Quick guide: What the EU Trade Secrets Directive means for you

The EU directive that protects companies’ confidential expertise has been binding for EU firms since 9 June 2018. It was mainly implemented to provide a consistent definition of the term ‘trade secrets’ that varied in each country’s legislation. It also aims to determine the relevant protection measures. Its scope includes key factors influencing competitivity, such as innovation capabilities and expertise. In addition, it protects confidential information, including customer and partner data, strategy documents, finance and HR data, ensuring they don’t fall into the wrong hands.

What can companies do?

According to the new directive, a trade secret can only be classified as such if the company has implemented the appropriate secrecy protection measures. And that means companies must be able to prove in a court of law that they have taken the right precautions to secure the information in question.

Here are two approaches to protecting expertise:

Contractual secrecy protection measures

• Non-disclosure agreements (NDAs): contractual confidentiality agreements provide reliable protection when working with customers and partners. It’s important to note that the terms of their use should be clearly defined and that the information being protected should be unambiguously delimited.
• Reverse engineering: companies should always expressly forbid the production of replicas or copies of their products.
• Employment contracts: your own staff could also be the source of a data leak. That’s why it’s essential to include NDAs in all your employment contracts. These clauses should be detailed and formulated differently depending on the position.
• Sanctions: these motivate partners and others to comply with the agreements.

Technical and organisational secrecy protection measures

• Passes and chip cards: companies should use these basic protection measures to limit access to their premises and to individual departments. That helps prevent unauthorised third parties from gaining access to your offices – or at least makes it much harder.
• Need-to-know: each of your employees, partners and customers should only be given access to the information they really need. It’s also a good idea to keep a log of each time they access it.
• USB is a no-no: the use of personal storage media like USB thumb drives and SD cards should be prohibited. That makes it more difficult to steal business information.
• Prevention is better than cure: a final piece of advice is that you should use the appropriate type of encryption. This is made easier with high-security data storage solutions.

Summary

You are now obliged to implement secrecy protection measures and must be able to prove that you have done so. Now that companies have a clear and unambiguous definition of the term ‘trade secret’, it’s easier to take the right precautions and be much better prepared for a court case should any data be stolen.

Want to learn more about the EU Trade Secrets Directive? See our recent blog.

 

Written by Marcus Henke

---

Brainloop,  Information Security

---