How to safeguard proprietary data from competitors.

HOW TO SAFEGUARD PROPRIETARY DATA FROM COMPETITORS

One of the most common and troublesome problems large and small organizations face is protecting proprietary data-such as financial information, customer lists and marketing and expansion plans-from competitors or others with prying eyes. August Bequai, JD, LLM, is a lawyer in private practice, specializing in industry security law, in McLean, Virginia. He lists the steps necessary to ensure data protection.

Prevention is the best protection when it comes to safeguarding proprietary data. Although lawyers frequently say patents and copyrights are adequate to prevent a competitor from usurping data, experience proves otherwise. In more than half the cases in which trade-secret lawsuits were filed, the court ruled against the organization or person seeking protection. In fact, 90% of the cases involving patents-which are the most difficult trade-secret protections to get initially-are overturned by the courts.

Clearly, an organization should not rely on patents or copyrights alone when seeking data protection.

Here are some important advisories for protecting data from unauthorized users.

THE DATA

* Precise definition. Management often defines proprietary data incorrectly-either by omitting details on the data package itself or in any literature about the data or by failing to provide complete information to those who have access to it. For example, property definitions may be too broad, making ownership claims unenforceable-or too narrow-and therefore useless.

* Litmus test. At least two criteria have to be met before a proprietary claim is effective. The owner must be able to prove the information is not already generally known and the information is of value.

It's not enough that the owner considers the data valuable or not generally known; it must be provable. One way is to be able to show the data give the owner an advantage over competitors.

The owner also must prove it used its own labor and resources to develop the data and then treated the information as classified. Defining and limiting access helps establish evidence of confidentiality.

* Ownership definition. Management should clearly state its ownership-both on the data and to those with access to it. For example, employees, consultants and customers should be told that the company owns the data and is prepared to enforce its rights.

Not all data, however, can be kept secret. A proprietary interest in data supporting an illegal activity, such as restraint of trade, is not enforceable.

EMPLOYEE SECURITY

* Screening programs. Because insiders pose the greatest security threat, a screening program should be established for all employees who will handle sensitive data.

n Security awareness. Employment policies and procedures should include a statement on data security. This notifies employees that data security is taken seriously.

* Noncompete agreements. Employees should be required to sign noncomplete contracts. Such a contract makes it clear that a departing employee can't take secret information collected on his old job and use it in a new job with a competitor.

Agreements should limit, for a set period, the places a departing employee cannot work. However, to hold up in court, the limitations must be reasonable and justified.

* Nondisclosure agreements. All employees with access to proprietary data should be required to sign a nondisclosure agreement. Such agreements have both legal and psychological value, especially when used with noncompete agreements.

* Nondiscrimination. In applying security measures, management should avoid focusing on individuals or groups solely because of sex, religion or nationality. For example, the U.S. Immigration Reform and Control Act of 1986 prohibits asking only foreign workers to sign confidentiality agreements. Also, other civil rights laws bar discrimination against other groups of employees.

OTHER DEFENSES

* Security upgrades. Management should periodically review and upgrade its data security programs, identifying and addressing weaknesses as soon as possible.

* Monitoring competitors. At the first sign a competitor is using a company's data, the violated company should notify the transgressor of impending action. Wise companies have reputations for enforcing their rights; such vigilance usually forestalls violations.

* Security-violation documentation. As a matter of policy, management should document any breach of data security. The time, date, location, data type and suspect's name should be recorded. Such documentation will be valuable in both disciplinary action and criminal or civil prosecution.

LEGAL LIMITATIONS

* Lawful measures. Safeguard methods should conform with federal, state and local laws. For example, some states regulate screening techniques such as honesty tests and lie-detector examinations. If an organization is a federal contractor, it must be sure its security programs are in accord with applicable laws.

* Transborder considerations. If a company transmits its data outside the United States, management must be alert to the receiving country's transborder trade-secret laws. For example, the United Kingdom has stringent data registration laws, and France and Belgium limit access to data stored in those nations.

While these steps are helpful, all these efforts can come to naught if an organization fails to maintain vigilance in guarding its data.

EXECUTIVE SUMMARY

* ORGANIZATIONS should not rely on legal techniques alone when seeking data protection.

TO QUALIFY for protection, owners of data must be able to prove the information is not common knowledge and is of v

* MANAGEMENT should make clear statements that its data are proprietary. Allusions to ownership are not enough.

* BECAUSE insiders pose the greatest security threat, employee policies, including statements on data security, noncompete agreements and nondisclosure agreements, are essential.

DEFENSIVE measures, such as security upgrades, monitoring competitors and security-violation documentation, also deter violations.

* MANAGEMENT should be aware of federal, state and local legal limitations of using safeguards such as lie-detector tests. International regulations also may differ from those of the United States.