By Anke Henrich
World market leaders in mechanical engineering are not the only ones whose success relies on exclusive expertise. Small and medium-sized companies also hold a lot of knowledge that their competitors would like to have. Expertise is of existential importance to companies, and well worth protecting. That is why the European Union passed the European Trade Secrets Directive in June 2016, to improve the protection of business secrets across Europe. The German Bundestag, however, took its time in implementing the Directive in national law, and it was not until March 2019 that a majority was found for the new Trade Secrets Act (GeschGehG). By then, the two-year transitional period the EU had granted had already expired in Germany.
It is no secret why Germany took so long to pass the GeschGehG: Its parliamentarians spent more than a year arguing in particular over the question of how far protection of whistleblowers - employees of a company who disclose what they see as improper behavior by their employer - should go. Trade unions, employers' representatives and journalists also had numerous specific concerns.
Action is now urgently needed, warns Daniel van Geerenstein, Deputy Head of Legal Services at VDMA. In order to succeed in court in the event of betrayal of secrets, companies under attack have to do more than just prove the economic damage they have suffered: They also have to provide watertight documentation that they have taken every reasonable effort to protect their expertise. This is despite the fact that, unlike the General Data Protection Regulation, this EU Directive contains no duty of action on the part of the companies.
In practice, this means a four-point program for a wide range of company divisions, such as research and development, IT, legal affairs, factory security, human resources and sales in particular. The first step is to identify all secret candidates - ideally more carefully than before. Legal experts complain that access rights to information are often only checked when an employee is fired from the company. After all, this party could take insider knowledge to the competition, either to exact revenge or to further their own career.
This is how the new EU directive defines a trade secret worthy of protection: A piece of information that is neither in full nor in the precise arrangement or composition of its components accessible to anyone, that is not generally known in the circles that usually deal with it.
- it is secret in the sense that it is not, as a body or in the precise configuration and assembly of its components, generally known among or readily accessible to persons within the circles that normally deal with the kind of information in question;
- it has commercial value because it is secret;
- it has been subject to reasonable steps under the circumstances, by the person lawfully in control of the information, to keep it secret
Once the trade secrets have been identified, the second step is to evaluate and prioritize them. Installing the protective measures based on the level of priority follows in the third step. Legal experts warn against limiting this solely to legal questions such as contractual agreements, compliance measures and work instructions. Those responsible should also conduct technical and organizational checks. It is still impossible to predict what exactly courts will interpret as appropriate confidentiality measures in future. Initial information and pointers on useful measures in IT, for example, are available from the German Federal Office for Information Security.
The fourth step is obvious. Daniel van Geerenstein's advice: "Companies urgently need to document and professionalize the protection of trade secrets - which often already exist but are documented poorly or not at all - so that they can benefit from the protection of the GeschGehG if needed."
Without a documented and verified protection concept, companies could face another rude awakening in court. A secret that is not even appropriately protected by the company itself may not be seen as a secret at all by the court.
It is well worth putting the effort into documentation. After all, insider knowledge is just as worthy of protection as patents: Just like when patents are violated, companies who have suffered damage can also sue for return, destruction or recall of the violated products.
Ultimately, thanks to the Directive, small and medium-sized companies in mechanical engineering in particular can enjoy a minimum level of protection for their valuable expertise throughout Europe. This makes international business in particular much easier - as long as the right precautions are taken.