Although technical and business know-how makes up a significant part of a company's value, it is often inadequately protected. The widespread introduction of mobile working as a result of the coronavirus pandemic has exacerbated the problem. If an employee discloses company know-how without authorization, they face a warning, and in particularly serious cases or in the event of recurrence, even dismissal. The company may also be entitled to damages and injunctive relief against the employee. Particularly serious breaches of confidentiality obligations may even be punishable by law.
However, measures under employment law and criminal sanctions generally require information to be protected as a trade secret. Since the German Trade Secrets Act (GeschGehG) came into force in 2019, the requirements for this have increased considerably. Only information of commercial value that is worthy of protection, not generally known or generally accessible and is the subject of appropriate confidentiality measures by the company is now protected as a trade secret on the basis of legitimate interests. In the event of a dispute, the employer bears the burden of proof that appropriate measures have been taken. Many companies have adapted internal guidelines and employment contract agreements to the new legal situation in good time and taken technical and organizational precautions to protect information. However, the general trend towards mobile working as a result of the coronavirus pandemic has often not yet been taken into account. Existing concepts should therefore be put to the test.
Appropriate confidentiality measures include technical, organizational, and legal measures. An appropriate protection concept takes into account the importance, risk situation and form of information worthy of protection. Top secret information, the disclosure of which would threaten the existence of the company, must be protected more carefully than sensitive information, the disclosure of which would only be associated with a short-term economic disadvantage. Protective measures must be determined according to this categorization; physical access restrictions such as lockable rooms and filing cabinets and IT security measures such as password protection can be considered. Legal protective measures include employment contract regulations and instructions and regulations in collective bargaining agreements or works agreements. In addition, protection concepts must be adapted to changing work circumstances.
Company know-how is exposed to an increased risk of disclosure when working from home or on the go. Third parties can listen in on confidential conversations or view confidential documents more easily than usual. Access restrictions are often no longer sufficient and must be supplemented by additional measures. It is advisable to sensitize employees in training courses and provide them with specific instructions on how to behave. Many employees are probably already used to visual restrictions such as protective films for laptops and file covers for business trips. In addition, regulations on the use of private data carriers and password protection should be reviewed. Particularly in the case of PC-bound workstations, the adaptation of protective measures can trigger co-determination rights of the works council. It is also conceivable that, when dealing with particularly sensitive data, no effective measures for protecting trade secrets are available, making remote work simply not an option.