A common defense argument in trade secrets litigation is the claim that the defendant did not copy or take any documents but rather retained certain information in their memory. Given the scientific debates about the rarity of a photographic memory and such recall abilities, one might think that German courtrooms are a magnet for the country’s best memory artists. In its decision of May 2, 2024 (Case No. I ZR 96/23), the Federal Court of Justice (BGH) established a rule of thumb.
Facts of the case: Login credentials from memory?
The plaintiff operates an online platform for trading auto parts, which connects wholesalers and retailers. On the password-protected platform, authorized wholesalers each had access to their own area where they could contact customers and access sensitive data. A former member of the plaintiff’s executive board, who joined a competitor after leaving the company, had access to customers’ login credentials during his employment and continued to use them after leaving to log into the accounts of several customers.
The distinctive feature of the case stems from the fact that the plaintiff had based its claims on the use of three usernames and passwords. However, the facts of the case revealed that the defendant had used ten usernames and passwords to access the ten different customer accounts a total of 300 times. The Regional Court of Kaiserslautern and the Higher Regional Court of Zweibrücken strictly limited their consideration to the three usernames and found no evidence of a violation of the law. Based on common sense, it would be possible to memorize the login credentials of three customers.
The Federal Court of Justice (BGH), however, overturned this decision and clarified that the lower courts should have also taken the broader circumstances of the case into account. The use of ten usernames and passwords totaling over 80 characters suggests that the defendant likely took notes.
Previous case law on memory retention
Case law consistently emphasizes that former employees must not, in principle, be restricted in the use of their professionally acquired knowledge and experience obtained in good faith. However, this principle applies only to information that the employee has retained in memory and can reproduce from memory without the aid of any tools.
An earlier decision by the Federal Labor Court (BAG) concerned the use of 18 customer addresses that had been managed over many years by an employee of a wine merchant. The former employee had conducted further business with these 18 customers. Among other things, the proceedings centered on the question of whether the defendant had copied and/or taken customer data with him prior to his departure. In their decisions, the Baden-Württemberg Regional Labor Court and the BAG assumed without further discussion that an employee could retain in his memory the names and addresses of 18 customers whom he had served over many years (BAG, judgment of Dec. 15, 1987 – Case No. 3 AZR 474/86). It should be noted in passing that a search of the defendant’s home did, after all, turn up “455 copies of orders, 78 return slips, 27 copies of order forms, and 46 original customer index cards.”
Somehow, however, the defendant’s attorney – using what appears to have been a remarkable line of argument – managed to convince the courts that these were worthless old documents…
The Federal Court of Justice’s (BGH) 1999 “Wine Consultant” ruling (Case No. I ZR 2/97) also concerned the wine trade. In that case, a sales representative had written to at least 200–220 of his principal’s former customers after terminating his employment and, during the legal proceedings, claimed to have recorded all the addresses from memory with the help of the phone book. Although this argument convinced the Higher Regional Court of Koblenz, it did not persuade the Federal Court of Justice, which remanded the case for further evidence to be taken. As far as can be ascertained, the proceedings were subsequently settled out of court (perhaps for good reason…).
Another ruling on memory capacity comes from the Higher Regional Court of Brandenburg in 2020 (Case No. 6 U 42/19). This case involved an insurance agent who, after leaving her job, began working for a competitor and claimed to have memorized customer data in order to contact them later. However, the plaintiff was only able to prove actual use in one instance. The Brandenburg Higher Regional Court considered it plausible that the defendant could have retained the data of at least one customer in her memory, given that she had worked in a small community for over 16 years. The court emphasized that the mere recollection of customer data does not necessarily indicate unauthorized use, particularly when the number of customers served and the level of detail in the information are manageable.
The Higher Regional Court of Stuttgart also addressed the question in 2020 (Case No.: 2 U 575/19) of how likely it is that employees can retain the details of product formulations and customer data from memory. The specific case involved polyurethane foam systems, whose formulations consist of many specific parameters. The Higher Regional Court of Stuttgart criticized the defendants for simply claiming to have retained these formulations in their memory without, however, referring to specific formulations or plausibly explaining why certain formulations – or essential components thereof – in particular should have remained in their memory. At the same time, the panel emphasized that it is entirely reasonable for an employee in a management position to retain the identities of customers and contacts in their memory.
Significance of the number and type of information
A central question in the Federal Court of Justice’s (BGH) new decision was how much and what kind of data a person can memorize. The BGH emphasized that, while it is conceivable within the scope of free evaluation pursuant to Section 286 ZPO, that a person could memorize the login credentials of three customers – consisting of usernames and an eight-digit password – but ten usernames and their corresponding passwords? That is in a completely different league. It defies common sense to memorize such a large amount of information without taking notes.
In this case, the passwords consisted of eight arbitrary characters, although unfortunately the exact nature of their composition is not specified in the decision. This detail is likely to be decisive for assessing the facts of the case: Human memory is capable of retaining well-structured and meaningful information, such as the creative passwords “Password” or “12345678.” However, with complex and random character combinations (“he+3mnc_5jdfj5”), this becomes considerably more difficult, especially when dealing with a large number of such passwords. Thus, it seems plausible that someone can remember simple passwords, while it is nearly impossible to keep ten complex or even randomly generated passwords in memory. Even with “only” three randomly generated alphanumeric passwords, there are likely to be significant doubts, realistically speaking, that they can be retained in memory.
Conclusion: Realistic limits of memory
The ruling shows (once again) that companies should not rely solely on the loyalty of former employees but should implement robust security measures to protect their trade secrets. This is particularly true when a key executive leaves the company. In this case, for example, the question certainly arises as to whether the plaintiff company should at least have reviewed its password management after the executive’s departure.
It is not entirely clear whether the Federal Court of Justice’s (BGH) reasoning can be regarded as an empirical rule regarding memory performance. In any case, the decision highlights the limits of the defense’s potential arguments. However, some questions remain: How can a defendant prove that he did not use any records? Would he have to demonstrate in court that he is able to recall all combinations from memory? Will we, then, see memory competitions in courtrooms in the future to prove memory capabilities? Or will a psychological expert opinion be necessary?
What is clear is that simple and coherent information can be memorized, while complex and disjointed data is difficult to retain without notes. After all, the Federal Court of Justice’s decision highlights the limits of human memory. The assessment that three sets of data are conceivable but ten are unlikely can now serve as a practical rule of thumb for memory performance in real-world situations.