition used in the World Trade Organization's Agreement on Trade-Related Aspects of Intellectual Property Rights ("TRIPS Agreement"). Nevertheless, the "reasonable steps" requirement appears to be novel for some Member States, which may not have incorporated the trade secrets definition in the TRIPS Agreement into their national laws. What constitutes "reasonable steps" may vary according to the trade secret's value, the threats faced, and the cost of particular measures and likely will be the subject of future interpretation by the Court of Justice of the European Union ("CJEU").

Although the rights in the EU Directive are similar to intellectual property ("IP") rights, they are not considered IP rights. This is because the European lawmakers did not want to trigger provisions of other European laws relating to IP, such as the EU IPR Enforcement Directive (2004/48/EC) and the EU Customs Enforcement Regulation ([EC] No. 1383/2003).

LAWFUL ACTS

The acquisition of trade secrets will be lawful if obtained by: (i) independent discovery or creation, (ii) reverse engineering or (iii) any other practice which conforms with honest commercial practices.

  • Reverse Engineering: While independent creation or discovery appears to be a universally accepted concept, in certain parts of Europe at least reverse engineering can be a contentious practice. In this context, reverse engineering of trade secrets means "the observation, study, disassembly or test of a product or object that has been made available to the public or that is lawfully in the possession of the acquirer free from any legally valid duty to limit the acquisition of the trade secret." While reverse engineering may be considered fair practice in the majority of Member States, it may be considered unfair competition and thus unlawful in other countries such as Germany (e.g., according to German case-law, reverse engineering may be unlawful if it requires a significant investment in workforce or technology to reverse engineer a product). In any case, despite the exception in the EU Directive, reverse engineering of trade secrets still may be contractually prohibited.
  • Workers' Representatives: There is an exception for workers' representatives (e.g., trade union representatives) to exercise their rights to information and consultation in accordance with EU and national law or practices.
  • Honest Commercial Practices: The term "honest commercial practices" is not defined or explained in the EU Directive. If and when the CJEU provides guidance on the term, its treatment by the TRIPS Agreement likely will be relevant. The TRIPS Agreement describes "honest commercial practices" as "a manner contrary to honest commercial practices shall mean at least practices such as breach of contract, breach of confidence and inducement to breach, and includes the acquisition of undisclosed information by third parties who knew, or were grossly negligent in failing to know, that such practices were involved in the acquisition."

In addition, the acquisition, use, and disclosure of trade secrets shall be considered lawful to the extent that such acquisition, use, or disclosure is required or allowed by EU or national law.

Exceptions: The EU Directive also provides for various exceptions.

  • Freedom of Expression and Information: Investigative journalism was a hotly contested topic, with the media sector raising significant concerns. The final draft of the exception refers explicitly to the Charter of Fundamental Rights of the EU and to respect for the freedom and pluralism of the media.
  • Whistleblowers: Another exception that triggered much debate involved whistleblowers. Under the whistleblower exception, the trade secret protection does not extend to cases in which information is disclosed for the purpose of revealing relevant misconduct, wrongdoing, or illegal activity. The discloser, however, must have acted to protect the general public interest. Critics of this exception argue that it may be misapplied to an unnecessarily broad publication of trade secrets. As with other language in the EU Directive, the CJEU likely will clarify what constitutes "public interest" at some point.
  • Workers: Protection does not extend to trade secrets disclosures by workers to their representatives as part of the legitimate exercise of their functions in accordance with EU or national law. Guidance in the EU Directive makes clear that the EU Directive is not intended to affect or limit the use of collective agreements regarding duties not to disclose trade secrets, provided that such agreements do not restrict the scope of exceptions in the EU Directive.
  • Legitimate Interests: There is also an exception for "legitimate interests" recognized by EU or national law. In the absence of guidance in the EU Directive, the CJEU likely will be asked to provide further guidance in due course.

EMPLOYEE MOBILITY

The EU Directive expressly responds to concerns that it may restrict employee mobility, stating that it shall not limit "employees' experiences and skills honestly acquired in the normal course of employment." The uncertain boundaries of this statement, however, make future interpretation by the CJEU inevitable.

This Directive's approach appears broadly consistent with the approach taken to "residual knowledge" of employees in certain Member States (e.g., the UK, see below). It also reflects the approach often taken by parties to the use of "know-how" in outsourcing and other technology agreements, i.e., to include a "residuals clause." In any case, the EU Directive explicitly states that it will not prevent employers from concluding non-competition agreements with employees. Accordingly, restrictions and non-compete clauses concerning the use of trade secrets may continue to be used by employers, subject to national law.

UNLAWFUL ACTS

  • Unlawful Acquisition: The acquisition of trade secrets is unlawful when carried out by: (i) unauthorized access to, appropriation of, or copying of items lawfully under the trade secret holder's control; or (ii) any other conduct considered contrary to honest commercial practices. It also is unlawful for a person to acquire trade secrets from another party if that person knew or should have known that such party was using or disclosing trade secrets unlawfully.
  • Unlawful Use or Disclosure: The use or disclosure of trade secrets is unlawful when it is carried out by a person who: (i) has acquired the trade secrets unlawfully or (ii) is in breach of a confidentiality agreement or any other duty not to disclose or to limit the use of the trade secrets. In addition, the use of trade secrets is unlawful if the user knew or should have known that the information was obtained from another person who was using or disclosing it unlawfully. The production, offering, or placing on the market of infringing goods also is unlawful, as well as the import or export of infringing goods for those purposes, if the person using the trade secrets knew or should have known that the trade secrets were used unlawfully. "Infringing goods" are goods with a design, characteristic, functioning, manufacturing process, or marketing that significantly benefits from trade secrets which were unlawfully acquired, used, or disclosed.
  • The EU Directive makes clear that direct infringement should not require proof of willful intent or gross negligence. Such proof of willful intent or gross negligence should only be required in case of indirect infringement, i.e., when obtaining the trade secret from another person who acquired, used, or disclosed the trade secret unlawfully.

RIGHTS AND REMEDIES

The EU Directive grants trade secret holders a broad range of remedies that are comparable (but not identical) to those available in intellectual property cases, e.g., injunctive relief, corrective measures, and damages.

  • Injunctions and Corrective Measures

    • In terms of provisional measures, a trade secret holder's remedies may include an injunction and the seizure or delivery of suspected infringing goods. Permanent remedies may include an injunction, corrective measures such as the recall of infringing goods, and the destruction or delivery of items containing or implementing the trade secrets. Sanctions such as recurring penalty payments are also available for non-compliance with both provisional and permanent measures.
    • An infringer may request pecuniary compensation instead of the measures listed above, if: (i) the infringer neither knew nor had reason to know that the trade secret was obtained from another person who was using or disclosing it unlawfully, (ii) the execution of other measures would cause disproportionate harm to the infringer, and (iii) pecuniary compensation appears to be reasonably satisfactory. If applied, pecuniary compensation must not exceed the amount of royalties that would have been payable if the person had requested authorization to use the trade secret. In some Member States, e.g., Germany, this possibility of pecuniary compensation instead of an injunctive relief or corrective measures is novel.
  • Damages: Damages should be appropriate to the actual prejudice suffered due to the infringement. Appropriate factors are the negative economic consequences, including lost profits, that the injured party has suffered and any unfair profits made by the infringer. In appropriate cases, elements other than economic factors, such as the moral prejudice caused to the trade secret holder, may be considered. Damages may be set as a lump sum on the basis of elements such as, at a minimum, the amount of royalties or fees that would have been due if the infringer had requested authorization to use the trade secrets. With respect to employees, liability for damages may be limited if the employee acted without intent.

PROTECTION OF TRADE SECRETS DURING LITIGATION

The EU Directive provides for specific measures to protect trade secrets during litigation, including restricting access to documents and to hearings. Although the laws of a few Member States allows certain in camera proceedings, these proceedings tend to be rare in practice. The EU Directive therefore does not foresee the use of completely in camera proceedings. Instead, it allows a "limited number of persons," consisting of at least one natural person and one attorney from each party, access to otherwise confidential documents and secret hearings. These individuals are subject to a confidentiality obligation that survives termination of the proceedings.

In addition, court judgments containing confidential information will be kept confidential by removing pages containing confidential information or redacting those parts. Trade secret holders may request the publication of such a court judgment, which keeps confidential information secret but still identifies the infringer and the infringing acts. Such a request for partial publication is subject to a strict proportionality test that considers the interests of both the trade secret holder and the infringer. It remains to be seen whether the courts of the Member States will grant such requests. In Germany, for example, motions based on a similar provision in the German Patent Act ("PatG") are rarely granted because applicants often fail to show the required legitimate interest.

LIMITATION PERIOD

Actions for trade secret infringement must be brought within a maximum of six years, but Member States can implement shorter time periods. The six year maximum limitation period is a welcome change for trade secret holders over prior draft versions of the EU Directive (e.g., the 2013 draft version, which specified a much shorter two-year limitation period).

WHAT THE EU DIRECTIVE DOES NOT DO

As mentioned above, trade secrets are not considered IP under the EU IPR Enforcement Directive and the EU Customs Enforcement Regulation. Consequently, trade secrets under the EU Directive do not benefit from the mechanisms that those regulations provide for IP rights, such as pre-litigation evidence collection under the EU IPR Enforcement Directive and border measures under the EU Customs Enforcement Regulation. The EU Directive does not provide specific rules on such measures for trade secrets either, leaving a gap in their protection.

Since Member States are free to implement or maintain higher standards of protection, such gaps may be filled by the laws of the Member States. As an example, the so-called "Düsseldorf procedure" in German patent cases permits obtaining and safeguarding evidence before filing a patent infringement complaint. This procedure, which was initially established by courts in Düsseldorf, could be extended to trade secrets.

Furthermore, due to lack of legislative power on the EU level, the EU Directive also does not cover criminal sanctions. Here, too, laws of the Member States may be used to fill this gap.

IMPLICATIONS OF THE EU DIRECTIVE FOR GERMANY

Although Germany has no specific statute that comprehensively regulates the law of trade secrets, the standard of trade secrets protection in Germany is generally high. As a result, implementation of the EU Directive likely will require only minimal changes.

Trade secrets are currently protected by the Act Against Unfair Competition ("UWG"), which renders unlawful all acts contrary to honest business practices and provides for civil remedies and criminal sanctions in cases of misappropriation of trade and business secrets (Geschäfts- und Betriebsgeheimnisse). Additional provisions dealing with trade secret protection are found in other statutes, including the Civil Code ("BGB"), the Criminal Code ("StGB"), the Commercial Code ("HGB"), the Employee Inventions Act ("ArbnErfG"), as well as in the Works Constitution Act ("BetrVG").

It remains to be seen whether the German courts will place greater emphasis on the precautionary "reasonable steps" undertaken to protect trade secrets, as discussed above. The current test under German law focuses on whether the need to keep certain information secret has become apparent under the circumstances, regardless of its financial value. Moreover, since reverse engineering generally is permissible under the EU Directive, German courts may be called to revisit their position that reverse engineering is considered unlawful if it requires "substantial investment."

Companies in Germany likely will benefit from the enhanced protection accorded trade secrets in legal proceedings. While the German Civil Procedure ("ZPO") provides certain mechanisms to protect trade secrets during litigation, the greater protections in the EU Directive are friendlier to the trade secret holder and thus may encourage more effective rights enforcement. Furthermore, the express implementation of the rights to recall and destroy infringing goods will further enhance the trade secret holder's position under German law.

While departing employees are traditionally well protected under German law (e.g., where a post-contractual secrecy obligation would unreasonably impair the departing employee's professional development), whistleblowers likely will receive better protection in Germany after implementation of the EU Directive. Lastly, it remains to be seen whether pecuniary damages under the EU Directive will replace default injunctive relief, which is typically awarded in Germany.

IMPLICATIONS OF THE EU DIRECTIVE FOR THE UK

Current UK law protects trade secrets under contract law and the laws of equity. For this reason, the EU Directive's provision of statutory trade secret protection for the first time represents a significant change to UK law, at least in theory.

In practice, however, the EU Directive is unlikely to dramatically change the law. Arguably, the test under the EU Directive is stricter than existing UK law, as it requires that the information is commercially valuable and that the owner have taken reasonable steps to keep it confidential. But existing UK law also protects information with the necessary quality of confidentiality that is disclosed in circumstances importing an obligation of confidentiality and that is used without the consent and to the detriment of the owner.

As for employees, current UK law obligates them not to disclose confidential information accessed during their employment. When their employment ends, confidential information should be protected indefinitely, but any residual information that has become part of an employee's skill and experience cannot generally be protected unless specified by contract. Remedies under existing law are broadly similar to those in the EU Directive, e.g., damages, account of profits and injunction. Current UK law provides no criminal penalties for trade secret infringement.

OUTLOOK TO THE US: HOW DOES THE EU DIRECTIVE COMPARE WITH THE US DTSA?

The US DTSA is modeled on the Uniform Trade Secrets Act, which in its substantive terms is very similar to the TRIPS Agreement and the EU Directive. The definition of trade secrets in the US DTSA uses different wording than the EU Directive, but the scope of coverage appears to be almost identical. The specific facts of a case will continue to be critical to determining what qualifies as a trade secret under either definition.

The remedies are similar as well, for the most part. The most significant difference is that the DTSA includes a specific provision for ex parte seizures of trade secret information. In appropriate circumstances, this allows a victim of trade secret theft to obtain a court order, quickly and without advance notice to the defendant, to seize misappropriated trade secret information. This seizure remedy is to be used only in extraordinary circumstances and requires a series of specific findings. As a result, it is unlikely to be used often.

Like the EU Directive, the US DTSA finesses the question of enforceability of employee non-competition agreements. The Act allows restrictions on employment relationships if they are "based on evidence of misappropriation and not merely on the information the person knows." At the same time, the Act expressly forbids injunctions that "conflict with an applicable State law prohibiting restraints on the practice of a lawful profession, trade, or business."

Also like the EU Directive, the US DTSA provides specific protections for whistleblowers. This differs from current state trade secrets laws, and it remains to be seen how broadly these protections will be construed.

Finally, the US DTSA requires the US Attorney General to prepare biannual reports detailing or providing, among other things: the scope of theft of American trade secrets occurring outside of the United States; the extent to which those thefts are sponsored by foreign governments; a breakdown of the trade secret protections by each of the United States' trading partners; and specific recommendations to the executive and legislative branches for reducing trade secret theft and protecting American companies. The first report is due in one year. These provisions do not change any legal requirements, but illustrate the increasing concern among US lawmakers about international trade secrets issues.

CONCLUSIONS AND RECOMMENDATIONS

The EU Directive does not radically change trade secrets law in Europe, but does help to harmonize trade secrets law across Europe with the goal of bolstering investment, innovation, and competition and reducing costs. The new rights may be particularly helpful for small and medium-sized organizations that lack the budget and resources for extensive patent protection. Nonetheless, many organizations will still want to rely on intellectual property protection where appropriate, and the EU Directive will not mean that confidentiality agreements are no longer required. Contractual rights of confidentiality will continue to be used to enhance statutory rights under the EU Directive. In addition, because the EU Directive is a minimum harmonization law, organizations will still need to be aware of any supplemental provisions under national laws implementing the EU Directive.

To benefit from the EU Directive's protections, companies with valuable trade secrets should begin thinking about potential changes to their processes and procedures now, ahead of the implementation deadline. In particular, we recommend that organizations:

  • Carry out an audit to identify information that falls within the definition of trade secrets;
  • Check that they have appropriate and adequately-documented processes to protect their trade secrets, which preferably include: o Marking trade secrets as confidential;

    • Granting limited access to trade secrets to different users within the organization;
    • Checking template confidentiality agreements to ensure trade secrets are adequately protected including with respect to reverse engineering of trade secrets;
    • Checking whether existing agreements adequately protect trade secrets;
    • Putting in place technical measures to avoid reverse engineering of trade secrets;
    • Checking whether information security requirements are sufficient to protect trade secrets; and
    • Reviewing employment contracts and whistleblowing policies.

Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Morrison & Foerster LLP. All rights reserved