===What is the confidentiality obligation?===
Now you know what counts as confidential information, what can you do with it and what’s not allowed?
You’ll often see:
- Keep the information confidential. Don’t disclose it except to a limited group of people — and you may be required to ensure that these people only receive the information subject to an equivalent duty of confidentiality:
- Inside the organisation: In a large organisation this may be to a small group of people in the organisation (for example, credit, legal or the on-boarding team). There may be specific restrictions to prevent it getting to trading desks or front office personnel who may use the information to profit from it (this will usually be illegal: it’s likely to constitute insider trading or market abuse, but no harm is specifying in the contract).
- Outside the organisation: you may be allowed to share it with your professional advisers, and to regulators and quasi regulatory authorities (stock exchanges etc) where required by law (or you reasonably consider it expedient). There may be some tiresome details about only giving in formation that is reasonably necessary, and taking what steps are necessary to take legal action to prevent disclosures to regulators.
- Only use it to carry out the “purpose” or “project”: This is somewhat hard to enforce — it’s nebulous, right? — and in practice you’ll never know what goes on behind closed doors, but in the English law-speaking world this is pretty uncontroversial precisely because it isn’t practically actionable. But our North American cousins — and those on the private side of the investment banking wall — can get very worked up over it.
At least, that’s what I recall, but it may have been a fever dream.
