Trade secrets and ‚reasonable protective measures‘

Labor law implications of the new German Trade Secret Act (GeschGehG)

By Pascal R. Kremp, LL.M. (Wake Forest), and Till Basfeld

Beitrag als PDF (Download)

On April 26, 2019, the German Trade Secret Act (Geschäftsgeheimnisgesetz or GeschGehG) entered into force, introducing a number of important novelties to the German legal system. Two of the most important introductions were the need for “reasonable protective measures” and the legalization of reverse engineering, which was previously severely restricted. With this new law, Germany has finally implemented Directive (EU) 2016/943 –ten months late, as the Directive’s deadline expired on June 9, 2018. The legal regulations previously governing trade secrets, namely sections 17 to 19 of the Act Against Unfair Competition (UWG), have now been completely abolished.
The aim of the EU Directive was to provide uniform minimum standards of know-how and trade secret protection throughout Europe and improve enforcement possibilities.
Until now, the EU member states have provided very different levels of protection for trade secrets and know-how. German law contained only fragmented and incomplete regulations, and there were only a few rulings from the German Federal Supreme Court addressing the subject.

Reasonable protective measures
The most important new aspect of the Trade Secret Act is the owner’s obligation to take reasonable protective measures to protect trade secrets. Thus far, merely the intent to keep information secret was sufficient, and the presence of such intent was often presumed in favor of the owner.
The extent of the protective measures an owner needs to take in order for information to qualify as a trade secret has not yet been elaborated in detail. The answer depends on which measures are usually expected in each particular situation. Relevant criteria are company size, development costs and both the importance and nature of the trade secret. Protective measures can be of a concrete nature (for example, IT security, access restrictions, etc.) or a legal nature (for example, confidentiality agreements), as set out later in this article under the heading “Consequences for companies.”
If no protective measures are taken or the measures taken are insufficient, information will not be considered confidential information and thus will not be protected as a trade secret. Furthermore, even if information qualifies as a trade secret, the level of legal protection depends on the extent of the protective measures taken. Courts will take this into account when deciding on remedies to the owner of a trade secret in case of an infringement.

Legalization of reverse engineering
Another novelty in German law is the lifting of the prohibition on reverse engineering. Germany had a very restrictive approach regarding reverse engineering compared with international standards. The new Trade Secret Act explicitly permits reverse engineering.

Trade secrets vs. whistleblowing
The debates regarding EU Directive 2016/943 in the European Parliament as well as in the German Bundestag mainly focused on the potential for the effects of the new regulations to be too restrictive regarding whistleblowing and journalism.
Consequently, a provision was included that explicitly stipulates exceptions to the prohibition on obtaining, using and disclosing trade secrets without authorization. According to these exceptions, it is not prohibited to obtain, use or disclose trade secrets if these actions are necessary to protect legitimate interests. In particular, this protects the right to free expression and freedom of information, the right to expose illegal activity or wrongdoing if such exposure is suitable to protect public interest, and the right of employees to enable employee representation bodies to fulfill their duties. It remains to be seen what role these exceptions will play in practice as a defense for persons breaching secrecy.
It will be interesting to see how courts will consider and assess such arguments in their rulings, especially in cases where breaches of secrecy are driven not so much by noble motives but instead by financial self-interest. For example, the development of case law will be relevant here for bank employees selling bank customer data to tax authorities, for settlement negotiations with employees who are trying to increase their severance package by threatening to disclose their employer’s alleged non-compliance, and so on. The courts will have to balance the conflicting interests of the parties, even though this is not explicitly mentioned in the Trade Secret Act.

Remedies
The new Trade Secret Act provides for a number of civil procedural instruments as remedies to the secret owner in case of a trade secret violation.
The secret owner has certain information rights against the infringer regarding products that infringe a trade secret. The owner can demand cessation and prohibition of the use of the trade secret, destruction or handing over of documents and data, and recall and withdrawal of infringing products from the market. Damage claims are also possible.

Enforcement and procedural situation
The Trade Secret Act allows the federal states (Bundesländer) to allocate the competence for claims based on the Trade Secret Act to selected regional courts. It is desirable that this option is used because it would enhance the specialization and expertise of the judges concerned. Furthermore, the Trade Secret Act enables courts to classify information as confidential, strictly limit access to the proceedings and impose secrecy obligations on the parties involved. However, unlike under previous law, the courts cannot exclude any party completely but instead must allow at least one representative and one lawyer from each party to access the proceedings.
If a court classifies information as confidential, the owner of the trade secret must provide a version of the pleadings “reduced of the trade secrets” that the other party can review instead of the classified version.

Consequences for companies
As mentioned in the beginning, the most important novelty here is the need for secret owners to take reasonable protective measures to safeguard their trade secrets. Therefore, companies are advised to review whether sufficient protective measures have been taken to secure their trade secrets. At the present time, it is not yet clear which protective measures are required in each individual situation. Generally speaking, however, the following protective measures should be considered:

  • Rigorous labeling of documents as confidential if their sensitive nature is not obvious
  • Implementation of IT-related protective measures, such as password protection for folders and documents, setting up of firewalls and authentication procedures
  • Review and conclusion of non-disclosure and confidentiality agreements with employees, customers and business partners – ideally these should particularly emphasize the scope of information to which the individual employee, customer or business partner has access
  • Limitation of the number of people with access to trade secrets to the necessary minimum – that is to say, only people with a compelling need to know should have access to trade secrets
  • Establishment/review of a comprehensive know-how compliance system aligned with general compliance and IP strategy

Due to the many unanswered questions associated with the Trade Secret Act, companies should monitor developments regarding legislation and court decisions on this subject in the coming years. This will require companies to regularly review their know-how compliance systems.

pascal.kremp@dlapiper.com

till.basfeld@dlapiper.com