One often-overlooked requirement has the potential to make or break a trade secret misappropriation claim: the trade secret owner must have taken “reasonable measures” to protect the trade secret; otherwise the information does not qualify as trade secret under the Federal Defend Trade Secrets Act (“DTSA”) or the Uniform Trade Secrets Act (“UTSA”).  But the statute does not provide what protective measures are sufficiently reasonable, so that determination largely depends on each case’s facts and circumstances. This article examines recent case law surrounding what measures courts have found to be “reasonable” under the circumstances (and which ones courts have found were not “reasonable” under the circumstances).

The federal government, 49 states,¹ and the District of Columbia have all enacted versions of the UTSA, which sets forth the general statutory requirements for a trade secret. See, e.g., 18 U.S.C. § 1836; Tex. Bus. & Comm. Code § 134A. The UTSA requires that a trade secret owner take reasonable efforts under the circumstances to protect a trade secret.  See UTSA § 1(4)(ii) (defining a “trade secret” as “information … that (i) derives independent economic value … from not being generally known to, and not being readily ascertainable by proper means by, other persons who can obtain economic value from its disclosure or use, and (ii) is the subject of efforts that are reasonable under the circumstances to maintain its secrecy.”) (emphasis added).  In the comments to this provision, the UTSA drafters explain that “reasonable efforts to maintain secrecy” may include advising employees of the existence of a trade secret or limiting access to a trade secret on a “need to know basis.” Id. On the other hand, an employer’s public disclosure of information or other carelessness with the information can preclude protection of that information as a trade secret. Id. Because reasonable measures is not explicitly defined, determining whether a trade secret plaintiff has taken reasonable measures to protect the alleged trade secret is a fact-specific inquiry dependent on the facts of each case; examination of recent decisions provides guidance for both trade secret owners and defendants in trade secret misappropriation lawsuits.

Cases Finding Protective Measures were Sufficiently Reasonable

Hagler Sys., Inc. v. Hagler Group Global

The Southern District of Georgia recently granted a preliminary injunction, finding that the plaintiff had taken reasonable measures to protect the alleged trade secrets under the Federal Defend Trade Secrets Act (“DTSA”). Hagler Sys., Inc. v. Hagler Group Global, CV 120-026, 2020 WL 2042484, at *2, *11-12 (S.D. Ga. April 28, 2020).  Measures that the court found persuasive included:

• The Plaintiff had labeled many of the alleged trade secret engineering files as “PROPRIETARY AND CONFIDENTIAL.”
• The files were only accessible through a private database software, which was only accessible by employees with login credentials. Id. at *12.
• Remote access to the files was only available through a virtual private network, which required additional credentials. Id.
• Defendant was a former employee who did not have access to the alleged trade secrets when he obtained them—the defendant ultimately had to recruit a third-party to gain access to the information. Id.
• Externally, the plaintiff’s “confidential information [was] only shared with customers after management approval and only to vendors pursuant to nondisclosure agreements.” Id.
• The Plaintiff utilized external security measures, including limiting access to the facilities to employees with RFID tags and security cameras on the buildings. Id.
  The court found these internal and external protections were sufficient to demonstrate that the plaintiff had taken reasonable measures to protect its trade secrets.

 Cutera, Inc. v. Lutronic Aesthetics, Inc.

• In another suit brought under both the California UTSA and the DTSA, the court granted a temporary restraining order, finding the information was likely the subject of reasonable efforts to maintain the information’s secrecy. Cutera, Inc. v. Lutronic Aesthetics, Inc., 444 F.Supp.3d 1198, 1206-7 (E.D. Cal. March 13, 2020). In this case, the court found that the plaintiff, a medical device company that marketed and sold laser systems, took reasonable measures to protect its trade secrets where the company:

• required all employees to sign a confidentiality agreement, which explicitly required employees to keep information including “customer lists” and “marketing, financial or other business information disclosed...by the company” confidential.” Id. at 1206-7.
• provided an employee handbook which required employees to maintain the confidentiality of its “strategy, customers,...[and] financial information;” and
• submitted a declaration stating that its employees are only provided with access to confidential information on a “need to know” basis. Id.

Reasonable Measures were Insufficient

Yellowfin Yachts, Inc. v. Barker Boatworks LLC
A recent 11^th Circuit case is instructive regarding what measures courts have found did not constitute “reasonable” to protect trade secrets. In Yellowfin Yachts, Inc. v. Barker Boatworks LLC, the appellate court affirmed a Florida district court’s summary judgment decision that that no reasonable jury could find that the information was the subject of reasonable efforts to maintain secrecy, reasoning that:

• the defendant “refused to sign an employment agreement which stated that he would… keep all [plaintiff] trade secrets in confidence.” 898 F.3d 1279, 1300 (11th Cir. 2018).
• despite this refusal, plaintiff still gave the defendant access to the information and even “encouraged [the defendant] to store [the] information on a personal laptop and phone” and did not instruct the defendant to secure the information on his personal devices;
• plaintiff failed to mark the information as confidential; and
• plaintiff “never asked [him] to delete the information from his personal devices after he left the company.” Id. at 1299-1301.

As such, the 11^th Circuit held that “Yellowfin effectively abandoned all oversight in the security of the Customer Information.” Id. at 1301.

RV Horizons, Inc. v. Smith
In RV Horizons, Inc. v. Smith, the court granted summary judgment that the plaintiff had not taken reasonable measures to protect its investor lists, which it alleged it maintained with the “utmost secrecy.” Civ. A. No. 18-cv-02780-NYW, 2020 WL 6701119, at *26-27 (D. Colo. Nov. 13, 2020). The plaintiff argued that it had taken reasonable measures because the investor lists were stored in a special software database, which was password protected, and access was provided only to a limited number of individuals on an as-needed basis. Id. at *26. The court disagreed, reasoning that:

• the plaintiff did not provide any specific evidence regarding “the limited number of individuals” who have access to the software account today or historically;
• there was no evidence that the investor lists were segregated in the software account from other materials that were freely shared;
• plaintiff did not present any evidence of any type of confidentiality agreement, handbook, or training regarding the access to or use of investor lists or the software account; and
• there was no evidence that any representative of the plaintiff ever informed the defendants that the investor lists were trade secrets. Id.²

As such, the court concluded that “no reasonable jury could find that the Trade Secret Plaintiffs employed reasonable efforts to secure the information.” Id. at *27.

BCOWW Holdings, LLC v. Collins
Finally, in another TUTSA case, the Western District of Texas denied a preliminary injunction in part because the plaintiff had not taken reasonable measures to protect its trade secrets related to the “design, pricing, or strategy for the development of its maple-leaf waffle maker.” BCOWW Holdings, LLC v. Collins, SA–17–CA–00379–FB, 2017 WL 3868184, at *15-16 (W.D. Tex. Sept. 5, 2017). The plaintiff shared the information with its vendors, but

• did not require its vendors to sign confidentiality or exclusivity agreements;
• regularly transmitted files to these vendors via unsecured e-mails;
• did not mark any of these documents as confidential or restrict its vendors’ storage or use of the information; and
• there was no evidence that plaintiff “even verbally imparted (or even internally discussed) the need for these vendors to maintain the secrecy of its information.” Id. at *16.³

The plaintiff pointed to several unexecuted employment agreements and two unrelated non-disclosure agreements; the court reasoned that these unrelated agreements demonstrated that plaintiff “had the knowhow and sophistication to require non-disclosure agreements under certain circumstances it believed were appropriate” and stated the fact that plaintiff “did not also require vendors…to sign confidentiality agreements strongly suggests that it did not regard this information as secret.” Id. Because the plaintiff had not taken reasonable measures to protect its alleged trade secrets, the court denied the preliminary injunction.

Real World Application
As the above cases show, a company is more likely to demonstrate reasonable measures when it can clearly demonstrate efforts to adopt such protective measures specific to the alleged trade secrets, and, importantly, communicate such efforts and the trade secret nature of the information to employees. Indeed, companies that give employees access to proprietary information that the company intends to keep secret should expressly communicate such intentions to the employees. Courts have recognized company efforts to communicate confidentiality policies as reasonable measures, including in an employee handbook or oral communication. Trade secrets owners should also consider marking documents reflecting the trade secrets as “Confidential” or “Proprietary,” both internally and externally where necessary.

An effective strategy for satisfying the reasonable measures requirement should include both internal and external adoption of confidentiality-centered business practices. Internally, companies should consider using restrictive covenants with their employees to protect trade secret information, including covenants to not compete, non-disclosure agreements, and/or confidentiality agreements. In the event that an employee refuses to sign such agreements, the company should take steps to restrict that employee’s access to the information, including temporarily or permanently re-assigning the employee and tracking the employee’s use of the proprietary information. Companies who want to protect trade secrets should also consider:

• restricting access to trade secrets by password-protecting proprietary information;
• utilizing specialized software to store the trade secret information;
• limiting the ability of employees to take the trade secret information off premises or onto personal devices;
• disclosing the trade secret information only to employees who need to know the information to perform their duties; and
• securing physical access to the information, including the use of badges, sign-out procedures, video surveillance, and/or security officers.

Externally, trade secret owners should not disclose the trade secret information outside of the company to vendors, suppliers, or customers without the use of a non-disclosure or confidentiality agreement which specifically requires the third-party to protect the secrecy of the information. Failure to secure confidentiality from a third-party will weigh heavily against reasonable measures.

As shown in the case law, these restrictions to information access are probative of reasonable measures taken to protect alleged trade secrets, but might not individually satisfy the reasonable measures requirement.

Defendants accused of misappropriation, on the other hand, should probe in discovery for a specific identification of the trade secrets and the explicit measures that were taken to protect the secrecy of that information. Defendants may want to obtain the following information to establish whether a plaintiff has taken reasonable measures to protect its trade secrets:

• the number of employees who had access to the information as compared to the total employee count;
• the number of employees who actually utilized the information for their job responsibilities;
• whether employees were able to utilize their own personal devices to access the information;
• whether the plaintiff ever communicated that the information was a trade secret to employees;
• any employee handbooks or policies communicated to employees;
• the physical security measures on plaintiff’s premises;
• whether the information is password protected;
• the number of employees who have and have not signed confidentiality agreements;
• any third-parties that had access to the information and whether the third party was subject to a confidentiality agreement; and
• information on any prior lawsuits or disputes related to the trade secret information or former employees.

Conclusion

Recent case law demonstrates that the reasonable measures requirement can be a very important consideration in trade secret misappropriation cases for both plaintiffs and defendants. Baker Botts will continue to monitor the case law for developments related to “reasonable measures”  and will provide periodic updates as they become available.

ABOUT BAKER BOTTS L.L.P.
Baker Botts is an international law firm whose lawyers practice throughout a network of offices around the globe. Based on our experience and knowledge of our clients' industries, we are recognized as a leading firm in the energy, technology and life sciences sectors. Since 1840, we have provided creative and effective legal solutions for our clients while demonstrating an unrelenting commitment to excellence. For more information, please visit bakerbotts.com.