Sandrine Cullaffroz-Jover, Lawyer
Director of the IP-IT, Data Security & Privacy practice of the PwC Avocats law firm
On 14 April 2016, the European Parliament adopted, at first reading, the proposal for a Directive on the protection of undisclosed know-how and business information (trade secrets) against their unlawful acquisition, use and disclosure, as amended by the Committee on Legal Affairs. While controversial, the text lays the foundation for a harmonised European system of protection and compensation for violations of trade secrets.
Key points of the directive
In accordance with the International Trade-Related Aspects of Intellectual Property Rights (TRIPS) agreement concluded in the framework of the World Trade Organization, the new directive sanctions a definition of trade secrets that is based on three cumulative criteria:
- the information that falls under trade secrets “is secret in the sense that it is not, as a body or in the precise configuration and assembly of its components, generally known among or readily accessible to persons within the circles that normally deal with the kind of information in question;”
- the information “has commercial value because it is secret;” and
- the information “has been subject to reasonable steps under the circumstances, by the person lawfully in control of the information, to keep it secret.”
These criteria refer to all business and economic information in companies’ information assets likely to give them a competitive advantage, but by nature unable to be protected by intellectual property rights.
Moreover, the directive gives the details of a typology of violations considered to be unlawful, namely acquisition, use and disclosure of trade secrets. All the more so, production, provision, marketing, import, export and storage of infringing goods for these purposes will also be considered to be unlawful use of protected information.
In order to reconcile the directive’s objectives of protection with the fundamental freedoms of expression and information, the European authorities have expressly excluded the right to compensation for victims of theft or misappropriation of trade secrets when said secrets were acquired, used or released under the following circumstances:
- the exercise of the right to freedom of expression and information, including respect for the freedom and pluralism of the media, established in the Charter of Fundamental Rights of the European Union;
- the revelation of professional misconduct or illegal activity, provided that the defendant acted in the interest of the general public (this exemption being particularly aimed at whistle-blowers in the fields of public security, consumer protection, public health and environmental protection);
- the use by workers of experience and skills acquired as part of the legitimate exercise of their position (this exemption being particularly aimed at preserving workers’ mobility); and
- the protection of any legitimate interest recognised by European Union law or national law.
The text adopted by the European Parliament should now be examined by the Council of the European Union with a view to ultimately publishing it in the Official Journal of the European Union. As of this publication, the 28 Member States will have two years to transpose the directive into national law.
Consequences for companies
In a globalised and highly competitive context, the directive supplements the traditional legal basis that companies can use to encourage innovation and fight against industrial and economic espionage.
In order to effectively anticipate the transposition of the new provisions into Internet laws, companies must be sure to classify their data by level of sensitivity and organise the protection of trade secrets through appropriate confidentiality measures on both a legal and technological level.
- EncroChat: Deciphering of the End-to-End Encryption Service Used by Criminals Cybercrime
- Preserving Digital Footprints and Cyber Resilience: Training the Swiss Police Cybercrime
- Ransomware in Six Questions (by the Ministerial Delegation to the Security Industries and the Fight Against Cyberthreats, French Ministry of the Interior) Cybercrime