The PR and Legal Aspects of Protecting Confidential Information
By Jonathan Bernstein
 

The inadvertent or intentional disclosure of confidential information has, many times, been the match which lit the fire of crisis -- but what made the affected organization(s) vulnerable in the first place was lack of preparedness. A comprehensive vulnerability audit should always include a search for legal weaknesses.

For example, when trying to ensure you don't suffer the crisis of losing trade secrets to the competition, Quarles & Brady Litigation Partner Jeffrey Morris writes that, "...a company is likely to face an uphill battle in court in seeking trade secret protection for a document containing a detailed and sensitive sales history for all key customers if it develops, during the trial, that the company has no written confidentiality policy, has never even articulated any policy regarding confidentiality at all, has never labeled this particular document as confidential and, in fact, has allowed all employees, all the way down to the least highly compensated clerk, computer access to this document. Not only will a court likely be skeptical about the company' s claim that it regards this information as 'confidential,' more importantly the court will almost certainly have to find that the company has not made 'reasonable efforts' to protect the confidentiality of that information. Such a finding, of course, would be fatal to company's efforts to avail itself of the protections provided in the Uniform Trade Secrets Act."

Given what we've learned of most organizations' confidentiality practices in past vulnerability audits, we suspect that insufficient attention was paid to these legal considerations.