Legal protection of trade secrets underboth the Uniform Trade Secrets Act (UTSA) and the federal Defenseof Trade Secrets Act (DTSA) depends on whether a company has taken"reasonable measures" to safeguard the secrecy of the information.Many companies satisfy this obligation by implementing policiesthat control access to the systems where sensitive information isused and stored, and by initiating IT security measures.

With millions of American workers hastily shifting to aremote-work arrangement during the Covid-19 pandemic, employers must be mindful ofthe risks to proprietary information presented by this changed workenvironment. They can take several steps to safeguard theirdata:

Revisit policies.  Policiesand protocols that were drafted premised on restricted use of tradesecret information on the employer's premises will need to bereviewed and revised. Without revisions, an employer could beperceived to be negligent or selective in its enforcement ofsafeguards.

If employees are being permitted to perform work from personalcomputers, or if firewalls have been disabled to permit remotework, employers should consider prohibiting the sending or storingof confidential company information on personal emailaccounts, portable storage devices, or personal cloud accounts.

Guard the home office. Remind the workforce that their contractual obligation to ensurethat confidential information remains confidential applies equallyat their remote worksite. Employers may want to provide employeeswith guidance or directives about where work involving trade-secretinformation can be performed. Depending on the sensitivity of theinformation, employers could require all work to be done in a roomto which only the employee has access or that all information belocked away.

With the new popularity of videoconference meetings, employeesshould be mindful of trade-secret information in the backgroundthat may be visible to outsiders. This risk is amplified if aspouse or partner also shares the workspace and is not aware ofwhat is or is not considered to be confidential. Employers mightalso recommend that hard copies of documents that employees takehome or print while at home be shredded or disposed of properlywhen the employee returns to office.

Be mindful of departingemployees.  Traditionally, a largeproportion of trade secret misappropriation involves departingemployees taking proprietary information with them. The exitinterview for a departing employee is the best opportunity torecover all company property, to remind the employee of theirongoing confidentiality and other contractual obligations, and toensure that the employee has taken adequate steps to search for andreturn all company information in their possession.

With the large increase in the number of employees beingfurloughed or laid off in the weeks following the enactment of thestay-at-home orders, exit interviews were excused in some cases, orbecame cursory. The challenges of terminating an employee who isremote, including the return of company property, must be fullyconsidered. While laptops can be shipped back, it is critical totake steps to ensure that the employee has returned or destroyedhard copies of materials and has searched for deleted confidentialinformation on personal devices or in cloud-storage accounts.

In this chaotic environment, employers may forget to disable theworkers' access to company systems, shared drives, or outsideaccount access to databases such as Salesforce.

Work with IT to strengthensafeguards.  It has been reported widelythat phishing and related cyberattacks increased when theremote-work arrangements commenced. With the assistance of ITprofessionals, companies may wish to implement additional protocolsto ensure that trade secret information is not unwittinglycompromised:

• Changing settings of company-issued or personal computers tolock the screen after a short period of non-use.
• Requiring all work to be done on the company's secured network,such as via VPN.
• Requiring employees to password-protect their home Wi-Fisystem.
• Prohibiting transmission of confidential or trade-secretinformation, and instead using shared drives or cloud accounts thatthe employer sets up, with access rights limited to aneed-to-access basis.
• Increasing training and reminders to employees about maliciousemails and other security-compromising tactics.
• Implementing remote lockout and wipe capabilities to companydevices, should they be misplaced or stolen.

Each company must assess what practices suggested above are"reasonable under the circumstances" to maintain the integrity ofits trade secrets, taking into account how work is performed. Thereare some suggestions that might be stifling to productivity, whileothers may be cost-prohibitive. What may be reasonable to onebusiness may not be reasonable for another. Instead, therecommendation is to think about many of the safeguards that are inplace at the office and how the remote work environment hasrendered those safeguards less effective.

Even in jurisdictions that are reopening, employers shouldconsider the issues presented above and formulate a plan to ensurethat confidential information and materials follow the employeesfrom home back into the office.

See also:

• Impostor Fraud: A Cyber Risk ManagementChallenge
• Managing Risk in the Cloud: A Guide for CorporateTreasurers
• Arming Corporate Treasurers for CybercrimeCombat
• Who's Legally Liable for a Risk ManagementFailure?

Koray Bulut is a partner in the employmentgroup at Goodwin who focuses his practice on employment law,with an emphasis on litigation matters.

From: BenefitsPro