The requirement to protect a trade secret through appropriate confidentiality measures continues to pose challenges for clients and advisors. A recent decision by the Austrian Supreme Court (öOGH) now illustrates that negligence can have serious consequences for the trade secret holder.
Background: Appropriate protective measures, Section 2 No. 1 b) of the German Act on the Protection of Trade Secrets (GeschGehG)
The trade secret holder’s obligation to protect their trade secret from access by third parties through appropriate confidentiality measures is the central innovation of the GeschGehG. The interpretation of this element of the offense still leads to difficulties in practice because there are only a few decisions providing concrete guidance on the necessity (or lack thereof) of certain measures. As a result, in cases of doubt, increasingly stringent measures and ever-higher protection requirements are recommended. Even though the Higher Regional Court of Düsseldorf has already clarified that optimal protection or extreme security is not required (Higher Regional Court of Düsseldorf, decision of March 11, 2021, Case No.: 15 U 6/20, para. 64), this approach is understandable and, ultimately, to a certain extent necessary given the unclear legal situation. A recent decision by the Austrian Supreme Court illustrates the potential consequences of negligence.
Decision of the Austrian Supreme Court
The Austrian Supreme Court ruled in an injunction proceeding between two companies operating in the financial services sector that provide fund and financial data, along with additional information, to their clients (insurance companies, banks, pension funds, and other financial service providers).
The respondent employs a woman who had previously held a managerial position at the petitioner for approximately 13 years and was involved in all operational processes there. In 2018, this employee had contractually obligated herself to the petitioner to treat the petitioner’s trade secrets as “strictly confidential.” The employment relationship ended with a notice of termination by the plaintiff in July 2021.
As recently as November 2021 – that is, several months after her employment ended -the former employee was able to log into the database of her former employer, the plaintiff, and had unrestricted access to all data there. According to the petitioner’s allegations, the former employee copied a significant amount of customer data and information about funds in November 2021, i.e., after her departure. The petitioner claims that the respondent used this information to actively and specifically poach customers. The petitioner initiated proceedings to preserve evidence as part of a preliminary injunction, which was granted at the first instance. The Court of Appeals (the second instance) dismissed the petition. The petitioner has filed a petition for review with the Supreme Court against this decision (Note: The Austrian Code of Civil Procedure allows for three instances in injunction proceedings).
The Supreme Court points out that the petitioner neglected to provide effective protection for its trade secrets. The former employee had unrestricted access to the petitioner’s database for months after the termination of her employment contract (the repetition of “unrestricted” appears in the original).
As a result, the petitioner violated its obligation to protect the trade secrets with appropriate confidentiality measures. It therefore cannot invoke statutory confidentiality protection against the respondent in this specific case (Supreme Court, Order of November 19, 2024, 4 Ob 195/24s).
Assessment
The Austrian Supreme Court’s reasoning (rightly) conveys a certain sense of bewilderment. The court expressly points out that, as part of reasonable IT security measures, it goes without saying that a departing employee’s access to the IT system must be immediately blocked.
This warning and admonition can be applied in every respect to the assessment under German law: A holder of trade secrets who fails to implement even the most basic protective measures – such as blocking database access for departing employees – loses protection for those trade secrets. Every company should take urgent care not to neglect trade secret protection when terminating employment relationships. This includes such obvious measures as blocking access to computer systems and physical access to the workplace, as well as providing instructions on how to handle trade secrets after leaving the company and, of course, the obligation to return all physical or electronic copies of the (former) employer’s trade secrets.
Another interesting question – which did not require clarification in the Supreme Court proceedings – is whether the loss of trade secret protection affects only the relationship between the parties involved, or whether a third party could also rely on the inadequate protective measures (provided they are aware of them). From a systematic perspective, there are good reasons to believe that any third party should also be able to raise this objection: The obligation of the secret holder is not limited to the relationship with specific individuals. Since the secret holder must protect its information from everyone in an appropriate manner, a third party who becomes aware of inadequate confidentiality measures may also rely on them.
Conclusion: No protection without protective measures
The legal system still does not require perfect protective measures. However, anyone who acts negligently and – as in this case – fails to implement even the most basic protective measures due to gross negligence forfeits the protection of their secrets.