The legislative materials show that the protection previously provided by Sect. 17 to 19 of the Law against Unfair Competition (UWG) was not supposed to be changed fundamentally. Instead, the German legislator saw a need to introduce supplementary rules under civil law due to the requirements of the Trade Secrets Directive (EU) 2016/943 (BT-Drs. 19/4724 p. 19). With this “supplementary rules”, however, a large number of detailed changes have taken place. This includes a noticeably narrower definition of the term trade secret. According to Sect. 2 no. 1 b) GeschGehG, the protection of information as a trade secret presupposes that the information has been subject to appropriate confidentiality measures by its lawful owner. This results in a need for action.
Starting position
Trade secrets can be decisive for the competitive position of a company. They are characterised by a commercial value, cf. Sect. 2 no. 1 b) GeschGehG. This commercial value results from the secrecy of the information concerned. If the information is no longer secret, its commercial value is lost, since the former owner of the secret can no longer defend the competitive advantage by way of legal proceedings. If a secret is not effectively protected against unauthorized access by third parties, it lacks recognition as a trade secret. In that event, it is also not a suitable basis for business investments. The new law links the protection of trade secrets as a commercially valuable asset to appropriate confidentiality measures. The protection of trade secrets therefore requires active measures.
Non-compliance with the new legal requirements is not – as in the case of the GDPR – subject to a fine. Therefore, the issue is becoming a management matter only (too) slowly. It may come as a surprise to many companies when they notice that they are without legal means against industrial espionage (cf. Ziegelmayer, Geheimnisschutz ist ein große Niche – Zur den unterschätzten Auswirkungen des GeschGehG, CR 2018, 693). For this reason, the implementation of a compliance management designed to protect trade secrets is recommended frequently (cf. Apel/Walling, Das neue Geschäftsgeheimnisgesetz: Überblick und erste Praxishinweise, DB 2019, 891, 898). Some others even locate measures to protect trade secrets directly within the Compliance Department’s area of responsibility (Hiéramente/Golzio, Die Reform des Geheimnisschutzes aus Sicht der Compliance Abteilung – Ein Überblick, CCZ 2018, 262; Hoeren/Münker, Die neue EU-Richtlinie zum Schutz von Betriebsgeheimnissen und die Haftung Dritter, CCZ 2018, 85, 88, who – in the interest of avoiding liability towards third parties – consider it necessary to establish the position of an officer for trade secrets within the company.).
Confidentiality measures as a management duty
In view of the significant value of trade secrets for the companies’ competitive position, there is no doubt that the protection of trade secrets must first and foremost be ensured by the management bodies, regardless of whether the measures are ultimately taken in the compliance department or outside of it. Management must take the necessary measures to ensure the protection of trade secrets (see Wurzer, Know-how-Schutz als Teil des Compliance Managements, CCZ 2009, 49, 54, with reference to No. 4.1.3 of the German Corporate Governance Code). If the managing director refrains from introducing adequate protective measures, this is equivalent to a waiver of the protection of trade secrets and thus a waiver of a commercially valuable asset, comparable to abandoning a patent or not renewing a trademark. There may be cases where such an approach is in the interest of the company, in particular if the competitive advantage conferred by the property right or by the trade secret cannot be used in a profitable manner. This is the case, for example, when the cost of maintaining protection exceeds the profit generated by this protection, disregarding the maintenance costs. In that regard, external options of commercial exploitation must also be taken into consideration, such as the licensing of intellectual property rights and know-how. In most cases, the loss of trade secret protection will not be in the company’s best interest, but will instead represent a missed business opportunity.
Need for implementation
According to the established case law on Sect. 17 to 19 UWG, the proprietor of the secret did not need to implement appropriate confidentiality measures. Instead, it was sufficient for the owner of the secret to present a noticeable subjective intention to keep the information secret. In the event of a dispute, the owner needed to proof that intention. However, courts have been very generous with this requirement and have for all practical purposes essentially presumed the owner’s intention to keep business information secret. Therefore, it was usually up to the alleged infringer to prove the opposite, which hardly ever happened.
This has changed. With the entry into force of the GeschGehG, the burden of proof for effecting appropriate confidentiality measures lies with the owner of the trade secret. To this end, it will be necessary or at least advisable to create internal structures – as for instance a trade secret management – or to review existing structures. In the legal literature, a three-stage approach has been proposed, which includes the identification and categorisation of trade secrets as well as the adoption of appropriate confidentiality measures. The details of possible confidentiality measures will not be discussed here. In any case, documentation of the procedure is absolutely necessary.
Liability of managing directors and board members
If, contrary to the interests of the company, the company’s management completely fails to introduce confidentiality measures or if confidentiality measures taken prove to be insufficient, this may constitute a breach of duties of the managing director or the executive board.
Civil liability
The violation of such duties leads to liability of the managing director according to Sect. 43 (2) GmbH Act (GmbHG) or of the executive board according to Sect. 93 (2) Stock Corporation Act (AktG). Both the managing director and the executive board are subject to an organisational obligation in order to ward off risks and threats to the company’s assets. As a result of this obligation, the managing director and the executive board need to operate an organisation geared to loss prevention and risk control. In the case of trade secrets, the specific risk situation does not arise only from the fact that third parties could actually obtain possession of the trade secrets by unfair means. Rather, the risk to the trade secrets is already laid down by law in-dependently of such occurrences. The loss of trade secret protection is directly linked to the conscious or unconscious omission of appropriate confidentiality measures. The commercial disadvantage occurs immediately when the necessary measures to protect the trade secret have been omitted. It does not require an unauthorised person to have access to the secret.
Specifically for the protection of trade secrets, the responsibility of the executive board members arises from Sect. 93 (1) AktG. According to this provision, the members of the executive board must maintain secrecy regarding confidential information and secrets of the company, in particular company or business secrets, which have become known to the members of the executive board through their activities on the executive board. This obligation is supplemented by the penal provision of Sect. 404 AktG. Similarly, for the managing director of a limited liability com-pany (GmbH), the protection of company and business secrets is emphasized in Sect. 85 GmbHG, according to which the unauthorized disclosure of a secret can be a punishable act.
An inadequate implementation of secrecy measures is generally not to be equated with the active violation of an obligation to confidentiality within the meaning of Sect. 93 (1) AktG. While the obligation of confidentiality presupposes the existence of a trade secret, failure to take confidentiality measures shall deprive the information concerned of such protection in the first place. However, a loss of an asset, as for instance a commercially valuable trade secret, for which the executive board or managing director is responsible may, in accordance with the general provisions of Sect. 93 (2) AktG, 43 (2) GmbHG, obligate the executive board or managing director to pay damages.
Criminal relevance
Failure to take confidentiality measures may also become relevant as a criminal abuse of trust. Pursuant to Sect. 266 German Criminal Code (StGB), anyone who violates his obligation under the law to protect the property interests of others and thereby inflicts a disadvantage on the person whose property interests he has to look after shall be liable to prosecution for abuse of trust . In the event of substantial damage (the value limit assumed by the courts is currently EUR 50,000), which will often be exceeded if trade secrets are lost, Sect. 266 (2), 263 (3) no. 2 StGB even provides for an increased penalty in the form of imprisonment from six months to ten years. Failure to introduce necessary and appropriate confidentiality measures may constitute such abuse of trust (cf. on the Compliance Officer: Schünemann, Leipziger Praxiskommentar Untreue, 2017, para. 159). The managing director of a GmbH has a guarantor position vis-à-vis the company which obliges him to protect the as-sets entrusted to him, but at least to warn the shareholders of a possible loss of as-sets (cf. Schünemann, Leipziger Praxiskommentar Untreue, 2017, mn. 312). The same applies to the executive board of a stock corporation, whereby both the GmbH managing director and the executive board of the stock corporation have room for manoeuvring under the Business Judgement Rule. This room for manoeuvre will, however, usually be exceeded if valuable company secrets are revealed and legal protection for them is lost due to a lack of secrecy measures.
As pointed out above, the loss of the trade secret as a legally protected asset is directly linked to the failure to take confidentiality measures. Therefore, the managing director or the member of the executive board in default is strictly speaking even cut off from defending with the argument that third-party access to the trade secret has actually not occurred.
The commercial criminal departments of the public prosecutor’s offices are already groaning under heavy workload. It is therefore highly unlikely that they will investigate such matters ex officio. However, the public prosecutor’s offices will not be able to completely evade this, if criminal charges are pushed. In cases where confidentiality measures are completely absent or manifestly inappropriate, the defence will not be easy.
Bottom line
Managing directors and board members are obliged to implement confidentiality measures sufficient to comply with the new Trade Secret Protection Act. In order to avoid civil and even criminal liability, these measures need to be taken without delay.
