France and Germany lag as deadline passes for new trade secrets laws

Courts are likely in time to define the steps that holders of trade secrets will need to implement, but until then it would be wise for companies to review contracts, bolster internal polices and practices, and educate staff on trade secrets and how the new laws apply to them.

The spur to action should stem from the implementation of the Trade Secrets Directive into national law across the EU.

The Trade Secrets Directive

The Trade Secrets Directive includes rules that protect businesses against the unlawful acquisition, use and disclosure of their trade secrets, including in respect of second-hand sharing of that information. However, there are protections built into the Directive that permit the acquisition of trade secrets through, for example, reverse engineering.

Under the Directive, a trade secret is considered to be information that is secret, has commercial value because it is secret and has been subject to reasonable steps under the circumstances, by the person lawfully in control of the information, to keep it secret. Information is only considered secret if it is "not … generally known among or readily accessible to persons within the circles that normally deal with the kind of information in question".

Up until the Directive, protection for trade secrets was provided for across Europe through a patchwork of laws. The Directive is designed to give a greater degree of harmonisation to the protections trade secrets holders can expect to receive across the trading bloc.

The Directive was finalised in 2016, but the deadline for its implementation was 9 June 2018. While new regulations have been introduced to implement the Directive into UK law, both France and Germany have missed the deadline.

State of play in France

New legislation to implement the Trade Secrets Directive was initially proposed earlier this year when a draft bill was filed on 19 February.

The draft has subsequently been amended by the French parliament, but the proposals are still subject to review by both the National Assembly and Senate later this month. It is likely that the final text will not be adopted until later in June or even July.

The changes made to the initial draft has seen improvements made to the scope of protections provided for – the draft, as it stands currently, is now more in line with the wording of the Directive.

Plans to introduce criminal liability for trade secrets infringement into French law were put forward by the Senate. This would have extended the scope of French law beyond that required by the Directive, which only applies a civil liability regime for trade secrets infringement. However, those plans have subsequently been shelved.

The proposed new French trade secrets laws do, though, provide that businesses making trade secrets infringement claims could be held liable for abuse of process if their claims are made in bad faith and aimed at stifling legitimate trade. Where this is the case, businesses could be ordered to pay a fine to the French State of up to 20% of the value of damages they are claiming or, in the absence of a damages claim, up to €60,000.

The majority of industry in France is in favour of the latest draft, as it more in line with the Directive. They are keen to better understand what 'reasonable steps' should be implemented.

State of play in Germany

German implementation of the Trade Secrets Directive is further behind schedule.

The proposed new Act on the Protection of Trade Secrets was set out in April, but the Ministry of Justice has suggested that it will not be until September or October before the draft is debated in parliament, and possibly the end of 2018 until the new laws are adopted.

While the draft Act is mostly in line with the Directive, it lacks clarity on some issues that industry will be looking for.

For example, although the draft provides for the recall of infringing goods, it does not explain when goods will be said to contain features, or have been manufactured in a way that is, 'based on' a trade secret. While this is somewhat clear when it comes to patent or design infringement, it is unclear how it should be assessed whether a product is based on a secret. The Directive in contrast only refers to infringing goods that "significantly benefit" from trade secrets.

Also, businesses would only face administrative fines of up to just €1,000 for not keeping information confidential that has been disclosed to them in court proceedings under the proposals – this seems to be an extremely small penalty that may not deter infringers.

To-date, the proposed new trade secrets laws in Germany seemed to have failed to capture much interest from businesses. There has been a greater focus on other new legislation, notably the new data protection laws that have been introduced, and companies have also traditionally been more focused on taking retrospective action to prevent others from exploiting their stolen trade secrets than protecting those trade secrets in the first place – that emphasis will need to change under the new laws.

In addition, the cost of reviewing trade secrets applicable across an industry can also be prohibitive for many mid-sized companies, so many operate hoping their activities do not get them in trouble.

UK implementation complete

Some of the provisions of the Trade Secrets Directive are provided for in UK law, most notably in respect of the common law of breach of confidence. However, new regulations were introduced to address gaps and provide legal certainty and uniformity for dealing with the unlawful acquisition, use or disclosure of trade secrets across all of the UK’s jurisdictions.

The Trade Secrets (Enforcement, etc.) Regulations 2018 came into force on 9 June.

The Directive's main definitions are replicated in the UK regulations, including for 'trade secret' and 'infringing goods', and apply the definitions to the existing law of breach of confidence. This means that the UK case law on breach of confidence in confidential information will also apply to the unlawful acquisition, use or disclosure of trade secrets. Common law protections or remedies for trade secrets established in common law will also be available under the statutory framework.

The regulations set limitation periods for businesses to bring raise legal action for an alleged breach of confidence – five years for Scotland and six years for the rest of the UK – and further prescribe the circumstances in which the limitation periods are said to begin.

The regulations also provide a statutory framework for the exercise of the broad powers already developed by the UK courts to protect the confidentiality of trade secrets disclosed during court proceedings, and further supplement the common law by specifying the criteria that must be satisfied to secure interim relief and the factors that a court must take into account.

The regulations, which were consulted on by the UK's Intellectual Property Office prior to being finalised, do not implement the so-called ‘whistle-blower’ protections provided for in the Directive. From this it can be inferred that the government's view is that the minimum protections set out in the Directive were already enshrined in the UK’s common law, existing legislation or court rules.

In light of the already strong protections for confidential information in the UK and in the wake of May’s GDPR implementation, UK industry has been relatively quiet on the Directive and the UK regulations as they developed. However, UK businesses, particularly those operating in Europe, will be reassured that implementation of the Directive will unify a previously fragmented trade secrets regime and implement across the wider EU protections for trade secrets which are in line with global trends.

Protecting trade secrets

In line with the definition of 'trade secret' under the Directive, only businesses that take "reasonable steps" to keep their information secret will qualify for the protections provided for under the new trade secrets laws.

However, 'reasonable steps' has not been defined and is therefore an open concept that is likely to be clarified by the courts as disputes arise over the application of the new trade secrets laws to information owned by businesses. What is considered "reasonable" is likely to depend at least in part on the nature of the information and the organisation in question.

Businesses should not wait for the courts to provide guidance on this issue, however. They should consider a range of measures to ensure their information would qualify as a 'trade secret' under the new regime.

First, companies should identify and audit closely the trade secrets in their possession.

They should update internal policies to ensure secret information is not at risk, such as introducing and enforcing a 'clean desk' policy, implementing appropriate information control methods including encryption and access restrictions, and banning the use of private emails at work.

Training for employees could be provided to raise their awareness of trade secrets and how to handle that information - businesses should point staff to applicable policies, procedures and guidelines.

Businesses should also ensure that trade secrets are given effective protection in employee contracts – non-disclosure clauses, non-compete agreements and non-solicitation provisions are potential contractual tools to use to prevent staff from disclosing trade secrets to third parties, in particular when they leave for rival employers.