You are here:
07 May 2018 / article

Personal data vs. business information in the European Union: recent developments

These are busy times for the protection of personal and business data in the European Union (“EU”): on May 25, the General Data Protection Regulation 2016/679 (“GDPR”) will become applicable, while on June 9 all EU Member States should (in principle) have adopted legislation implementing the so-called Trade Secrets Directive 2016/943. Let’s have a look at how these two important pieces of EU legislation could be of relevance for US companies.

Personal data vs business information

As to its territorial scope of application, the GDPR first of all provides that it applies to any processing of personal data that takes place in the context of the activities of a European establishment of a data controller or processor, regardless of whether the processing itself takes place in the EU. This entails that not only EU affiliates of US-based companies should be GDPR compliant, but also US companies themselves, insofar as they would have a branch or representation office in the EU and this ‘establishment’ creates a data flow to the US. In addition, the GDPR applies to the processing of personal data by a controller or processor without any EU establishment, where the processing activities relate to (1) the (active) offering of goods or services to individuals in the EU, or (2) the monitoring of individuals’ behavior in the EU. US companies operating a web shop targeting European customers or a mobile application tracking the behavior of EU individuals will thus also be caught by the GDPR, even if they have no establishment in Europe.

On the other side of the spectrum, companies often also own important (non-personal) sensitive business information or technical knowhow. US companies should therefore also be attentive to the Trade Secrets Directive, aiming at the protection of such confidential business or technical information. As the Trade Secrets Directive does not set any territorial restrictions, it can perfectly be used by US companies to act against misappropriation of their trade secrets in the EU. In order to succeed, US companies should of course make sure that what they call “trade secrets” effectively meets the following definition: “any information that is secret, has commercial value because it is secret and has been subject to reasonable steps to be kept secret”. Such ‘reasonable steps’ generally include signing NDAs and adequate confidentiality clauses with employees, consultants and any third party having access to confidential information, protecting such information with passwords and access control, etc. As the EU and the US (via the Defend Trade Secrets Act effective since May 11, 2016) have defined trade secrets in a similar manner, this should not be too much of a challenge for US companies.

In sum, we encourage you to be aware of how much the protection of personal data, on the one hand, and business data, on the other hand, is a hot topic at the EU level and could potentially serve your international business.  



More clarity on the exemption of wage withholding tax for construction industry

More clarity on the exemption of wage withholding tax for construction industry

Since 1 January 2018 construction companies, that employ shift workers, can benefit from a substantial cut in payroll taxes. Recent legislation clarifies this... read more
Belgian notaries and digitisation: a (new) love affair

Belgian notaries and digitalisation: a (new) love affair

Digitalisation and innovation is all around us these days. This movement is also present in the real estate and Mergers and Acquisitions transaction process.... read more
Renaissance of the Belgian PPP market

Renaissance of the Belgian PPP market

Public-Private Partnerships (PPPs) had traditionally been a favorite way of financing large infrastructure projects in Belgium. However, the model went through... read more
Stay informed

Don't miss out. Stay up to date about our latest news and events.

Stay informed