Georgia Bar Journal
GSB Vol. 14, NO. 4, Pg. 32.
Keeping Your Genies in the Bottle: 10 Steps to Protect Your Most Sensitive Secrets
GSB JournalVol. 14, NO. 4December 2008Keeping Your Genies in the Bottle: 10 Steps to Protect Your Most Sensitive SecretsWarren R. Hall Jr. and Brett E. CoburnIf, as has been said, intellectual property is the currency of the future, then the future has arrived. Yesterday's spy movie gadgets are today's reality: from pint-sized recording devices to minute cameras, to portable electronic storage media capable of putting a bookshelf in your pocket or an entire library in your briefcase. It seems that portability of information is matched only by portability of employment. It is ironic that the proverbial "gold watch" signifying 25 years of tenure with an employer has largely gone the way of the vanishing wristwatch, a victim of the Information Age with its ever-present competing offerings.
In recent years, the combination of increasingly portable data and an increasingly portable workforce has created a perfect storm of opportunities for a company's proprietary information to fall into the hands of a competitor. Resulting legal problems are invariably expensive, time-consuming and frustrating. No matter what your company spends or what resources are deployed, the effort is likely to be a "recovery," not a "rescue." Once out, your intellectual property genies are unlikely to go back into the bottle. Your best chance is to secure your genie bottle on the front end, by spending a fraction of the time and money that you would waste later racing around after your genies once they escape.
Under Georgia law, a trade secret is information
. . . which is not commonly known by or available to the public and which information:
Derives economic value, actual or potential, from not being generally known to, and not being readily ascertainable by proper means by, other persons who can obtain economic value from its disclosure or use, and
Is the subject of efforts that are reasonable under the circumstances to maintain its secrecy.(fn1)
Thus, one of the main battlegrounds in trade secrets litigation is whether your intellectual property genies were reasonably protected. Appropriate protective measures can reduce the risk of theft in the first instance, and can also protect legal rights (by garnering trade secret protection for sensitive information) and create new legal rights (such as contractual protection for non-trade-secret confidential business information) for protecting a company's secrets. Such measures include identifying sensitive information, limiting access to it and creating and implementing policies and contractual arrangements that facilitate protection of such information. This article presents a series of practical steps that companies should take to protect their sensitive information from misappropriation and to help ensure that appropriate legal remedies are available in the event that misappropriation occurs and litigation becomes necessary.
Identify your most sensitive information.
Your company, or your client's company, likely has more secret information than it thinks. Although some secrets are obvious, such as customer lists and strategic marketing plans, other types of information can be similarly sensitive and damaging if they fall into the wrong hands. Financial data, cost and overhead information, sales data broken down by product or customer and designs or schematics for existing products or services can be devastating if revealed to a competitor.
The Georgia Trade Secrets Act (GTSA) identifies types of information that can often constitute trade secrets as "technical or nontechnical data, a formula, a pattern, a compilation, a program, a device, a method, a technique, a drawing, a process, financial data, financial plans, product plans, or a list of actual or potential customers or suppliers . . . ."(fn2) Most other states have adopted variations of the Uniform Trade Secrets Act that define trade secrets similarly, although not always identically.(fn3)
Understand also, however, that the sun does not rise and set solely on trade secrets. In Georgia and many other states, parties can contractually protect confidential information from disclosure for a limited period of time even if the information does not constitute a trade secret.(fn4) Thus, when identifying proprietary information that you want to protect, you should look beyond trade secrets. As long as the information is not readily available outside your company and has not been publicly disclosed by someone with authority to make such disclosure, you should seriously consider protecting all proprietary information and tangible things using the techniques outlined below.
For example, financial records and cost and sales data each could provide a savvy competitor with tools to spot weaknesses or opportunities, such as struggling product lines or submarkets, or particular products on which your costs are running over budget. Cost information also can allow a competitor to pinpoint the optimum price at which it can capture sales (and thus market share), but still maximize profits. Sales or profit data organized by product lines or business groups will identify to a competitor where it should focus its competitive efforts. Product design plans can allow a competitor to identify how and why its products compare to your company's-and thus how to improve its competitive product or point out any deficiencies in your products.
The stakes are high in competitive business environments. A crafty competitor can use even seemingly benign information to gain a competitive edge. So, when evaluating your company's or your client's secrets, remember that even secrets that are not true "trade secrets" can often be worthy of protection.
Limit access to sensitive information.
Once you have identified your proprietary information, whether it be trade secrets or merely confidential business information, your first step in protecting it is to restrict access within your organization. This is an important but sometimes overlooked aspect of data security. Even sensible executives can be lulled into a false sense of confidence if they feel that their secrets are secure from external threats.
Two reasons suggest why limiting in-house access to your secrets is a prudent first step. First, Georgia courts have at times been hesitant to grant trade secret protection for information that is freely available within a company's walls, even if the information is entirely secure from outsiders.(fn5) Second, in the authors' experience the greatest threat to a company's proprietary information is from "inside jobs"-misappropriations by current or recently departed employees. Limiting access within a corporation to secret information narrows the pool of potential misappropriators. Simply put, internal document and information security is a vital first step in enhancing the odds of protecting your company's information.
Carrying out this important step, however, is another matter. Restricting internal access to a wide range of secrets is time-consuming and fraught with difficulties. As an initial matter, most companies are not in the business of collecting proprietary information for its own sake-the information exists and is valuable often because the company's...