What is Confidential Information? - OneNDA Provision

OneNDA Owner’s Manual™ A Jolly Contrarian owner’s manual™ Go premium Overview — Summary — See also — Wikitext NDA Showdown OneNDA Homemade NDA What is Confidential Information? Confidential information Exclusions from confidential information Who can I share it with? Affiliates Permitted receivers Disclosure to regulators What are my obligations? Confidentiality obligation Procure compliance Return of information How long do my obligations last? Term Other important information Boilerplate Remedies Don’t go there girlfriend topics Non-solicitation Exclusivity Indemnity Sample text What is Confidential Information? Confidential Information means information that is disclosed: by a party to this Agreement (the Discloser) or on the Discloser’s behalf by its authorised representatives or its Affiliates, to the other party to this Agreement (the Receiver), its Affiliates or Permitted Receivers, and in connection with the Purpose. Affiliates means any: entity that directly or indirectly controls, is controlled by, is under common control with or is otherwise in the same group of entities as a party to this Agreement, or fund or limited partnership that is managed or advised, or whose general partner or manager is managed or advised, by the Receiver or its Affiliate or which the Receiver or its Affiliate controls. Permitted Receivers means the Receiver’s Affiliates and the Receiver’s or its Affiliates’ officers, employees, members, representatives, professional advisors, agents and subcontractors. Confidential Information does not include information that is: in the public domain not by breach of this Agreement, known by the Receiver or its Permitted Receivers at the time of disclosure, lawfully obtained by the Receiver or its Permitted Receivers from a third party other than through a breach of confidence, independently developed by the Receiver, or expressly indicated by the Discloser as not confidential. Resources and Navigation Index: Click ᐅ to expand: OneNDA TOC OneNDA NDA

Overview

A bit of monkeying around with where definitions are between versions 1 and 2, but no changes to the effect. If It were me I would have left “what Confidential Information” is and “what it isn’t” in consecutive paragraphs — or even in the same one — but the agreement is so short it doesn’t matter.

Summary

What is in scope?

Parties give each other all kinds of information. Not all of it is sensitive. Seeing as an NDA imposes onerous obligations, you should carefully define the “confidential information” that’s in scope. Consider the following:

Personal information: Personal information about individuals is tricky in this age of big data and fake news. There may be additional provisions concerning storage, processing and rights to access and correct that information. Especially now the EU General Data Protection Regulation (GDPR) is in force. Hoo boy. Data protection is an area of law of which JC has assiduously steered clear over his career and he is not about to change that now.

Client-identifying information: some data is interesting and sensitive only as far as it can be associated with an person or entity. Trading data, for example. That a Vodafone trade was executed at close on the 1st of September at a price of 103 isn’t especially sensitive. It isn’t susceptible to copyright. Not until you link it to the client who executed the order. Then it is sensitive. Market abuse and insider trading lie this way.

Proprietary IP and technology: Trading data tends to be valuable insofar as it relates to a given client. Other types of information (especially intellectual property: patents, copyrights, designs, trade secrets, secret sauce and so on) is valuable irrespective of the identity of the client.

What is out of scope?

What information that otherwise would be in scope, is out of scope? Even within the definition of confidential information, you’ll need to make exceptions for information the receiver already held, or receives or develops independently (and not in breach of a confidentiality undertaking) or with reference to information specifically disclosed

Information disclosed to a regulator is still confidential information

Don’t make the schoolboy error of excluding “information required to be disclosed to regulators or government authorities” from the definition of “confidential information”. Now, to be sure, this is a legitimate exception to a fellow’s general covenant not disclose confidential information to anyone — but it shouldn’t disqualify the information from being “confidential information” altogether. If it did, once you were required to give any information to a regulator, it would suddenly be open season and you could tell everyone about it. Not the intention.

One misconceived argument we have seen for this approach is as follows: “if I give information to a regulator then I cannot control what the regulator does with it. Regulators are all-powerful. They may publish sensitive information in the Luxembourger Wort for all I can do about it. Therefore your information, once I have rightly given it to a regulator, can no longer be treated as confidential.”

Not so fast: If you disclose my information legitimately to a regulator, and the regulator then discloses it to the world (whether or not legitimately) you have complied with the terms of your contract. Unless you have independently covenanted to procure that the regulator keeps it confidential (don’t do that: regulators are all-powerful, and you make yourself a hostage to fortune), you have not breached your NDA, and you cannot therefore be liable for resulting losses. They are regrettable externalities: obstreperous actions of impish third parties. On the other hand, if you disclose my information legitimately to a regulator, and then you separately disclose it to someone else, then you absolutely can and should remain liable for losses. If by disclosure to a regulator the information is deemed "no longer confidential" you would be free to disclose it to someone else without that sanction.

Proprietary information

If your definition starts with “information belonging to the discloser” or “proprietary information” then you have excluded most of the data you are seeking to protect. “Belonging to” implies “possession”, implies “property” implies “intellectual property”. Intellectual property subsists in creative works — copyright, patent and trademarks — but not in facts or raw data. To be yours, you have to have created it. Your trading data, your client lists, your employees — this is not information belonging to you. It is information relating to you which (QED) the receiving party wants but does not have, which is why it is worthy of protection by contract even though no intellectual property rights attach to it.

“Public” versus “public domain”

For all you “That Guy”s out there, we have a whole separate page devoted to explaining why it isn’t such a big deal to write “public domain” when you mean “public”. In a nutshell, as used in an NDA, “public domain” does mean “public”.