The "Need to know" principle - does it qualify for a legally appropriate protective measure in Know-how protection?

The restriction of knowledge of trade secrets according to the "need to know" principle forms an essential protective measure for safeguarding know-how against third parties.

According to the "need to know" principle, involved persons should only have access to trade secrets to the extent that it is absolutely necessary for the fulfilment of their tasks.

With the correct implementation of the "need to know" principle in the company, protection of trade secrets cannot only be achieved on a factual level, the implementation of the "need to know" principle is above all also legally relevant when enforcing trade secrets against third parties: For example, the Higher Regional Court of Schleswig ruled in its decision of 28 April 2022 (file no 6 U 39/21) that the company's particular selection of a deliberately small group of persons who had access to a cost accounting was appropriate.

In practice, the implementation of the "need to know" principle raises a number of questions, such as:

• What information qualifies to be known by a certain group of people according to the "need to know" principle?
• For what purpose is the information needed and for whom is access to the information mandatory according to the company organisation?
• When and for how long (limited editing and reading rights?) is knowledge required?
• Where (e.g. on which server) is the information available and how is the access restriction technically / organisationally secured?

Classification

The more sensitive the secret information, the more restricted the access should be and the smaller the group of persons permitted; this applies above all to the "crown jewels" among the trade secrets, i.e. that know-how whose disclosure would have consequences that would threaten the existence of the company. It must also be taken into account that individual areas of activity in the company do not necessarily require the same flow of information. For example, employees in production do not need to have the same / full know-how about the operation of machines for different work steps. Similarly, the marketing department does not need to have technical details from production drawings.

Train your people

In practical implementation, care must be taken to ensure that the "need to know" principle is not just theory in corporate guidelines, but is and can be "lived". For this reason, the person cleared for access to secret information must be trained on the "need to know" principle regularly.

"Need to know" principle for an audit-proof know-how protection management system

The failure to set up a "need to know" principle and, above all, the failure to document it, is a classic "finding" during audits within the framework of the internal control system (ICS). Therefore, the implementation of the "need to know" principle is one of the key points of the implementation of an audit-proof know-how protection management system. 

Martin Prohaska-Marchried and Wolfgang Kapek regularly represent companies in Austria in enforcing and defending trade secret claims and are authors of the handbook "Know-How-Schutz kompakt" published by Austrian Standards.