What is Confidential Information? - OneNDA Provision

NDA Anatomy™ JC’s guide to non-standard confidentiality agreements. For the OneNDA, see the OneNDA Anatomy →Go uptown The OneNDA clause What is Confidential Information? Confidential Information means information that is disclosed: by a party to this Agreement (the Discloser) or on the Discloser’s behalf by its authorised representatives or its Affiliates, to the other party to this Agreement (the Receiver), its Affiliates or Permitted Receivers, and in connection with the Purpose. Affiliates means any: entity that directly or indirectly controls, is controlled by, is under common control with or is otherwise in the same group of entities as a party to this Agreement, or fund or limited partnership that is managed or advised, or whose general partner or manager is managed or advised, by the Receiver or its Affiliate or which the Receiver or its Affiliate controls. Permitted Receivers means the Receiver’s Affiliates and the Receiver’s or its Affiliates’ officers, employees, members, representatives, professional advisors, agents and subcontractors. Confidential Information does not include information that is: in the public domain not by breach of this Agreement, known by the Receiver or its Permitted Receivers at the time of disclosure, lawfully obtained by the Receiver or its Permitted Receivers from a third party other than through a breach of confidence, independently developed by the Receiver, or expressly indicated by the Discloser as not confidential. view template Resources: Confidentiality agreement | Confi — Led Zeppelin style | GDPR | Copyright vs. confidence | OneNDA | Common terms | Certification | Confidential information | Confidentiality obligation | Derived information | Disclosed information | Discloser | Exclusivity | Indemnity | No licence | Non-solicitation | Permitted disclosees | Permitted disclosures | Procure compliance | Purpose | Receiver | Remedies | Reps and warranties | Return of information | Term of confidentiality | Index: Click ᐅ to expand: Confidentiality OneNDA Tell me more Sign up for our newsletter — or just get in touch: for ½ a weekly 🍺 you get to consult JC. Ask about it here.

What is in scope?

Parties give each other all kinds of information. Not all of it is sensitive. Seeing as an NDA imposes onerous obligations, you should carefully define the “confidential information” that’s in scope. Consider the following:

Personal information: Personal information about individuals is tricky in this age of big data and fake news. There may be additional provisions concerning storage, processing and rights to access and correct that information. Especially now the EU General Data Protection Regulation (GDPR) is in force. Hoo boy. Data protection is an area of law of which JC has assiduously steered clear over his career and he is not about to change that now.

Client-identifying information: some data is interesting and sensitive only as far as it can be associated with an person or entity. Trading data, for example. That a Vodafone trade was executed at close on the 1st of September at a price of 103 isn’t especially sensitive. It isn’t susceptible to copyright. Not until you link it to the client who executed the order. Then it is sensitive. Market abuse and insider trading lie this way.

Proprietary IP and technology: Trading data tends to be valuable insofar as it relates to a given client. Other types of information (especially intellectual property: patents, copyrights, designs, trade secrets, secret sauce and so on) is valuable irrespective of the identity of the client.

What is out of scope?

What information that otherwise would be in scope, is out of scope? Even within the definition of confidential information, you’ll need to make exceptions for information the receiver already held, or receives or develops independently (and not in breach of a confidentiality undertaking) or with reference to information specifically disclosed

Information disclosed to a regulator is still confidential information

Don’t make the schoolboy error of excluding “information required to be disclosed to regulators or government authorities” from the definition of “confidential information”. Now, to be sure, this is a legitimate exception to a fellow’s general covenant not disclose confidential information to anyone — but it shouldn’t disqualify the information from being “confidential information” altogether. If it did, once you were required to give any information to a regulator, it would suddenly be open season and you could tell everyone about it. Not the intention.

One misconceived argument we have seen for this approach is as follows: “if I give information to a regulator then I cannot control what the regulator does with it. Regulators are all-powerful. They may publish sensitive information in the Luxembourger Wort for all I can do about it. Therefore your information, once I have rightly given it to a regulator, can no longer be treated as confidential.”

Not so fast: If you disclose my information legitimately to a regulator, and the regulator then discloses it to the world (whether or not legitimately) you have complied with the terms of your contract. Unless you have independently covenanted to procure that the regulator keeps it confidential (don’t do that: regulators are all-powerful, and you make yourself a hostage to fortune), you have not breached your NDA, and you cannot therefore be liable for resulting losses. They are regrettable externalities: obstreperous actions of impish third parties. On the other hand, if you disclose my information legitimately to a regulator, and then you separately disclose it to someone else, then you absolutely can and should remain liable for losses. If by disclosure to a regulator the information is deemed "no longer confidential" you would be free to disclose it to someone else without that sanction.

Proprietary information

If your definition starts with “information belonging to the discloser” or “proprietary information” then you have excluded most of the data you are seeking to protect. “Belonging to” implies “possession”, implies “property” implies “intellectual property”. Intellectual property subsists in creative works — copyright, patent and trademarks — but not in facts or raw data. To be yours, you have to have created it. Your trading data, your client lists, your employees — this is not information belonging to you. It is information relating to you which (QED) the receiving party wants but does not have, which is why it is worthy of protection by contract even though no intellectual property rights attach to it.

Derived information

Careful with derived information - here we are straying into the dappled world of intellectual property where a confidentiality agreement.ought not be your natural first line of defence. (Your copyright — which is not a function of a contract — is).

• Deriving new information from intellectual property: So: taking copyrighted information and fiddling around with it potentially takes it outside the realm copyright. The point about copyright is that it attaches to a specific articulation of a creative idea. If you take that idea and change how it is expressed — if you derive new content out of it — then, potentially, you own that new copyright, not the person whose copyrighted work you modified. You can control a recipient's ability to derive by contract, and it is fair to do so.

• Deriving new information from data: On the other hand, with non-copyrightable data, you don’t own in the first place. Therefore, by the lights of copyright law, you did not use your creative juices to produce it, so a person to whom you supply that information who then uses hers to derive some new information out of is not infringing your proprietary right. You don’t have a proprietary right.

Written or oral

“Written or oral” is a favourite incluso for a mediocre lawyer who can’t think of any other way of “adding value”. For purely practical reasons, resist the urge to include orally transmitted information. Especially in a service-provider - client relationship, and especially if you are the service provider receiving the information — it gives your client a free, and hard to disprove option to claim anything at all that they want to keep secret is something "I told you, remember?". It may also interfere with service provider's ability to claim it had prior possession of the information (and therefore the information is out of scope of the confidentiality obligation altogether).

Now chaps, really: — if data is valuable enough for you to require an “injunctionable” right to stop me using it, it must be valuable enough for you to be bothered confirming in writing. If you do that you put beyond argument the fact that you did communicate it to me, and when.