COVID-19 has changed the nature of the workplace as many employers now operate with a significant remote workforce—and may continue to do so for the foreseeable future. Coupled with the exponential increase in the number of videoconferences and remote log-ins, the danger of the loss of confidential information and trade secrets is more acute than ever. Further, in regulated industries such as securities or health care, the loss of data is more likely to result in government investigations as well as class action lawsuits.
Under the federal Defend Trade Secrets Act (DTSA) as well as the trade secret laws of most states, employers must make reasonable efforts under the circumstances to maintain the secrecy of their trade secret information—otherwise, the information may lose trade secret status. While courts engage in a fact-specific analysis to determine if an employer has taken such reasonable measures, below is a list of non-exhaustive steps that businesses should consider taking to protect their trade secret or confidential information.
- Ensure robust security measures. If feasible, require employees to use company-issued computers and equipment, and utilize protections such as encryption, two-factor authentication, endpoint protection, and/or VPNs (virtual private networks). Absent such firewalls, hackers are far more likely to be able to invade a virtual workspace and steal confidential information and trade secrets. VPNs, in particular, are critical. A VPN creates a private network across a public network and enables employees to send and receive data across shared or public networks privately. Even better, a VPN network can, and should, be encrypted. Likewise, employees should be advised to avoid public Wi-Fi in favor of a secure personal hotspot to help mitigate risks.
- Update data policies. Companies should update their policies and procedures regarding the access and use of confidential and proprietary information, provide clear guidance (and, if necessary, retraining) to employees regarding these policies, and make sure employees acknowledge and agree to these policies in writing. In many courts, the existence of a policy is an important factor in evaluating whether an employer’s measures are reasonable.
- Limit access to confidential information. Employers should limit access to sensitive information to employees on a need-to-know basis. Employers should also consider implementing procedures limiting the copying or printing of such materials outside of the office.
- Take stock of information. Companies should inventory and classify information as trade secret or proprietary where appropriate. Doing so will help companies determine which information is most mission-critical and develop stronger protections for it. Counsel can help orchestrate this process and assist companies in understanding what information may be classified.
- Implement off-boarding protocols. If employees are laid off or furloughed, terminate their access to the company network immediately. Ensure that departing employees return all company property and devices and remind them of continuing obligations not to disclose confidential information.
In light of the unique challenges that a remote workforce presents, employers should assess their existing protections and consider what, if any, additional steps they should take to help protect their confidential and trade secret information. Such steps will continue to serve businesses well even after the worst of COVID-19 has passed. Experienced counsel, who are part of Nixon Peabody’s Noncompete and Trade Secrets team, are available to assist you in this analysis.
The foregoing has been prepared for the general information of clients and friends of the firm. It is not meant to provide legal advice with respect to any specific matter and should not be acted upon without professional counsel. If you have any questions or require any further information regarding these or other related matters, please contact your regular Nixon Peabody LLP representative. This material may be considered advertising under certain rules of professional conduct.
