Trade secret protection as part of HR compliance

The German Trade Secrets Act (GeschGehG) has been in force since April 26, 2019, i.e. for more than two years. Nevertheless, the topic of know-how protection is still not adequately addressed in many companies. Two important aspects are often overlooked: First, since the law came into force, only information that is the subject of appropriate secrecy measures is protected as trade secrets; no transition period applies in this respect. This has now been confirmed several times by decisions of the higher courts (see Higher Labor Court Baden-Württemberg 18.8.2021 - 4 SaGa 1/21; Higher Labor Court Düsseldorf 20.6.2020 - 12 SaGa 4/20). On the other hand, the law contains a large number of liability provisions, also for the infringement of trade secrets of third parties. Thus, third parties as owners of the possibly infringed trade secrets can assert claims for, among other things, removal, omission, destruction and removal from the market both against the specific infringer and the owner of a company, insofar as the infringer is an employee or agent of this company.

Protection of trade secrets and labor law

Current or former employees of a company are also a frequent threat to trade secrets. For example, the owner of a company may be exposed to claims by third parties because a new employee uses a customer list "brought along" by the former employer. Moreover, employees' carelessness in handling trade secrets can also lead to competitors obtaining valuable confidential information and thus causing damage to the company. In this respect, aspects of labor law also play an important role in the protection of trade secrets and the establishment of secrecy protection systems in the company.

Appropriate protective measures from the perspective of labor law

The Trade Secrets Act requires "adequate" protective measures. The question of adequacy is to be based, among other things, on the "value" of the trade secret and its "significance" for the company. In addition, the question of assessing adequacy also depends on the company itself. In this respect, a globally active company can be expected to take greater and more costly protective measures than a smaller company (see Higher Court Hamm 15.9.2020 - 4 U 177/19). Corresponding protective measures can be of an organizational, technical and legal nature. From a (labor) law perspective, the first protective measure to be considered is the categorization of trade secrets according to importance and risk. Categorization is usually carried out in three stages: (i) existential information, (ii) important information and (iii) other sensitive information. In the next step, it must be ensured that only the designated employees really have access to this information (so-called "need-to-know principle"). In addition, employees should be made aware of how to handle trade secrets both when they are hired and when they leave the company, and written declarations should be obtained, for example, that no trade secrets obtained "illegally" from the previous employer will be brought in or that the trade secrets of the current employer will be stolen when they leave the company. Finally, depending on the size of the company and the organization, one or more persons must be appointed as so-called secrecy protection officers who are operationally responsible for compliance with secrecy protection.

Avoiding gaps in protection when concluding non-disclosure agreements

Particular attention should be paid to contractual obligations regarding the handling of trade secrets with so-called key employees (i.e. employees who come into contact with existential or important information). When concluding confidentiality agreements, particular care should be taken to ensure that trade secrets and other confidential information are specified in concrete terms so that they are sufficiently transparent for employees. So-called "catch-all clauses" that impose a blanket obligation on the employee to maintain silence about "all business secrets and other confidential company information" without further specification are invalid. This has been argued in the literature for some time. By decision of the local Labor Court Aachen, the invalidity of "catch-all clauses" has now been confirmed at least by the courts of appeal (Labor Court Aachen 13.1.2022 - 8 Ca 1229/20). If companies do not specify business secrets in confidentiality agreements with employees, they cannot invoke the corresponding confidentiality clause in the event of a breach of the confidentiality obligation by employees and cannot enforce a cease-and-desist order in court because the clause is not effective. Companies should definitely review their confidentiality agreements with regard to the above-mentioned case law. Otherwise, there is a high risk that companies will not be able to enforce such confidentiality agreements against the employees concerned in the event of violations and that the company's trade secrets will be exposed to a significant gap in protection. 

Use of external personnel

Just as with the hiring of in-house personnel, attention must also be paid to the establishment of appropriate protective mechanisms when using external personnel in know-how-sensitive areas. This applies in particular to the use of temporary workers under the German Temporary Agency Act (AÜG), who are integrated into the work organization like company employees for the duration of the assignment. They must be carefully selected and instructed accordingly during onboarding with regard to points relevant to know-how protection. In addition, in order to ensure sufficient protection of secrets, it may be necessary in individual cases for the client company to impose a direct obligation on the temporary workers to maintain secrecy, despite corresponding obligations on the part of the leasing company to oblige the temporary workers to maintain secrecy.

Risks due to mobile working

Due to the Corona pandemic, a home office obligation applied in the meantime, which could return in fall/winter 22/23 depending on the pandemic situation on the basis of a corresponding occupational health and safety regulation. In addition, mobile working will remain part of working life after the pandemic to a much greater extent than before. When working remote, employees will have to handle trade secrets and other sensitive information. In this context, the company faces a significantly higher risk of know-how leakage and "data theft". For example, it may be easier to listen in on telephone calls, documents may be more easily accessible to unauthorized persons if they are not treated in accordance with the law, and end devices used may be supposedly easier targets for cyber-attacks. Companies must therefore identify the corresponding security gaps and close them as best they can. When implementing know-how protection concepts, companies should provide special protective measures for mobile working due to the higher risk potential for know-how leakage in the home office. Typical areas of regulation are likely to be: Taking documents with you (if permitted at all) and their safekeeping, access to the mobile workplace or its "shielding"; precautionary measures for telephone and video conferences (avoiding eavesdropping by third parties) as well as the protection of the hardware and software used against "security intrusions".

Participation of the works council

Like other compliance measures, measures to protect trade secrets can also trigger co-determination rights of the works council. For example, requirements for the handling of trade secrets can also affect the codetermined conduct of the works council pursuant to Section 87 I No. 1 BetrVG, insofar as company rules of conduct are established regarding the protection of know-how. In the case of the implementation of technical protection measures, such as the registration of access/attempts to access particularly sensitive information or the calling/sending of certain files, the right of co-determination pursuant to Section 87 I No. 6 BetrVG may be affected in the case of the introduction and use of technical equipment. Protective measures subject to co-determination would have to be implemented by way of a works agreement. This must be taken into-account accordingly when implementing appropriate know-how protection concepts. To ensure smooth implementation, the works council should be involved in good time.

(Labor law) enforcement

Depending on the severity of the breach, sanctions under labor law against employees who violate confidentiality obligations may include a warning or (extraordinary) dismissal. A corresponding obligation is likely to arise from an ancillary duty of confidentiality under the employment contract. A warning or termination could therefore be effective even without an appropriate system of protection of secrets. However, the establishment of a system for the protection of secrets by means of appropriate measures is mandatory for the enforcement of further-reaching claims for removal, injunctive relief and/or damages (cf. inter alia Higher Labor Court Düsseldorf 20.6.2020 - 12 SaGa 4/20). This may be relevant, for example, in legal proceedings against former employees who have illegally stolen trade secrets.

Conclusion

The Trade Secrets Act has, on the one hand, increased the requirements for the effective protection of a company's own trade secrets. In addition, there is an increased risk of being exposed to claims by third parties for infringement of their trade secrets. Companies are therefore required to take appropriate protective measures tailored to the company. When implementing a know-how protection concept, aspects of labor law also play an important role, as threats to trade secrets can also emanate from (former) employees.