When the Act on the Protection of Trade Secrets came into force in April 2019, it marked a break with past convention for Germany. Previously, secrets were usually also vaguely referred to as “know-how,” the legal protection of which was basically taken for granted. After April 2019, in the event of a dispute, the person who felt his “secret” had been violated suddenly had to show and prove that this information was “subject to reasonable steps under the circumstances to keep it secret.”

In the meantime, there are more and more German court decisions on trade secret law. They clarify the rules and show what requirements must actually be met in order to properly protect information. Some litigants experience unpleasant surprises. Information that was secret from management’s point of view can be found to be common property due to a lack of protective measures, and any third party can use them virtually at will.

Since the introduction of the Trade Secrets Act, it has been necessary for companies to take appropriate measures to ensure that their sensitive information exists as a legally protected secret - such as information to be kept secret from the public or competitors. This can include, for example, customer lists, supplier data, market analyses, data sets for machine control, strategy papers, drawings or machine-generated data.

All too often, such data is not subject to copyright protection, and it is rarely protected as a patent. A customer list is not something that has any level of creativity, nor does it offer a technical solution, which rules out protection by the aforementioned property rights. Nevertheless, such information is important and worth money, not least in view of the multi-billion-dollar data economy - but only if its secrecy is kept, i.e. proprietary.

Recent rulings in Germany on the Trade Secrets Act have specified  what protective measures are needed to make information proprietary. For example, the higher regional courts (OLG) of Düsseldorf and Hamm clarified that an entrepreneur does not need to create optimal protection with absolute or extreme security for his confidential information. Thus, the costs of protection do not have to exceed the value of the secret. Conversely, it is insufficient for the entrepreneur to take only a minimum of protective measures - for example, to avoid high costs and a high organizational effort - in order to maintain adequacy (OLG Düsseldorf, ref. I-15 U 6/20 and OLG Hamm ref. 4 U 177/19).

The OLG Stuttgart ruled that, as a minimum standard, it is to be required that relevant information may only be entrusted to persons who (potentially) need the information to perform their task and who are bound to secrecy (ref. 2 U 575/19).

Overall, no adequate level of protection can be assumed if the owner of the secret accepts a “data leak,” i.e. allows employees to save files on private data carriers without password protection, or if paper documents are not secured against access by unauthorized persons. There must therefore be a clear restriction on access to information, and this must actually be enforced.

Detailed confidentiality agreements could be an important component of the protection of secrets. Contractual penalties, which have somewhat fallen out of fashion in Germany, may now also see a resurgence.

Insufficiently effective measures necessarily lead to the loss of trade secret status. In a judgment, the Düsseldorf Regional Labor Court found that a trade secret requires appropriate confidentiality measures. Without such measures, there is no trade secret and no injunctive relief. A contractual obligation to return the list that constitutes a potential secret alone is not sufficient for this. Furthermore, the German legislator did not grant a transitional period to the owners of secrets: If protective measures had not been implemented when the law came into force, the information was merely information and not a trade secret (ref. 12 SaGa 4/20).

In practice, companies must create protection levels - such as internal, confidential, secret, top secret. The protection levels then define the protection measures that must be applied there. This should also define the groups of people who are permitted to have access. It is also necessary to “instruct” and continuously train employees in this regard.