"If you want to keep a secret, you must also hide it from yourself." ― George Orwell, 1984

The first ever Trade Secret Protection Act (the "Act") in Bulgaria came into force in April 2019 implementing Directive (EU) 2016/943 on the protection of undisclosed know-how and business information (trade secrets) against their unlawful acquisition, use and disclosure. Businesses wishing to enjoy the protections of the new Act may need to take immediate steps to better protect their trade secrets.

Under the statutory definition of trade secret, the person in control of the information is required to have taken measures to protect it; otherwise, the relevant information will not qualify as a "trade secret". However, as the Act does not define the standard applicable to such measures, elaboration by the courts is awaited. Different standards will likely be applied to different types of information and businesses. Following the recent leaks of data worldwide it is difficult to imagine what cybersecurity standard would be considered sufficient.

This unpredictability can be counteracted by well-drafted confidentiality undertakings in contractual arrangements. These may include confidentiality clauses in contracts with employees, external business partners, contractors and consultants, non-disclosure agreements in the course of transactions, internal "secrecy" rules identifying, categorising and labelling trade secrets and outlining the procedures to protect them, internal information security training, information barriers and restrictions on access rights, monitoring of leaks and an incident response plan for data breaches. Buyers in M&A deals should start requesting the above information in due diligence reviews and may also demand specific representations and warranties requiring the seller to confirm that it has taken adequate measures to protect its trade secrets. The seller also may be obliged to implement specific confidentiality procedures concerning trade secrets pre-closing.

The Act applies to non-disclosure agreements executed as a standard practice at the outset of M&A transactions even if there is no reference to it. We expect to see more elaborate non-disclosure agreements defining what information would be considered confidential in the relevant transaction in more detail. It is likely that red file data rooms, but also physical data rooms or lawyer-to-lawyer disclosure will be used more often to demonstrate that measures have been taken to protect trade secrets when disclosing information. These can include maintaining a list of people with access, signed (individual) confidentiality undertakings and prohibiting printing or copying.

What is protected?

A trade secret is any commercial information, know-how and technological information which:

1. is secret, i.e. not generally known to or easily accessible by persons who commonly use this type of information; and
2. has commercial value because of its secret nature; and
3. the person lawfully in control of has taken measures to keep secret.

A trade secret holder is any person lawfully controlling a trade secret.

The subject of infringement may be goods and services where the design, characteristics, operation, production process, manner of marketing or sale are substantially influenced by trade secrets that have been unlawfully acquired, used or disclosed.

Infringements

An infringer is any person who has unlawfully acquired, used or disclosed a trade secret.

A trade secret can be lawfully acquired through independent discovery or creation; (lawful) observation, study, disassembly or testing of a product, by (voluntary) disclosure, or by contract, etc.

The following are generally unlawful:

1. The acquisition of a trade secret without the trade secret holder's consent, if obtained through unauthorised access to, misappropriation or copying of documents, objects, materials, substances or electronic files which are lawfully under the control of the trade secret holder and contain the trade secret or from which the trade secret can be deduced.
2. The use or disclosure of a trade secret without the trade secret holder's consent, if carried out by a person who (i) has acquired the trade secret unlawfully, (ii) has been in breach of a confidentiality agreement or other duty not to disclose the trade secret, or (iii) has been in breach of a duty to limit the use of the trade secret.
3. The acquisition, use or disclosure of a trade secret, if at the time the person knew or ought to have known that the trade secret had been obtained from another person who was using or disclosing the trade secret unlawfully.

The Act provides for exceptions when the acquisition, use or disclosure of a trade secret is not unlawful, e.g. when exercising the right to freedom of expression or for the detection of crimes.

Sanctions

Under the Act, in addition to any proceeding before or any fine imposed by the Bulgarian Commission for the Protection of Competition, a civil court claim may be filed to:

1. rule on the existence of an infringement;
2. order the termination or prohibition of such infringement;
3. prohibit the production, marketing or use of infringing goods or the import, export or storage of such goods;
4. prohibit the provision of infringing services; and
5. order the destruction/return of documents/devices containing trade secrets.

The court will consider the trade secret's value, the measures taken by the lawful trade secret holder to protect it, the infringer's conduct, and the impact of the unlawful use or disclosure of the trade secret. The Act's specific rules for calculating damages assess not only the direct loss and loss of profit, but also the profit made by the infringer and the non-pecuniary damages suffered by the trade secret holder. A five-year limitation period applies.