Trade Secrets: Evolving Challenges and Responses

Trade secrets are vital in corporate IP. In a digital, AI-driven economy, the risk of theft rises, making them more vulnerable. While the advantage of confidential info stays, protection methods face pressure. Cyberattacks, AI data mining, and legal conflicts challenge trade secret security, prompting new protection approaches.

Trade secrets have evolved from internal security measures to a complex ecosystem involving cloud computing, global data flows, and AI analytics. AI models, trained on vast datasets, generate knowledge that blurs the line between raw data, protected trade secrets, and public info.

The borderless digital economy reshapes IP law, with trade secrets at its core. Regulatory trends reflect this change. Comparing approaches to defining and protecting trade secrets reveals the complexities and enforcement challenges in a data-shared, networked world.

What Trade Secrets Are Around The World

Trade secrets are confidential information, including technical details like manufacturing processes, chemical formulas, software, and commercial data such as marketing, customers, and finances. They must provide a competitive advantage by being undisclosed.

The international legal basis for protecting trade secrets is Article 39[2] of the Agreement on Trade-Related Aspects of Intellectual Property Rights (TRIPS). Under TRIPS, information qualifies as a trade secret if it is not widely known or easily accessible, has commercial value because of its secrecy, and is protected by reasonable security measures by its owner. This definition highlights the role of secrecy in preserving competitive advantage.

The US Restatement of Torts takes a similar approach, defining trade secrets as any formula, pattern, device, or compilation of information used in a business that gives an advantage over competitors who do not know or use it. The Uniform Trade Secrets Act (UTSA) also states that the information must have independent economic value because of its secrecy and be protected by reasonable efforts to keep it confidential. 

The EU’s Data Act reflects the conflict between the goals of the data economy and the need to safeguard trade secrets. While the Act aims to require access to valuable datasets, it must also respect the restrictive nature of trade secret laws.

In the United States, national trade secret law is anchored in the Defend Trade Secrets Act of 2016 (DTSA), which supplements the state-level protections established by the Uniform Trade Secrets Act (UTSA).

The DTSA broadly defines a trade secret as any form or type of financial, business, scientific, technical, economic, or engineering information, as long as the owner has taken reasonable steps to keep it confidential and the information holds independent economic value because it is not generally known or easily accessible by others.

This reflects core principles of US trade secret law: the lack of a registration requirement, the importance of active secrecy measures, and the legality of independent development and reverse engineering. US courts focus heavily on whether the plaintiff can show that the information was genuinely treated as a secret and that reasonable steps were taken to keep it confidential.

American law offers a framework for addressing trade secret misappropriation through tort and statutory methods. The UTSA defines misappropriation as the acquisition, use, or disclosure of a trade secret by improper means, such as theft, breach of confidence, or inducement.

India lacks a dedicated statutory framework. Trade secret protection arises through the common law doctrine of breach of confidence, contractual obligations, and judicial interpretation of Section 27 of the Indian Contract Act, 1872, which governs agreements in restraint of trade.

Indian courts apply a three-part test: the information must not be generally known, must have commercial value because it is secret, and must be subject to reasonable efforts to keep it confidential. Cases underscore the Indian judiciary’s willingness to enforce confidentiality obligations, particularly in employment contexts.

India’s reliance on judicial interpretation and contractual mechanisms creates holes in protection. There is no statutory recognition of misappropriation as a tort, nor is there a cohesive framework to guide judicial reasoning in trade secret disputes.

The EU

The EU has taken steps to harmonize trade secret protection through the Trade Secrets Directive(TSD). TSD Article 2 defines a trade secret as information that is not generally known or readily accessible; that has commercial value because it is secret; and that has been subject to reasonable steps to maintain its secrecy.

New Thinking

 The data economy has heightened the value and difficulty of protecting trade secrets. Automated systems and IoT devices generate vast data that businesses rely on for operations and product development. The EU’s Data Act requires access to certain data types, like raw IoT data, which conflicts with trade secret principles that depend on secrecy and security. While the Act attempts to differentiate raw data from protected information and calls for safeguards, defining clear boundaries is challenging in complex, layered data-sharing environments.

Beyond regulatory tensions, modern data-analytic technologies pose new trade secret risks. AI, data mining, and analytics can extract insights from datasets that resemble proprietary know-how, even if lawful. The digital environment has also expanded trade secret theft opportunities, with cyberattacks targeting confidential info, exposing algorithms, designs, and strategies. Attackers now use AI to automate phishing, find vulnerabilities, and develop targeted malware. Once inside, AI tools can swiftly locate and extract sensitive trade secrets.

The legal system struggles with these issues. Enforcing trade secrets requires tracing misappropriation, but cyberattacks, often anonymous or offshore, complicate attribution. Once confidential info leaks through dark web or databases, it loses secrecy. Even when perpetrators are identified, enforcement faces jurisdictional hurdles and rapid data spread online.

Integrated Strategies

Businesses must adopt a fundamentally more integrated approach to trade secret protection, combining legal, technical, and organizational measures within a dynamic, proactive framework.

• A crucial step is identifying and classifying trade secrets, as many organizations are unclear on what qualifies. Without this, it is impossible to protect or prove trade secret claims. Trade secret inventories and data mapping are vital for modern IP management.

• Access controls must be strictly enforced within corporate networks and with third parties. Sensitive information access should follow least privilege and need-to-know principles, especially with AI systems and large datasets. Encrypting data in transit and at rest is essential, supported by strong key management and access monitoring.

• Legal instruments are crucial. Update NDAs, data agreements, and confidentiality clauses to cover modern risks, including AI threats. Contract clauses should address reverse engineering, derivative data use, and managing AI training outputs from shared info.

• Employee training and awareness programs must evolve as well. Because insider threats are still a leading cause of trade secret loss, organizations should foster a culture that values privacy. This helps ensure that employees understand the importance of trade secrets and the additional risks associated with digital technologies.

• A strong incident response plan is important. It should include advanced detection tools, clear escalation procedures, and legal preparedness to handle breaches swiftly and in compliance with regulations. Counsel should be involved early to preserve privilege and navigate trade secret enforcement, data privacy laws, and regulatory reporting.