According to estimates, in 2018 the average business user sent and received 140 emails per day, a figure that is projected to grow significantly in coming years. On top of that, more business e-mail is done on mobile devices, which unfortunately means less attention to detail. As a result, we have seen increased incidence of company employees inadvertently sending sensitive corporate information to unintended recipients. And the risk emanates not only from your company's employees, but also the employees of any vendors who have access to your trade secrets. Fortunately, inadvertent disclosure of a trade secret does not mean that all is lost, provided that prompt and definitive action is taken.

Putting the Horse Back in the Barn

When it comes to the inadvertent disclosure of trade secrets, it can be possible to “put the horse back in the barn,” but notice of the disclosure must be given to the unintended recipient as soon as possible. Both the Uniform Trade Secret Act and the federal Defend Trade Secrets Act impose liability on those who use or disclose a trade secret with actual or constructive knowledge that it was “acquired by accident or mistake,” provided that such knowledge arose “before a material change of … position” by that person. Put another way, if the unintended recipient of a trade secret uses or discloses it without actual or constructive knowledge, no liability will exist. As a result, it is imperative that notice be given to the recipient promptly after learning of the inadvertent disclosure. Doing so will both 1) impose liability on the inadvertent recipient if they make use of disclosure, and 2) increase the odds that trade secret status is not lost. See e.g. Ideal Aerosmith, Inc. v. Acutronic USA, Inc., 2007 WL 4394447 at *8 (E.D.Pa. Dec. 13, 2007) (permitting trade secret claim to proceed against defendant that acquired trade secrets by mistake); Fireworks Spectacular, Inc. v. Premier Pyrotechnics, Inc., 107 F. Supp. 2d 1307, 1310–11 (D. Kan. 2000) (holding that trade secret status was not lost where recipients of inadvertent disclosure were given prompt notice).

Every state except New York and New Jersey has adopted language identical or similar to the “accident or mistake” language of the UTSA. New York lacks a trade secret statute altogether and instead relies on common law; as a result, courts applying New York law have been less forgiving to inadvertent disclosures. See e.g. Defiance Button Mach. Co. v. C & C Metal Prod. Corp., 759 F.2d 1053, 1063 (2d Cir. 1985) (“upon disclosure, even if inadvertent or accidental, the information ceases to be a trade secret and will no longer be protected”). New Jersey adopted the UTSA in 2011 but specifically rejected the “accident or mistake” language. N.J. Stat. Ann. § 56:15-2. But even in matters where the laws of New York or New Jersey may apply, counsel can rely upon the DTSA as long as the trade secret is “related to a product or service used in or intended for us in interstate or foreign commerce.” 18 U.S.C. § 1832(a).

In addition to giving the recipient notice, the recipient should also be asked to identify:

1. Every instance of further dissemination of the trade secret beyond the original communication (i.e., who else received the e-mail and when);
2. Every location where the trade secret may be stored (i.e., computers, mobile devices, servers); and
3. All other copies of it that may have been made.

Once these disclosures are made, the recipient should also be asked to certify return or destruction of the trade secret, and any individuals who came into possession of it should certify that they are no longer in such possession and that they further agree not to use or disclose any information embodied within the trade secret. However, before any agreed-upon destruction occurs, the trade secret owner should obtain copies of all identified copies and disseminations of the trade secret so that they may be preserved in the event of subsequent litigation. If a party that inadvertently receives a trade secret is unwilling to take these steps, the broad injunctive relief provisions of both the UTSA and the DTSA should be taken advantage of.

Re-examining Controls

An inadvertent disclosure raises a bigger risk than simply what the recipient may do with the trade secret: the risk that the trade secret loses its status as a trade secret altogether. By definition, information is only entitled to trade secret protection if it is “the subject of efforts that are reasonable under the circumstances to maintain its secrecy.” An inadvertent disclosure could be symptomatic of a failure to take such reasonable efforts. As a result, all companies—but especially those that suffer an inadvertent disclosure—should closely examine their controls. Among other protections, trade secrets should be identified and catalogued by location and individuals with access, which should be limited to those whose duties actually require access. Files containing trade secret information should be password protected, as should any machines used to access them. And employees should be instructed not to transmit passwords in any communications that also transmit trade secrets.

Stephen M. Vaughn is a partner in the Commercial Litigation and Intellectual Property Litigation Groups of Morris, Manning & Martin LLP's Atlanta office.