A real-life case that raises unexpected questions: Does the passive acquisition of a USB flash drive containing trade secrets constitute an element of the offense under the German Act on the Protection of Trade Secrets (GeschGehG)? And if so, which one? The legal classification of the “found” trade secret is the subject of this article.
The Initial Case
Two managing directors from competing companies meet for lunch. However, the conversation does not revolve around price-fixing. Rather, one of the managing directors reports ongoing trouble with the shareholders and a generally poor atmosphere within the company. He also hints that he does not see his professional future at his current company. At the end of the conversation, this managing director silently places a USB drive on the table. There is no mention of the USB drive’s contents, nor are there any other clues as to what it contains.
The other managing director pockets the USB drive without giving it much thought. Upon accessing the contents (after an IT check, of course), he finds several files that, after a quick and cursory glance, turn out to be current customer lists for various product lines.
Although the managing director is very interested in this information, he has the good sense to call his trusted IP attorney, who, as it happens, is also knowledgeable about trade secrets. He now wonders whether – and, if so, at what point – he might have already committed a criminal offense, or whether he could perhaps make use of the data in some way.
I. Legal Framework
Section 4 (GeschGehG) specifies the conditions under which a trade secret may not be obtained, used, or disclosed.
The question is whether any of the following actions constitute a prohibited act under the provision: first, the mere acceptance of the USB drive; second, connecting the USB drive to a computer and subsequently reading its contents; and finally, the use or disclosure of the trade secrets (which has not yet occurred in our case).
1. Requirements of Section 4 GeschGehG
A trade secret is obtained unlawfully within the meaning of Section 4 (1) no. 1 GeschGehG through unauthorized access to, unauthorized appropriation of, or unauthorized copying of documents, objects, materials, substances, or electronic files that are subject to the lawful control of the trade secret owner and that contain the trade secret or from which the trade secret can be derived.
According to prevailing legal opinion, a person gains access if they place themselves or allow themselves to be placed in a situation that affords the possibility of accessing the trade secret or a medium containing the trade secret. The mere possibility of gaining knowledge is sufficient; actual knowledge is not required for access to be established. Access can occur both physically and digitally.
It is disputed whether overcoming protective measures is necessary, as is argued in the legal literature. The prevailing view rejects such a requirement – and rightly so. Neither the wording of Section 4 GeschGehG nor EU Directive 2016/943 suggests that bypassing security measures is a prerequisite for the offense.
The EU legislature deliberately chose not to include such a requirement. This is confirmed in particular by a comparison with Section 202a of the German Criminal Code (StGB), which criminalizes the spying on data. There, the elements of the offense expressly require that “access controls be circumvented”; Section 4 GeschGehG, by contrast, does not contain such a requirement. If, in a specific individual case, no security measures can be circumvented, the question arises instead as to whether “reasonable confidentiality measures” within the meaning of Section 2 No. 1 b) GeschGehG were in place at all. However, this concerns solely the concept of a secret and not the prohibitions on conduct set forth in Section 4 GeschGehG.
According to prevailing opinion, however, the definition of “access” is limited by the requirement of “active conduct.” Thus, in its decision of November 27, 2020 (Case No.: 6 W 113/20), the Higher Regional Court of Frankfurt am Main ruled that the mere receipt of an email does not constitute “access” within the meaning of the provision, because the recipient makes no independent contribution to receiving the email. Rather, the court requires an active element; the recipient must have engaged in (some) form of activity to fulfill the elements of the offense.
It is also questionable whether “receipt” requires a subjective component, as was the case under previous law. Under the earlier legal framework – following the model of criminal law – the act had to be committed intentionally; additionally, there had to be a motive that increased the wrongfulness of the act. Such a motive was present, in particular, if the act was committed for competitive purposes, out of self-interest, for the benefit of a third party, or with the intent to cause harm. Civil law claims, such as those under Section 823 BGB, were established by classifying Section 17 UWG (old version) as a protective statute within the meaning of Section 823(2) BGB. However, this assessment can no longer be sustained today. Section 4 GeschGehG, the introduction of which repealed Section 17 of the Unfair Competition Act (UWG), is now based on civil law and no longer requires intent. The elements of the offense under Section 4 GeschGehG must therefore, in principle, be assessed objectively.
However, both the majority of the legal literature and case law hold the view that the concepts of access, appropriation, and copying presuppose “purposeful conduct” and that, therefore, a subjective element must be read into the elements of the offense. In some cases, however, legal literature distinguishes between these claims, holding that defensive claims must be assessed from a purely objective perspective, whereas claims for damages require fault and thus a subjective component. The Higher Regional Court of Frankfurt am Main also affirmed the requirement for a subjective element in its decision (see above).
The requirement of a subjective component appears appropriate. The very definition of “access” requires that a person “place themselves” or “allow themselves to be placed” in a certain situation. This wording presupposes an active element of conduct. Otherwise, the definition would have to state that a person “ends up” in a certain situation, which it does not.
2. Application to the initial case
a) The Acceptance of the confidential information
First, the question arises as to whether the mere passive acceptance of the USB drive constitutes a prohibited “acquisition,” in particular “unauthorized access” within the meaning of Section 4 (1) no. 1 GeschGehG.
By accepting the USB drive, the recipient gains the opportunity to actually become aware of the secrets, so that, in principle, access has occurred. As we noted above, actual knowledge is not, in principle, a determining factor here. However, it is questionable whether the recipient also obtained the USB drive through an active act or purposeful conduct. In the absence of such an active element, there would be no access within the meaning of Section 4 GeschGehG.
The case bears significant parallels to the mere receipt of an email, in which case the jurisdiction has denied receipt due to the lack of an active contribution. This is supported in particular by the fact that the recipient did not make a conscious contribution to the transmission of the confidential information. Admittedly, inserting the USB drive formally constitutes an active act. However, the recipient specifically lacks awareness that trade secrets are stored on the data storage device. Consequently, the subjective component of purposeful action is also absent. The recipient merely accepts an item handed to him without having previously formed the intent to obtain trade secrets through purposeful action. His conduct is specifically not directed toward gaining knowledge of confidential information. The requirement of an active act, however, implies the existence of at least a minimum degree of intent.
The facts of the case are therefore similar to the accidental discovery of an unmarked trade secret. The recipient cannot deduce from the unremarked-upon handover of the USB flash drive what content is stored on it. The handover itself also ultimately occurs by chance from the recipient’s perspective, since the decision to transfer the information rests solely with the former managing director. The recipient therefore receives the drive without any purposeful action on their part and solely based on the will of the person handing it over. Correctly, this process should not be considered a violation of Section 4 (1) no. 1 GeschGehG. It also seems disproportionate to hold the recipient liable for a legal violation in this specific situation, even though the recipient makes no independent contribution to obtaining access. Once the flash drive is plugged in, the recipient can, in fact, no longer reverse the acquisition of the trade secret, even though the recipient does not yet know that he or she is in possession of such a secret.
It should be noted here that the assessment depends on subtle nuances. A truly unsuspecting recipient should not be deemed to have committed the offense, especially since an overly broad definition of “obtaining” would also allow for the abusive “imposition” of secrets. However, the case would be assessed differently if the recipient suspects or even knows what data is on the USB flash drive.
b) Use of the USB flash drive
Furthermore, it is questionable whether plugging the USB flash drive into a PC and subsequently reading its contents constitutes unauthorized access.
In this case, at any rate, the required active act is present, since the recipient connects the drive on their own and deliberately opens the files. However, even at the time of insertion, the recipient does not yet know that the drive contains trade secrets. In the absence of any labeling or corresponding notification from the former managing director, the recipient cannot initially have any knowledge of this. Only by opening the files does the recipient gain the opportunity to recognize the confidential nature of the information.
According to a strict interpretation, unauthorized access does not require that the recipient be aware of the confidential nature of the information. The reasoning given is that even in such cases, there is a risk of the secret being disclosed. While this argument is convincing insofar as even an unwitting recipient can effectively jeopardize the protection of the trade secret, this view leads to considerable difficulties in practical application.
For example, according to the prevailing view, the mere discovery of a trade secret does not in and of itself constitute unauthorized access, as long as the secret is not recognizable as such. If, on the other hand, the finder knows for certain – based on a label or other circumstances – that a trade secret is present, and yet reads the documents anyway, they are acting purposefully and knowingly with regard to becoming aware of the secret. Even in the typical case of a found item, the legal literature therefore distinguishes based on whether the recipient recognizes the confidential nature of the information or not.
The strict view, on the other hand, completely disregards this element of knowledge. This is not convincing. The cases are comparable because, in both a chance discovery and the present case, the recipient is initially unaware that trade secrets are involved. Since the present scenario closely resembles the typical case of accidental discovery, the recipient should be permitted to first clarify the contents of the USB drive.
This is also supported by the fact that some legal scholars assume a duty to cease further review only from the moment the recipient recognizes the confidential nature of the information. Only from that point onward may the recipient not continue to read, use, or disclose the documents.
The underlying scenario has not yet been the subject of any court decisions. Nor does the legal literature present a uniform view on this matter. However, there are strong arguments in favor of requiring a subjective component and distinguishing based on the point in time at which the recipient becomes aware of the confidential nature of the information. In any case, it is clear that the recipient may not use or disclose the trade secret. If, while reading the files, the recipient realizes that they contain trade secrets and nevertheless continues to review them or disseminates the information further, the elements of the offense under Section 4 (2) no. 1 GeschGehG are fulfilled as of that point at the latest. By continuing to read or by passing on the information, the recipient now knowingly and intentionally gains unauthorized access to the trade secret within the meaning of Section 4 (1) no. 1 GeschGehG.
c) Indirect infringement of a trade secret, Section 4 (3) GeschGehG
Liability may also arise under the principles of indirect breach of a trade secret pursuant to Section 4 (3) GeschGehG. According to this provision, a person who has obtained a trade secret through another person and who, at the time of obtaining, using, or disclosing the trade secret, knows or ought to know that the other person has used or disclosed the trade secret in violation of paragraph 2, may not obtain, use, or disclose the trade secret. In this context, “knowing” means actual knowledge, and “should have known” means negligent ignorance. Pursuant to Section 276 (2) of the German Civil Code (BGB), a person acts negligently if they fail to exercise the care required in business dealings. With this provision, which was newly introduced by GeschGehG, the legislature has significantly expanded liability. The example case in particular, however, illustrates the relevance of the provision:
If the recipient has concrete indications that the information was used or disclosed as a result of a prior unlawful act, the recipient is subject to a duty to investigate. This duty may include the obligation to seek legal advice or to examine the origin of the information more closely. The scope of the duty to investigate depends, in each individual case, on the value of the secret.
In the present case, this leads to the following conclusion: At the time the USB flash drive is received, there is still no knowledge whatsoever of what information is stored on the data carrier. The recipient therefore knows neither that trade secrets are involved nor that an unlawful disclosure may have occurred. The elements of the offense under Section 4 (3) GeschGehG are not yet present at this point in time.
Only upon opening the files and realizing that they contain confidential customer lists or other trade secrets does a more concrete basis for suspicion arise. From this point on, the possibility that the information was disclosed without authorization becomes apparent. The recipient is now under a duty to investigate. If the recipient continues to use or review the information despite these grounds for suspicion, there is strong evidence that the recipient must, at the very least, have known that the information originated from an unlawful disclosure. From this point on, the recipient may neither continue to use nor disclose the trade secrets; any such use violates Section 4 (3) GeschGehG.
II. Conclusion
In the absence of relevant court decisions and given the isolated and inconsistent views expressed in the legal literature to date, it is not possible to predict with certainty how courts will rule on such a case. However, there are good reasons to interpret Section 4 GeschGehG as including a subjective component in order to properly assess such situations. This does not create a gap in protection, as the facts of the case are covered by Section 4 (3) GeschGehG.
Whether access through omission is also possible – for example, by merely retaining the USB flash drive – has not been conclusively clarified. To avoid legal risks, it is therefore advisable in practice to return any USB drive or comparable data storage medium received immediately and to seek legal advice at an early stage. To avoid difficulties in proving the facts later on, the entire process should be carefully documented. Furthermore, the recipient should under no circumstances pass on, copy, or otherwise distribute the USB flash drive or the email.