Beyond the Non-Disclosure Agreement: How to Protect Your Company’s Confidential Information

My colleague Brent Haden recently posted an insightful article about non-competition covenants. As he noted, such covenants, when properly drafted, can be enforceable.  However, many courts subject non-competes to intense scrutiny because of their effect on competition and limitation on the ability of workers to obtain employment.  Some states, such as California and Washington, have even gone as far as to refuse to enforce any non-competition agreement.  As a result, many employers are turning to confidentiality or non-disclosure agreements (“NDA”) as a way to protect their proprietary information.  These protections have become particularly important as data has become more easily transferable.

Like non-competition agreements, NDAs are restrictive covenants and the restraint they place on the employee must be no greater than necessary to protect the employer’s legitimate business interest.  In other words, to be enforceable the NDA should only cover information that should be kept confidential, such as trade secrets. Unlike non-competition agreements, the Virginia Supreme Court has not taken up the specific issues governing enforceability of non-disclosure agreements, which forces attorneys and employers to glean information from sometimes seemingly inconsistent lower court opinions.

Over the past decade, Virginia courts tightened the requirements for NDAs by refusing to enforce clauses that did not include some time limitation on enforcement or that did not limit the information covered to certain categories.  However, the Fairfax Circuit Court recently issued an opinion that seemingly reverses course on the trend.  In that opinion, the court ruled that an NDA was enforceable that covered “any and all confidential and/or proprietary information of [the company],” even though it did not have any time limitation on enforcement.  While this is a positive sign for employers, until the Virginia Supreme Court issues an opinion on the matter, the safest bet for enforcement is to keep the scope of the agreement as narrow as possible and include a reasonable time limitation.

A properly drafted NDA is only part of an effective data protection plan.  Many employers fall into the trap of relying on an NDA by itself to serve as the sole protection for its confidential information.  An NDA is only useful if the employer takes action to maintain and protect such information from disclosure.  In fact, it is the company’s duty to ensure that any trade secrets remain confidential.  The following are additional steps or policies that should be followed to ensure that an NDA will be enforced in court.

1. Limit access.  Courts will only allow companies to protect confidential information that is actually confidential.  If such information is treated as ordinary business information it may lose its protection under the NDA.  Companies do not have to resort to retinal scans or facial recognition programs, but they should take steps to ensure that confidential information can only accessed by employees who need it to perform their jobs and who have signed an NDA.  Paper files should be locked up and kept on the premises.  Workstations, digital files, and personal electronic devices should be password protected.  The company should also periodically monitor who is accessing its confidential files.
2. Label your information.  It is impossible to detail every confidential document that an employee will come in contact with while working, so attorneys often draft non-disclosure agreements to cover broad ranges of documents, such as “financial information” or “business plans.”  While this may be a practical necessity, courts look at such broad categories skeptically, especially when an employer cannot show that an employee knew that a specific document was intended to be confidential.  The simple solution is to make sure that the document is labeled as “confidential.”  If you are sending confidential information in an email, then you should make sure the word is in the title.  If the disclosure is verbal, then it should be prefaced by a brief instruction that what is being discussed is confidential and should not be repeated.
3. Maintain handbook policies and training.  Employers should not assume that their employees understand their responsibilities with regard to maintaining confidential information.  Employers should have detailed handbook policies that clearly explain their confidentiality policies and conform to the employee’s duties under the NDA.  Policies are useless unless they are understood, so employers should regularly train employees on their policies.
4. Perform exit interviews.  Interviewing departing employees can provide a number of benefits.  Among them is the opportunity to provide the employee with a copy of the NDA and to review the employee’s duties under the agreement together.  It is also a good time to go through a checklist of company property and confidential information in the employee’s possession to confirm that it has all been returned to the company. If possible, employers should have departing employees sign a form acknowledging any ongoing obligations.
5. Check departing employee’s computer.  One of the downsides of digital information is that an employee can download reams of documents onto a hard drive the size of a pen cap and walk right out the door.  Recently, a popcorn producer sued its former director of research and development for allegedly swiping over 5,000 confidential documents, including recipes and marketing surveys, when she learned she was going to be fired.  The company identified the alleged theft after analyzing the departed employee’s computer.  If an employer has reason to believe that a departing employee may have taken information with them, it should consider hiring a firm who specializes in electronic forensic analysis to review the employee’s computer usage.
6. Contact new employer.  If you know your former employee’s new employer, you should consider providing that employer with a letter detailing the employee’s continuing obligations not to disclose your trade secrets and other confidential information.  This will place the company on notice and prevent it from from claiming that any future violation of the obligations was made unknowingly.  Before taking this step, an employer should confer with counsel because if the new employer terminates the employment relationship, the former employee may sue for intentional interference with contractual relations.

By drafting and consistently following a confidential information policy, employers can provide maximum protection of their confidential information and ensure quick and effective enforcement of its NDAs by the courts.

Jeff Wilson is a Pender & Coward attorney focusing his practice on employment law matters, including counseling and business litigation.