Personal data vs. business information in the European Union: recent developments
These are busy times for the protection of personal and business data in the European Union (“EU”): on May 25, the General Data Protection Regulation 2016/679 (“GDPR”) will become applicable, while on June 9 all EU Member States should (in principle) have adopted legislation implementing the so-called Trade Secrets Directive 2016/943. Let’s have a look at how these two important pieces of EU legislation could be of relevance for US companies.
As to its territorial scope of application, the GDPR first of all provides that it applies to any processing of personal data that takes place in the context of the activities of a European establishment of a data controller or processor, regardless of whether the processing itself takes place in the EU. This entails that not only EU affiliates of US-based companies should be GDPR compliant, but also US companies themselves, insofar as they would have a branch or representation office in the EU and this ‘establishment’ creates a data flow to the US. In addition, the GDPR applies to the processing of personal data by a controller or processor without any EU establishment, where the processing activities relate to (1) the (active) offering of goods or services to individuals in the EU, or (2) the monitoring of individuals’ behavior in the EU. US companies operating a web shop targeting European customers or a mobile application tracking the behavior of EU individuals will thus also be caught by the GDPR, even if they have no establishment in Europe.
On the other side of the spectrum, companies often also own important (non-personal) sensitive business information or technical knowhow. US companies should therefore also be attentive to the Trade Secrets Directive, aiming at the protection of such confidential business or technical information. As the Trade Secrets Directive does not set any territorial restrictions, it can perfectly be used by US companies to act against misappropriation of their trade secrets in the EU. In order to succeed, US companies should of course make sure that what they call “trade secrets” effectively meets the following definition: “any information that is secret, has commercial value because it is secret and has been subject to reasonable steps to be kept secret”. Such ‘reasonable steps’ generally include signing NDAs and adequate confidentiality clauses with employees, consultants and any third party having access to confidential information, protecting such information with passwords and access control, etc. As the EU and the US (via the Defend Trade Secrets Act effective since May 11, 2016) have defined trade secrets in a similar manner, this should not be too much of a challenge for US companies.
In sum, we encourage you to be aware of how much the protection of personal data, on the one hand, and business data, on the other hand, is a hot topic at the EU level and could potentially serve your international business.
StéphanieDe SmedtSenior associate Attorney at Law
Stéphanie De Smedt is senior associate within the Litigation & Risk Management Practice Group of our Brussels office.
She is head of the IP/IT & Data Protection Team in Belgium and is team leader of the firm-wide Healthcare and Life Sciences Team.