Protection of undisclosed know-how and business information

Opinion of the European Data Protection Supervisor

on the proposal for a directive of the European Parliament and of the Council on the protection of undisclosed know-how and business information (trade secrets) against their unlawful acquisition, use and disclosure

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16 thereof,

Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles 7 and 8 thereof,

Having regard to Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data ,

Having regard to Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data , and in particular Article 41(2) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. INTRODUCTION 1.1. Background

1. On 28 November 2013, the Commission adopted a proposal for a directive on the protection of undisclosed know-how and business information (trade secrets) against their unlawful acquisition, use and disclosure (the 'proposal'). The proposal is described in the Explanatory Memorandum as a deliverable under the strategy outlined in the Commission Communication, ‘A Single Market for Intellectual Property Rights: Boosting creativity and innovation to provide economic growth, high quality jobs and first class products and services in Europe’.

2. The concept of trade secrets in the form of ‘business information’, according to Recital 1 of the proposal, ‘extends beyond technological knowledge to commercial data such as information on customers and suppliers’.

3. Given the clear relevance of personal data to this proposal, it is regrettable that the EDPS was not consulted as required by Article 28(2) of Regulation (EC) No 45/2001. This Opinion is therefore based on Article 41(2) of that Regulation. 1.2. Objective of the proposal and focus of this opinion

4. The aim of the proposal is to establish a sufficient and comparable level of redress across the internal market in the case of trade secret misappropriation while providing sufficient safeguards to prevent abusive behaviour. In doing so it is intended to attract and to retain investors and to boost confidence in the competitiveness of European companies.

5. The proposal contains provisions on the trade secret concept, on the circumstances under which the acquisition, use and disclosure of a trade secret are to be considered unlawful, and on measures, procedures and remedies which should be made available to the holder of a trade secret in the case of its unlawful acquisition, use or disclosure by a third party.

6. Under the proposal, Member States would be required to put in place measures to protect secret information which is held lawfully by natural or legal persons. Unlawful acquisition, use or disclosure of a trade secret is predicated (Article 2 of the proposed directive) on the absence of consent of the trader secret holder. The proposal therefore focuses on the rights of the trade secret holder. A trade secret holder, insofar as he or she controls information relating to an identified or identifiable natural person, will frequently be a data controller as defined in Article 2(d) of Directive 95/46/EC, and as such has a number of obligations towards data subjects.

7. This opinion highlights the need for the proposal to consider in particular the rights to privacy and to the protection of personal data of data subjects whose personal data may form part or whole of the trade secrets in question.

2. GENERAL COMMENTS

8. The proposal demonstrates a welcome awareness of the relevance of data protection. Recital 23 states that the proposed directive ‘respects the fundamental rights… recognised by the Charter of Fundamental Rights of the European Union, notably the right to respect [of] private and family life, the right to protection of personal data…’ Recital 24 refers specifically to the importance of these rights in relation to ‘any person involved in litigation’ concerning trade secrets. Article 8(4) concerning the confidentiality of trade secrets during legal proceedings explicitly requires that any processing of data pursuant to that article should be carried out in accordance with Directive 95/46/EC.

9. Nevertheless, greater precision on the concept of trade secrets and clearer safeguards are required to address adequately the potential effects of the proposal on the rights to privacy and to the protection of personal data.

3. SPECIFIC COMMENTS 3.1. Relevance of personal data to the definition of trade secret a) is secret in the sense that it is not, as a body or in the precise configuration and assembly of its components, generally known among or readily accessible to persons within the circles that normally deal with the kind of information in question; b) has commercial value because it is secret; c) has been subject to reasonable steps under the circumstances, by the person lawfully in control of the information, to keep it secret.’

11. Recital 1 appears to elaborate on this definition, indicating that trade secrets include companies’ ‘know-how’ and ‘business information’ ‘covering a diversified range of information, which extends beyond technological knowledge to commercial data such as information on customers and suppliers, business plans or market research and strategies.’ Annex 21 of the impact assessment, which discusses the impact on fundamental rights, is more explicit when it states (p. 254): ‘Information kept as trade secrets (such as list of clients/ customers; internal datasets containing research data or other) may include personal data.’

12. Further discussion on the concept of trade secrets is to be found in section 2.1.1 and Annex 4 of the impact assessment accompanying the proposal, wherein several alternative definitions and similar terms of varying degrees of currency are listed. A chart is reproduced which attempts to depict types of ‘confidential information’: trade secrets are shown as a sub-set of ‘business information’ which itself is distinct from ‘personal information’. (This appears to contradict the statement cited above in Recital 1 to the proposal). Four categories of the trade secrets concept are described, namely ‘secrets relating to highly specified products’, ‘technological secrets’, ‘strategic business information (including lists of customers)’ and ‘private collations of individual items of publicly available information’.

13. Emerging business models in some of the fastest growing sectors of the economy are based on the availability of massive amount of data on customers and their behaviour and on the ability to collect and to monetise those data. A considerable proportion of these data are therefore personal data relating to identified or identifiable individuals, whose processing remains subject to the rights and obligations laid down in Directive 95/46/EC, even after those data have been aggregated or ‘pseudonymised’, so long as they can still be "traced back" to an identifiable individual.

14. The relevance of personal data, which is defined in Article 2(a) of Directive 95/46/EC, to the concept of trade secrets, should therefore be more explicitly acknowledged in the proposal, in particular in Article 2 and in recitals 1 and 28. In order to ensure compliance with Directive 95/46/EC, this acknowledgement should be further reflected as a general provision for all processing of personal data pursuant to the proposed directive, and not only processing in the course of legal proceedings (as envisaged in Recital 24 and Article 8(4)). 3.2. Trade secrets, business secrets and intellectual property

15. Irrespective of any confusion of what a trade secret is, the impact assessment 9 emphasises that it is not the same as an intellectual property right, which is distinct in various ways, including in that the latter gives the holder an exclusive right to the use of the information. Accordingly, the explicit intention (in Recital 28) of the proposed directive is not to ‘affect the application of any other relevant law… including intellectual property rights.’ Its relationship, according to this recital, to Directive 2004/48/EC on the enforcement of intellectual property rights, where the two directives overlap, should be that the proposed directive ‘takes precedence as lex specialis’.

16. A trade secret is also, according to the impact assessment, though not in the text of the 10 proposed directive itself, distinct from ‘confidential business information’ or ‘business secrets’, which is already recognised by the EU as requiring protection. The principle of protection of such information is expressed in Article 339 of the Treaty on the Functioning of the European Union, which forbids EU institutions, members of committees and staff ‘to disclose information of the kind covered by the obligation of professional secrecy, in particular information about undertakings, their business relations or their costs components.’ This principle has been extended through secondary legislation to EU regulatory agencies and national authorities in rules on financial institutions and markets, competition and public procurement. The European Court of Justice, according to the impact assessment, has identified three criteria in determining whether information is a business secret: a. that the information be known only to a limited number of persons; b. that it be ‘information of which not only disclosure to the public but also mere transmission to a person other than one that provided the information may 12 seriously harm the latter’s interest’; and c. that interests liable to be harmed by disclosure must be objectively worthy of protection.’

17. These business secret criteria overlap with the definition of a trade secret in Article 2(1) of the proposed directive: both concepts suggest that steps have been taken to keep the information secret or confidential, and that its disclosure could somehow cause harm, including presumably damage to commercial interests. While the concept of business secret seems wider than that of trade secrets (as presented in the proposal), certain information may fall within both categories. A more precise distinction between the two concepts is needed in the text of the proposed directive itself to provide sufficient legal certainty to data subjects. Clarity is also needed on the relationship between the proposed directive and other legislation concerning business secrets should an overlap occur, in the same way as Recital 28 seeks to address any overlap with the rules on intellectual property rights. 3.3. An individual’s right to access personal data (Article 4)

18. The proposal and accompanying impact assessment largely focus on the importance of protecting the rights of holders of trade secrets and protecting against illegal processing of personal data through misappropriation of a trade secret by a third party. Given the scale and complexity of data processing and their connection to confidential commercial activities the need for some degree of secrecy and high standards of data security cannot be disputed. However, this must be balanced with the need for transparency on how decisions are taken which affect the privacy of individuals whose data is being processed.

19. The proposal should also, therefore, take account of the obligations of the holders of trade secrets as data controllers towards the individuals where their personal information is considered to be a trade secret. In particular, under Article 12 of Directive 95/46/EC, data subjects have the right to access the data being processed and to obtain rectification, erasure or blocking of the data where it is incomplete or 15 inaccurate. Under Article 18 of the proposed General Data Protection Regulation , it is envisaged to extend this right to enable the data subject to obtain a copy of data being processed electronically, including for example social network profiles, purchase and search histories, and to transmit them to another automated processing system. This is called the right to data portability.

20. The proposed directive should not interfere with data subjects’ rights. There is at least one well-reported instance of a global company, which relies on processing of large scale personal data partly, refusing a request from a data subject to access personal data on grounds that disclosures would ‘adversely affect trade secrets or intellectual property'.

21. Accordingly, the EDPS recommends that Article 4 of the proposed directive, which concerns lawful acquisition, use and disclosure of trade secrets, be amended. The article should clarify that the measures, procedures and remedies will not in any way restrict the rights of the data subject under Directive 95/46/EC, and in particular his or her right to access the data being processed and to obtain rectification, erasure or blocking of the data where it is incomplete or inaccurate.

22. Furthermore, in the event that a conflict arises between the right to protection of trade secrets and the right to access to personal data being processed, it may be advisable to provide for an adjudication process involving the relevant supervisory authorities including the national data protection authority. 3.4. Persons suspected of committing an offence (Recital 24, Article 8)

23. Recital 24 refers specifically to the importance of fundamental rights, particularly the rights to privacy and to the protection of personal data, in relation to ‘any person involved in litigation’ concerning trade secrets. Article 8(4) concerning the confidentiality of trade secrets during legal proceedings explicitly requires that any processing of data pursuant to that article should be carried out in accordance with Directive 95/46/EC.

24. Any investigation or litigation concerning a person suspected of illegal activity through unlawful acquisition, use or disclosure of a trade secret implies the processing of sensitive data under Article 8(5) of Directive 95/46/EC. Such data processing may only be under strict conditions, namely, ‘under the control of official authority, or if suitable specific safeguards are provided under national law'. A specific reference to these EU rules on treatment of sensitive data in the course of legal proceedings is therefore recommended. 3.5. Publication of judicial decisions (Article 14)

25. Article 14 of the proposed directive provides for the dissemination and the publication in full or in part of ‘information concerning [a legal] decision’ on an infringement of a trade secret. Among the factors to be taken into account by any decision on publication, under Article 14(3), would be ‘the possible harm that such a measure may cause to the privacy and reputation of the infringer, whenever the infringer is a natural person.’

26. Such an exercise of balancing privacy and transparency and assessing proportionality is appropriate. However, attention should be paid not merely to whether the infringer is a natural person. According to case law established in Schecke and Eifert v Land Hessen , legal persons can claim the protection of personal data where the name of the legal person identifies one or more natural persons, such as where the official title of a partnership directly identifies natural persons who are its partners. It is therefore recommended to clarify that decisions to publish under Article 14(3) should take into account whether information on the infringer would identify a natural person or persons, and if so whether publication of that information is justified.

4. CONCLUSION

27. The EDPS is pleased to note that some account has been taken of data protection aspects of the proposal, and recommends a fuller integration of respect for the rights to privacy and the protection of personal data by means of the following changes: a) a more explicit reference in the recitals to the relevance of personal data to the concept of trade secrets; b) inclusion of a general provision for all processing of personal data pursuant to the proposed directive to be subject to the rules laid down in Directive 95/46/EC; c) a precise distinction in the recitals between the concepts of trade secrets and business secrets and clarity on the application of EU instruments where an overlap occurs; d) clarification in Article 4 that the proposed directive will in no way restrict the rights of the data subject under Directive 95/46/EC and in particular his or her right to access the data being processed; a provision (as appropriate) for a adjudication process in the event of a conflict between the protection of trade secrets and the right to access to personal data; e) a specific reference in Article 8 to EU rules under Article 8(5) of Directive 95/46/EC on treatment of sensitive data such as on suspicion of illegal activity in the course of legal proceedings; and f) clarification in Article 14 that decisions to publish information on the outcome of legal proceedings (Article 14(3)) should take into account whether information on the infringer would identify a natural person or persons, and if so whether publication of that information is justified. Done in Brussels, 12 March 2014 (signed) Peter HUSTINX European Data Protection Supervisor