Template:Confidential information

Confidential information: what is in scope?

Parties give each other all kinds of information. Not all of it is sensitive. Seeing as a confi imposes onerous obligations, you should carefully define the “confidential information” that’s in scope.

• Personal information: Personal information about individuals is particularly tricky in this age of big data and fake news. There may be additional provisions concerning storage, processing and rights to access and correct that information. Especially now the EU General Data Protection Regulation (GDPR) is in force. Hoo boy.
• Client-identifying information: some data is interesting and sensitive only to the extent it is identifiable with the client. Trading data, for example. That a vodafone trade was executed at close on the 1st of September at a price of 103 isn't especially sensitive. It isn't susceptible to copyright. Not until you can refer it to the client for whom the order was executed. Then it is sensitive. Market abuse and insider trading lie this way. Careful, soldier.
• Proprietary IP and technology: Trading data tends to be valuable insofar as it relates to a given client. Other types of information (especially intellectual property: patents, copyrights, designs, trade secrets, secret sauce and so on) is valuable irrespective of the identity of the client.

Confidential information: what is out of scope?

• What information that otherwise would be in scope, is out of scope?: Even within the definition of confidential information, you’ll need to make exceptions:
  • Information the receiver already held at the time of disclosure
  • Information the receiver receives separately from someone else other than in breach of a confidentiality undertaking
  • Information the receiver develops independently of the disclosure and without reference to information disclosed

Trick for young players

• Information stays “confidential” even if you have to disclose it to regulators: Don’t make the schoolboy error of including in this exclusion from the definition of confidential information “information required to be disclosed to regulators or government authorities”. This is a legitimate exception to the prohibition on disclosing information — see below — but it shouldn’t disqualify the information from being Confidential Information altogether. If it did, once you were required to give any information to the regulator, it would suddenly be open season and you could tell everyone about it.
• Information belonging to...: If your definition starts with “information belonging to the discloser” then you have excluded most of the data you are seeking to protect. “Belonging to” implies “possession”, implies “property” implies “intellectual property”. Intellectual property subsists in creative works — copyright, patent and trademarks — but not in facts or raw data. To be yours, you have to have created it. Your trading data, your client lists, your employees — this is not information belonging to you. It is information relating to you which (QED) the receiving party does not have, and it is worthy of protection by contract even though no intellectual property rights attach to it.