Late last month, the Association of Corporate Counsel (ACC) hosted a panel on Trade Secret Protection in Life Sciences: Strategies for Success. In today's rapidly evolving business environment, trade secrets are becoming increasingly valuable assets for companies across nearly every sector and industry, and life sciences is no exception. Without adequate safeguards, this critical intellectual property could easily fall into a competitor’s hands, undermining years of research and investment and potentially robbing a life sciences company of a significant market advantage.

Defining "Reasonable Measures"

To ensure the integrity of their proprietary information, trade secret owners must be able to demonstrate to a court that reasonable measures have been taken to maintain confidentiality.

But what does "reasonable" actually mean in practice?

In general, courts consider efforts to be reasonable "under the circumstances" based on the nature and value of the trade secret, the size and nature of the business, the ease of theft, the extent of the threat of theft, and the particular field of knowledge or industry. While trade secret owners are not obligated to take "extreme and unduly expensive" measures, they are expected to go above and beyond "general protective measures” when safeguarding proprietary information.

Safeguarding Trade Secrets: Steps to Consider

In seeking to identify their trade secrets, life sciences companies should aim for a balance between the information security processes that will provide robust protection and legal enforceability and other business realities, including cost, operational efficiency, and information-sharing demands necessary to drive innovation and support business operations.

Reasonable measures to consider include:

Identify Trade Secrets for Employees

To avoid any confusion, it's a good practice to proactively identify in clear and simple terms what information is considered a trade secret and what is expected of employees who have access to that information.

Go "Need to Know"

Many organizations limit access to trade secrets to only those employees, groups, or departments where the "need to know" is critical to performing their jobs.

Don't Neglect Cybersecurity

Today's digital-first world gives bad actors multiple entry points to a company's networks and the proprietary information they contain:

• Passwords: Courts view password protection as an essential, reasonable measure. Beyond standard network security, consider using passwords to limit access to specific employees or proprietary information. Implement password strengthening and multi-factor authentication for heightened security.
• Security Software: Use firewalls, file transfer protocols, and intrusion detection software. Encrypt valuable trade secrets and monitor employee computer and network access.
• Remote Work: Enforce office security standards for remote employees. Clearly communicate work-from-home policies and procedures, and consider requiring all employees to use company-owned devices and email accounts wherever they’re working.

Mark All Trade Secrets

Marking puts employees and others on notice that the information is a trade secret and is evidence that the company undertook reasonable efforts to protect it. However, initiating such a program and then failing to mark or doing so inconsistently may be cited by courts as a failure to take reasonable steps should trade secrets be misappropriated.

Have a Written Policy

Develop a written policy identifying what information the company considers a trade secret and how that information should be handled. Be as precise as possible about the use, sharing, and management of confidential, proprietary, and trade secret information.

Comprehensive and Ongoing Training

Provide periodic (at least annually) training to employees on information security, including identification and handling of the company's trade secrets. An employee's level of exposure to trade secrets should influence the degree of training and protection obligations imposed on them.

Require Confidentiality Agreements

Require employees to sign a confidentiality or non-disclosure agreement before providing access to any trade secrets. Such an agreement should specifically describe categories of proprietary information and trade secrets and include a covenant not to improperly access, use, disclose, or retain such information outside of or following employment.

Institute Onboarding and Offboarding Protocols

Consider establishing one or more of the following protocols for employee onboarding:

• Conduct due diligence and place new employees in low-risk areas if necessary.
• Avoid hiring multiple employees from the same company in a short time frame.
• Institute new hire training that reiterates the need to protect confidential information, including a former employer. Obtain signed certification of attendance.
• Advise employees not to discuss sensitive topics with new hires. Consider using external counsel to assess high-risk projects or establish a clean room.
• Periodically review employees’ email and computer activities using forensic searches to prevent contamination when necessary.

When offboarding or terminating employees, consider instituting procedures for at least some of the following:

• Exit interview reminding employees not to use or disclose company or third-party confidential information
• A follow-up letter reiterating obligations—consider sending a similar letter to the new employer
• Return of any trade secrets
• Disconnection of network, email, and voicemail access of departing employees
• Preserving forensic images of devices and accounts of departing employees with access to sensitive information

Act Quickly When Misappropriation Is Suspected

It's critical to act promptly when unauthorized disclosure of trade secrets is suspected, as a court could view any delay as a failure to take reasonable measures. The best course of action is to formulate a robust incident response plan that includes protocols for:

• Identifying the trade secret at issue
• Launching an immediate investigation into the facts
• Retaining counsel experienced in trade secret cases
• Determining whether it is appropriate to send a cease-and-desist letter, involve law enforcement, and/or promptly seek an ex parte temporary restraining order or seizure order

Takeaway

Protecting trade secrets in the life sciences sector demands an ongoing and multifaceted approach that addresses both internal and external threats. By implementing clear policies, rigorous training, robust security measures, and a comprehensive response plan, companies can significantly reduce the risk of misappropriation and effectively mitigate any damage in the event valuable proprietary information is somehow compromised.