Protecting trade secrets: common pitfalls and how to avoid them
Protection of trade secrets has never been more important. Commercial advantage and business opportunities can stand or fall on being the first mover or established player in a competitive market, but gone are the days when secret formulae were locked in office safes.
Most businesses store sensitive commercial information on cloud-based networks that have varying degrees of access by company personnel and third parties. The past year has shown that employees don’t need to be physically in the workplace to access a huge range of company information, and in fact remote working can create greater opportunities for bad actors to thrive.
Many trade secret breaches come from employees or ex-employees, through a combination of human error and malicious intent. Below are some of the most common mistakes that companies can make when it comes to protecting their trade secrets and confidential information in the UK, and some key steps that can be taken to manage these risks.
Failure to identify and categorise trade secrets
The UK law provides varying degrees of protection depending on the nature of the information in question: does it amount to a trade secret, confidential information or simply “know-how”?
Trade secrets are the most heavily protected category of information in the UK (outside of other protectable intellectual property). Since 2018 the Trade Secrets Regulations have formalised in statute the previous common law protections available to businesses and we are starting to see this legislation being used in breach of confidentiality and post-termination restrictions disputes brought by companies against staff.
Employees are subject to an implied obligation during their employment not to misuse trade secrets or confidential information. Where trade secrets are involved, this obligation extends beyond termination of employment, even where the employment contract doesn’t deal with this.
“As a starting point, organisations should have clear and up-to-date contractual protections with the whole workforce.” Hannah Netherton, CMS
By contrast, express ongoing contractual obligations are generally required in order to prevent ex-employees (or any other form of worker or contractor) from using confidential information after employment has ended, and it is typically not possible to restrict an individual’s use of their know-how and skills acquired over the course of their employment.
However, it can be notoriously difficult to delineate between a trade secret and confidential information, and between confidential information and know-how. Given the different levels of protection afforded to each category, businesses need to form a view on which of their intangible assets amount to trade secrets and then take steps to ensure that they are protected accordingly.
Trade secrets should be identified and kept on a register, with a list of which personnel have access to the relevant information and appropriate protections put in place over those assets.
Failure of systems and controls
The protections put in place over trade secrets and highly confidential information need to be coherent and robust. Additional protections are needed over an organisation’s most valuable assets, to proactively protect them from being misappropriated and also, if it comes to taking enforcement action over misuse, to demonstrate to a court that the assets do amount to trade secrets that can be protected by law.
This can be achieved through IT infrastructure and ensuring that there are, for example, appropriate levels of encryption, limited access, multi-factor authentication, file transfer conditions and other restrictions over the assets that have been identified as requiring protection. Many businesses are increasingly using monitoring software to track access/use and warn of misuse, although these should be carefully implemented in order to manage the data privacy and employment rights issues that come with such software and artificial intelligence solutions.
IT infrastructure alone will not be sufficient. Organisations need to put in place appropriate controls through policies and procedures to manage the risk of misuse of assets. As a starting point, organisations should have clear and up-to-date contractual protections with the whole workforce, from employees to self-employed contractors and outsourced service providers.
