#6 Decoding the Data Act

Today, it's time for the sixth post in the #Decoding the Data Act series. We will take a closer look at the protection of trade secrets and indicate what solutions you can implement in this area as a data holder.

Does the data holder have to disclose Data that contains trade secrets?

As a general rule, a data holder cannot refuse to disclose Data solely on the grounds that some of the Data to be disclosed constitutes its trade secrets (remember that: Data constituting trade secrets is data that is not disclosed to the public, has economic value and the data holder takes measures to keep it confidential).

The data holder has the right to protect such data and, in certain situations, to refuse or suspend the disclosure of such information.

How can the data holder protect its trade secrets?

The data holder has the right to require the user and recipient to implement specific organisational and legal safeguards, e.g.:

• non-disclosure agreements (NDAs),
• strict access protocols,
• the use of specific technical standards, or
• the use of codes of conduct.

Important!

For the protection to apply, remember to specify in the data sharing Agreement which specific Data will contain trade secrets. Additionally, information on whether trade secrets can be generated must be provided before an agreement for related services is concluded.

For greater certainty, it is also worth considering including in the agreement with the user the right to audit, with the participation of independent third parties, to verify that the user has implemented the necessary measures to ensure the confidentiality of Data that contains the data holder's trade secrets.

When can the data holder refuse to disclose Data that contains trade secrets?

The Act introduces an additional layer of protection, the so-called "trade secret handbrake", which specifies the conditions under which the data holder may withhold or suspend the disclosure of Data (if the agreement has already been concluded). This is permissible when:

• no agreement has been reached on the necessary technical measures,
• the user fails to implement the agreed safeguards, or
• the disclosure threatens to breach the confidentiality of trade secrets.

Please note that if a request for access to data is forwarded to the data holder but no agreement has yet been concluded, the data holder may refuse to disclose the data in individual cases where, despite the technical and organisational measures taken by the data user or recipient, the disclosure of trade secrets would cause serious economic damage.

In such cases, the data holder must duly justify their decision, communicate it in writing and notify the competent authority of their decision. Data that is not protected by trade secrets should be provided in accordance with the request.

What rights does the data holder have if trade secrets are breached?

It should also be noted that Article 11 of the Act provides that the data holder may use appropriate technical protection measures, such as smart contracts and encryption, to prevent unauthorised access to the Data (including metadata) and to ensure compliance with the provisions of the Act and the contractual provisions on data sharing.

However, these measures must not discriminate against data recipients or restrict the user's rights to obtain copies, download, use or transfer data to third parties in accordance with Article 5 of the Act. Users, third parties and data recipients may not alter or remove these protection measures without the consent of the data holder.

In the event of a breach (e.g. obtaining Data by deception, using it for unauthorised purposes, unlawful disclosure of Data, breach of agreed technical or organisational measures), the data holder (and, where applicable, the holder of the trade secret or the user) may request the third party or data recipient to:

• to delete the Data and any copies thereof,
• to cease the production, offering or use of goods, services or data resulting from the unauthorised use,
• inform the user of the breach and of the remedial measures taken,
• provide compensation for the damage suffered.

The above consequences, in particular the deletion of Data and the cessation of production, may be particularly serious for a third party or data recipient in connection with their business activities.

What rights does the user have if access to Data constituting trade secrets is unjustifiably refused?

A user whose rights have been infringed has the right to lodge a complaint with the competent authority designated by the Member State (data coordinator), which shall decide whether and on what conditions data sharing should commence, be resumed or agree with the data holder to refer the matter to the dispute resolution body in accordance with Article 10(1) of the Act (Article 4(9) of the Act). In such a situation, the dispute resolution body shall settle the dispute between the data holder and the user. The same rights shall be granted to third parties (Article 5(12) of the Act).

Breaches of the obligations laid down in the Act are subject to penalties - Member States are required to establish effective, proportionate and dissuasive penalties, which may include fines, warnings, reprimands or orders to adapt business practices. When determining the amount of the penalty, the nature, gravity and duration of the infringement, as well as corrective measures and previous infringements, shall be taken into account (Article 40 of the Act).

In the next post in the Decoding the Act on Data series, we will address issues related to the rights and obligations of data users. Stay tuned!