The new Trade Secret Protection Act and its implications for practice

Introduction

On 26 April 2019, the new Trade secrets Protection Act ("GeschGehG", hereinafter the "Act") came into force. Germany has thus transposed, albeit with some delay, the provisions of Directive (EU) 2016/943 on the protection of undisclosed know-how and business information (trade secrets) against their unlawful acquisition, use and disclosure into national law.

So far, the protection of trade secrets had only been regulated fragmentarily.

The new Act defines for the first time the concept of trade secrets, codifies a differentiated system of claims by the owner of the trade secret and also expressly refers to limits of legal protection - for example for whistle-blowers or journalistic activities.

Companies are strongly advised to take immediate measures to systematize, concretize, control and document the protection of their trade secrets.

The following article gives an overview of the new legal provisions and shows the need for companies to act.

The starting position

Trade secrets are of immense economic importance not only for technology-intensive companies. Rather, it is essential for companies in all sectors to protect existing know-how, product specifications, customer data, the results of market and behavioural analyses, prices and a wealth of other information.

So far, the protection of trade secrets has been the subject of various regulations in German law, scattered over various laws, and has even been described as the Cinderella of intellectual property.

Among the criminal provisions that have been applicable so far, the following should be mentioned here: §§ 17 to 19 UWG (German Act Against Unfair Competition) as well as §§ 201 to 206 StGB (German Criminal Code), which criminalize the violation of the personal life and secret realm. Civil law, on the other hand, did not contain any explicit provisions concerning the protection of trade secrets. In the case of unlawful infringement of trade secrets, contractual claims for damages pursuant to §§ 280 (1), 241 (2) BGB (German Civil Code) as well as tortious claims pursuant to §§ 823 (1), 826 or § 823 (2) BGB (German Civil Code) in conjunction with a respective actual third-party protective law came into question. The provisions of §§ 823, 1004 BGB were used analogously to substantiate injunctive relief claims. There were no special procedural provisions for disputes concerning trade secrets.

With the implementation of the Directive (EU) 2016/943 by the Act, a new core law has now been created for the first time, which deals with the protection of trade secrets against unauthorised acquisition, use and disclosure (§ 1 para. 1 of the Act).

The new "trade secret" concept

The Act defines, for the first time, what is meant by the term trade secret. According to § 2 No. 1 of the Act, a trade secret is information (i) which is neither in its entirety nor in the precise arrangement and composition of its components generally known or readily accessible (i.e. secret) to the persons in the circles who normally handle this type of information and therefore of economic value and (ii) which is subject to appropriate secrecy measures by its lawful owner under the circumstances and (iii) for which there is a legitimate interest in secrecy.

Secret Information

The Act does not differentiate according to the type of information. The protection of the Act can therefore cover very different information such as business plans, advertising strategies and customer lists, but also construction plans, recipes, prototypes, processes, etc. An explicit reference to the company and its business is not required.

Whether the information is secret is determined according to a relative concept of secrecy, namely according to the knowledge or possibility of knowledge of persons who usually deal with information of the kind in question.

Commercial Value

The criterion of economic value must also be understood broadly, against the background of the recitals laid down in the EU Directive. In principle, the criterion can also be fulfilled for so-called negative information, such as secret information that incriminates its lawful owner. Whether and to what extent secrecy protection can exist for information about infringements of the law is controversial.

Reasonable steps to keep information secret

An essential innovation introduced by the Act is that the person who wishes to assert claims arising from the infringement of a trade secret must now prove that he or she has endeavoured to introduce reasonable (internal) secrecy measures according to the circumstances (or, following the wording of the English language version of the EU Directive, "reasonable steps under the circumstances, by the person lawfully in control of the information, to keep it secret"). This is to be seen as an intensification of the previous requirements for the protection of secrets, since the legal regulation in the reverse conclusion implies that there is no effective legal protection against betrayal of secrets if the lawful owner has not taken any contractual, technical and/or organisational precautions aimed at secrecy.

Since the criterion of the reasonableness of the secrecy measures to be taken, which is to be understood as an obligation, has not been concretized either in the wording of the law or in previous case-law, it is not yet possible to make a conclusive statement on the significance of this criterion. Its Interpretation may be based on experience with comparable provisions in other legal systems. However, even these do not lead to a conclusive answer to the question of what must be done to ensure that the measures of secrecy taken are regarded as reasonable. Rather, an answer to this question must be found in each individual case.

The appropriateness of the measures to be taken will depend in particular on factors such as the type of information, its importance and value to the company, but also on the size of the company and the cost and customary nature of the measures. In order to achieve manageability, it is advisable to evaluate and categorise the existing know-how requiring secrecy. The aim should be to develop a concept for the protection of secrets that is suitable for the respective company.

Building blocks of such a concept could be the following:

• collection of all information regarded as worthy of confidentiality within the company
• classification of this information into different confidentiality categories according to its importance and economic significance for the company
• development of protective measures for each confidentiality category. Examples are the enforcement of the "need-to-know" principle, the unambiguous identification of confidential information, the creation of secure premises, the installation of alarm systems and video surveillance, the use of special encryptions and passwords, the establishment of group authorisations and other IT security measures such as firewalls or a ban on the use of private storage media, but also the conclusion of appropriate confidentiality agreements with employees, customers or suppliers and cooperation partners. 

If possible, the individual measures should be laid down in writing within the framework of the concept of protection of secrets, so that documentation is available that can be used for evidentiary purposes in the case of a dispute. In addition, it may be advisable to name a person responsible for the protection of secrets within the company. 

In order to create a sensitivity within the workforce for the meaningfulness and value of measures to protect secrets, training should be provided on how to deal with trade secrets. The focus should not be one-sidedly on taking timely protective measures, e.g. with regard to the know-how resulting from the development of new products and services; it is equally important - against the background of the liability concept modified by the Act - to point out to employees that when hiring employees or establishing cooperations, know-how must not enter the corporate sphere in an unlawful manner.

Legitimate interest in secrecy

With the "legitimate interest in secrecy" required by the wording of the law, the German legislator has laid down an additional condition not provided for in the underlying EU Directive. The introduction of this additional requirement was (probably) motivated by the desire to be able to exclude information about infringements of the law from the protection of secrets and, at the same time, by the fear that the new regulation would result in a restriction of investigative journalistic activity. Since the underlying EU Directive follows different principles here and takes public interests into account within the framework of the exceptions - regulated in § 5 of the Act - and not in the definition of secrets, the procedure of the German legislator is criticised in the literature and it is discussed whether the corresponding requirement is contrary to the Directive, or at any rate must be interpreted in conformity with the Directive.

Extensive claims for holders of trade secrets

The Act provides the aggrieved owner of trade secrets with an extensive repertoire of possible courses of action.

For example, the law provides for claims for removal and injunctive relief (§ 6 of the Act) as well as for surrender, recall and removal from the distribution channels and the destruction and withdrawal of the infringing products (§ 7 of the Act). These claims are accompanied in each case by a claim for information against the infringer (§ 8 of the Act).

In this context, it should be noted that the aforementioned claims may also be asserted against the new employer of a former employee if the employee concerned has violated trade secrets by taking them with him or disclosing them and is therefore a rights infringer (§ 12 of the Act). There are restrictions on liability for damages for inadequate information.

The catalogue of claims extended by the Act brings about a clear improvement in the position of the holder of an infringed trade secret compared to the previous legal situation. It is worth mentioning in this context that the winning party in a court dispute can now be granted the power to make the judgment or information about the judgment publicly known at the expense of the losing party, if the winning party has a legitimate interest in doing so (§ 21 of the Act).

The possibility of publishing the judgment in trade secret litigation, whatever the legal remedy, serves to deter potential infringers and to inform the public of the unlawful use or disclosure of trade secrets. Corresponding provisions already exist in Section 12 (3) UWG (German Act Against Unfair Competition), Section 103 UrhG (German Copyright Act), Section 19c MarkenG (German Trademark Act), Section 140e PatG (German Patent Act) and Section 24e Utility Model Act.

With regard to the criminal relevance of the violation of trade secrets, the previously applicable criminal offences of §§ 17 to 19 UWG were transferred into § 23 of the Act without any significant changes.

Exceptions

However, the protection of trade secrets extended by the new law is by no means absolute. For example, § 5 of the Act codifies exceptions under which the acquisition, use and disclosure of a trade secret can be justified and the protection of a trade secret must take a back seat to matters of general interest. In principle, the legitimate interest required for this can be any interest approved by the legal system. According to § 5 of the Act, the acquisition, use or disclosure of a trade secret does not fall under the prohibition of action according to § 4 of the Act, if this

• serves to protect the exercise of freedom of expression and information, including respect for freedom and plurality of media (§ 5 No. 1 of the Act);
• serves to uncover an unlawful act or professional or other misconduct, provided that the acquisition, use or disclosure is suitable to protect the general public interest (§ 5 No. 2 of the Act, whistleblower cases) - in the organisation of internal whistleblower systems, in addition to the provision of § 5 No. 2 of the Act, the provisions of the Directive on the Protection of Persons Reporting Violations of Union Law (EU 2018/0106), which will enter into force shortly, must be taken into account
• serves the purpose of disclosure by employees to the employee representation, if this is necessary for the employee representation to be able to fulfil its tasks (§ 5 No. 3 of the Act). This could include, for example, the pursuit of legitimate group interests, for example, if the employee representation informs about an imminent personnel reduction.

Reverse Engineering

So far, German law has provided basic protection against "reverse engineering" by third parties. This is to be understood as the dismantling and analysis of an object with the aim of finding out about the structure of the object and the know-how contained in it, which is not openly visible. The reason for this prohibition was that, from a competition law point of view, it was considered desirable that third parties should not simply be allowed to acquire such know-how, especially since this tends to be easier and quicker due to the correspondingly ever-more sophisticated analysis possibilities and equipment.

After this prohibition had already been softened in the past by no longer being applied to cases in which "reverse engineering" was feasible without major difficulties, such acts are now often regarded as permitted under the new legal regulation, provided that the prerequisites for the facts of § 3 para. 1 no. 2 of the Act are fulfilled. This is the case where a trade secret has been obtained by "observing, investigating, dismantling or testing a product or article which (i) has been made publicly available or (ii) is in the lawful possession of the observing, investigating, dismantling or testing and is not subject to any obligation to restrict the acquisition of the trade secret".

Against this background, companies can - depending on the individual case - continue to seek protection against the consequences of reverse engineering, for example by relying on the provisions of copyright, patent and unfair competition law, or by attempting to prevent reverse engineering by means of special contractual provisions. However, it is questionable whether such contractual restrictions can be legally effective and agreed with effect against the right parties.

Procedural particularities

Within the framework of litigation on trade secrets, the state courts now have the possibility to take measures to protect the trade secrets at issue (§§ 16ff. of the Act). Possible measures include the imposition of confidentiality obligations towards parties, their trial representatives, witnesses, experts and other representatives or persons. In addition, in the event of violations of the obligations thereby created, a fine of up to EUR 100,000.00 or imprisonment for up to six months may be imposed and enforced immediately. In addition, for example, the party public may be restricted to a limited group of persons in order to protect the trade secret at issue.

Protection of algorithms (in big data applications)

With regard to the possibilities opened up by the new Act for the protection of algorithms, reference is made to the interview with Dr. Katharina Scheja, Deloitte Legal Frankfurt, and her article in CR | Computer und Recht, 8/2018, pp. 485 - 552.

Conclusion

Although the new Act does not provide for any legal obligation to implement, companies should develop a viable concept for protecting their trade secrets in order to be able to defend themselves effectively against infringements in the event of a dispute. Such a concept should be documented in writing. The possible measures for the protection of trade secrets are manifold and have to be determined according to the relevant individual case. In addition to contractual agreements and organisational regulations, technical security precautions can also be considered. Special precautions are also appropriate against the background of the further liberalisation of reverse engineering.