By

In an April 25, 2012 ruling [pdf] a Middle District of North Carolina court clearly illustrated the importance of pleading actual harm in an unfair competition case.  By dismissing parts of a dispute between River’s Edge Pharmaceuticals, a discount pharmaceutical product distributor, and Gorbec Pharmaceutical Services, Inc., a pharmaceutical manufacturer, the court ruled that speculation about potential harm  is not enough to sustain a litigant’s burden.

In 2003, River’s Edge first developed products through an FDA-sanctioned program.  River’s Edge sought help from Gorbec in 2007 to manufacture and test generic drugs under an Abbreviated New Drug Application (ANDA) process.  The parties contemplated preparing a written contract to memorialize their agreement, but never completed one.  River’s Edge submitted purchase orders to Gorbec to manufacture drugs to River’s Edge’s specifications. 

In 2010, the relationship soured.  River’s Edge claimed Gorbec executives boasted of having the “know-how, intellectual property, and regulatory approvals,” threatened to stop work, and made plans to compete.  Gorbec claimed River’s Edge failed to pay Gorbec in full, and hid a warning letter from the FDA asking River’s Edge to cease sales.  Both sued.  River’s Edge’s complaint alleged breaches of contract and fiduciary duty, fraud, promissory estoppel, unjust enrichment, conversion, and misappropriation of trade secrets; and sought declaratory relief.  Gorbec’s counterclaim was almost a mirror image, alleging breach of contract, unjust enrichment, negligent misrepresentation, fraud, and deceptive trade practices.

Both parties moved to dismiss for failure to state a claim under the Federal Rules of Civil Procedure, as interpreted by the U.S. Supreme Court in Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009); the only count not included in the Rule 12(b)(6) motions was River’s Edge’s declaratory judgment request.  The court granted many parts of the dueling motions.  What survived? 

River’s Edge’s Claims Trimmed

River’s Edge was left with a fiduciary breach claim based on Gorbec’s alleged refusal to provide River’s Edge with all FDA communications on pending ANDA work, conversion and trade secret misappropriation claims, and a contract claim for the alleged cessation of ANDA work.  However, the court dismissed the contract claims based on Gorbec’s alleged statements of ownership or intent to compete, fiduciary claims for any “threatened or potential conduct,” claims for constructive fraud and unjust enrichment, and made it clear that as to the misappropriation claims, River’s Edge had to be able to prove Grobec had the opportunity to acquire, use and disclose trade secrets without consent.

Gorbec’s Counterclaims Narrowed

The court dismissed Gorbec’s counterclaim for negligent misrepresentation entirely, dismissed part of the fraud counterclaim to the extent it was based on the idea that River’s Edge formed its own manufacturing company in order to get around its contract, and dismissed part of the contract counterclaim to the extent it was based on River’s Edge’s failure to enter into the anticipated written agreement.  The court denied the motion to dismiss for unfair and deceptive trade practices and unjust enrichment, finding sufficient information to state a claim; and denied the motion as to the part of the contract claim based on the actual ANDA work Gorbec had done, and denied dismissal of the fraud counterclaim to the extent it was based on fraudulent concealment of the FDA warning letter. 

Lessons Learned

As the court’s ruling demonstrates, in the arena of unfair competition, it is paramount to avoid speculative language about potential harm.  Instead, courts in trade secret misappropriation cases will look for plaintiffs to identify the specific injury the alleged theft has cost them. 

A conundrum employers face when protecting trade secrets is the obligation to identify the very secrets to be protected in litigation.  A critical issue in the context of discovery is the extent to which trade secrets must be disclosed and identified by the plaintiff.  When the secret is something as technical and unique as a computer source code alleged to have been used to augment a competitor’s source code library, the requirement to identify the misappropriated secret with “reasonable particularity” early in the case may become the “case within the case.”

A recent example of a fight not to be the first party to identify source code in discovery is the New York state court case of MSCI, Inc. v. Jacob and Axioma, Inc. [pdf], where Supreme Court Judge Shirley Kornreich ruled the plaintiffs had to identify the components and sequencing of both the secret and the publicly known source code to the defendants, before discovery could proceed.

The plaintiffs claimed their former employee (who was not subject to a non-compete clause) had taken, used, and disclosed portions of source code to his new employer Axioma, who had embedded parts of that secret source code in its own financial market software.  The plaintiffs first characterized the entire source code “reference library” as a trade secret, even though parts of that code are in the public domain or licensed.  Their backup argument was that “certain details of the specific implementation” of even the publicly known code were trade secrets.  The plaintiffs proposed to only identify which parts of its source code were not trade secrets, and maintained this was a more practical and cost-efficient, yet legally sufficient way to meet its burden of trade secret identification.  An earlier preliminary ruling by the court affirmed that approach.

However, the issue came to a head when the plaintiffs sought full disclosure by the defendants of the Axioma source code library first.  The defendants argued that before the plaintiffs could obtain or inspect Axioma’s source code library, the plaintiffs should be made to reveal the precise parts of source code it claimed were trade secrets. 

Judge Kornreich was “persuaded that the law requires that a trade secret plaintiff identify trade secrets with reasonable particularity early in the case” (citing Xerox Corp. v. IBM Corp., 64 F.R.D. 367, 371 (S.D.N.Y. 1974) for the proposition that trade secret defendants should not be made to “guess at what they are” and that only after identification of a trade secret lost can a defendant “undertake a meaningful discovery program...”; and noting that California has codified this requirement at Cal. Code Civ. Proc. §2019.210).  Judge Kornreich reasoned that distinguishing between “general knowledge in the field” and trade secrets would allow the court to set the “parameters of discovery” and make the defendants “able to prepare their defense.”  The judge even observed that the plaintiffs, once privy to Axioma’s source code, “could tailor their theory of misappropriation” or even misappropriate Aximoa’s trade secrets. 

Before the plaintiffs can seek further discovery from the defendants, they must identify with reasonable particularity which of the “component parts or sequencing of their source code” are not publicly available, commonly used, or licensed from third parties.

This order has expensive and important ramifications in the case at issue, and generally, in source code misappropriation litigation.  A vital consideration in launching trade secret cases is the cost (dollar and competitive) of disclosure and identification of the secrets lost.

Unfair competition litigation frequently involves disputes over whether information actually constitutes a trade secret.  Given the prevalent use of social media by both businesses and individuals, it is not surprising that courts have begun to address whether such information can be a trade secret.  In November, a California federal court refused to dismiss a claim that Twitter account information was protected as a trade secret.  A recent decision from the District of Colorado opened the door to allowing businesses to protect their Facebook and MySpace “friends” list as a possible trade secret.

In Christou v. Beatport, LLC [pdf], the plaintiffs, including several Denver area night clubs, brought numerous claims against a former employee and the companies that he founded.  The claims included an allegation of misappropriation of trade secrets.  Specifically, the plaintiffs alleged that the defendants misappropriated their login information to access profiles on MySpace and lists of MySpace “friends.”  The defendants moved to dismiss this claim, arguing that the plaintiffs failed to allege sufficient facts to demonstrate that their MySpace profile and “friends” list qualify as trade secrets. 

Colorado has adopted the Uniform Trade Secrets Act and defines a trade secret as the “whole or any portion or phase of any scientific or technical information, design, process, procedure, formula, improvement, confidential business or financial information, list of names, addresses, or telephone numbers, or other information relating to any business or profession which is secret and of value.”  C.R.S. § 7-74-102(4).  Additionally, the owner of a trade secret must have “taken measures to prevent the secret from becoming available to persons other than those selected by the owner to have access thereto for limited purposes.”

To determine if the MySpace lists could potentially constitute trade secrets under Colorado law, the court looked to eight factors:

(1) whether proper and reasonable steps were taken by the owner to protect the secrecy of the information; (2) whether access to the information was restricted; (3) whether employees knew customers’ names from general experience; (4) whether customers commonly dealt with more than one supplier; (5) whether customer information could be readily obtained from public directories; (6) whether customer information is readily ascertainable from sources outside the owner’s business; (7) whether the owner of the customer list expended great cost and effort over a considerable period of time to develop the files; and (8) whether it would be difficult for a competitor to duplicate the information.

Applying these factors, the court first noted that the plaintiffs took reasonable steps to protect the secrecy of their information because they secured the profiles through web profile login and passwords.  Further, the login and password information was restricted to personnel, including the former employee, who required access in order to promote the night clubs. 

The court also found that the defendants could not have gleaned the list of names from general experience.  Rather, the list of “friends” was more than a simple list of names of potential customers.  In its analysis, the court noted that “‘[f]riending’ a business or individual grants that business or individual access to some of one’s personal information, information about his or her interests and preferences, and perhaps most importantly for a business, contact information and a built-in means of contact.” The names themselves, readily available to the public, are not the important factor.   

The court also noted that the plaintiffs expended at least some cost and effort in developing the social networking aspect of its business.  In fact, while employed by plaintiffs, the former employee defendant was paid to assist in building, maintaining, and using the lists and profiles. 

After analyzing the relevant factors, the court denied the motion to dismiss, concluding that the plaintiffs had alleged sufficient facts to maintain their trade secret claim as to the MySpace information.  Because the existence of a trade secret is inherently fact-specific, it remains to be seen whether this claim will ultimately succeed and whether other employers will be able to assert trade secret protection for social media information.  Given the use of social media and the ease with which electronic information can be copied or transferred, this will become an increasingly common claim in litigation. 

It is well-established that an injunction to enforce a non-compete provision should not extend beyond the period set forth in the non-compete agreement.  Whether based on the belief that a contract should be enforced as written or because restrictive covenants are generally not favored by law, the majority of courts have declined to enforce a non-compete provision beyond the expiration of the period set forth in the agreement.  In its March 1, 2012 decision in Finkel v. Cashman Prof. [pdf], the Nevada Supreme Court reinforced this rule.  The New Jersey Supreme Court has reached the same conclusion.  See Community Hospital Group v. More, 183 N.J. 36, 63 (2005).   But have the courts considered whether this solution is sufficient?  In an effort to enforce the plain terms of the contract, are courts depriving employers of the benefit of their bargain?  Some argue that in limiting a non-competition injunction to the period provided for in the non-compete agreement, courts have largely failed to award the relief necessary to fully compensate employers for the injuries incurred by a breached non-compete provision. 

In New Jersey, courts follow the rule that non-competes should not extend beyond the period set forth in the non-compete agreement with one catch: a non-compete provision may be enforced beyond the expiration of the term in the agreement if no other relief (i.e. monetary damages) is available.  In Jackson Hewitt, Inc. v. Childress, 2008 U.S. Dist. LEXIS 4640 (D.N.J. 2008), the district court issued a twenty-four month injunction, prohibiting the defendant from competing with the company, but only because it was evident monetary damages were not available.  In Childress, the defendant, who had “openly refused to comply” with his non-compete obligations, filed for bankruptcy two days after the company brought suit seeking a preliminary injunction.  By the time the district court addressed the issue, the twenty-four month non-compete period had expired.  At that point, because the defendant filed for bankruptcy (discharging the plaintiff’s claim), issuing a new twenty-four month injunction, based on the non-compete period in the contract, was the only remedy for the plaintiff’s injury. 

The question is whether a non-compete provision should be enforced as written, and expire at the end of the period specified by the contract, as in More and Finkel, or whether the injured party is entitled to an injunction prohibiting the breaching party from competing for the full period set forth in the agreement, as done in Childress.  While the Childress court prohibited the defendant’s competitive behavior for an extended twenty-four month period, the court explained that this remedy was issued only because a monetary remedy was not available.  To remedy wrongful competitive behavior, an injunction should issue prohibiting competitive behavior for the full non-compete period set forth in the contract.  This is not to say that the injured party should not be entitled to damages; rather, an injunction reflecting the duration anticipated by the non-compete provision should issue separate and apart from a monetary award to compensate the injured party for damages incurred. 

Some argue that to enforce the full non-compete period (for example, 12 months), in addition to providing monetary damages, would amount to a double recovery for the injured party.  This is not the case.  For example, if an employee subject to a 12-month non-compete provision separated from his employer on January 1, 2012 and abided by the non-compete term, which would expire on December 31, 2012, he would have engaged in no competitive activities during the non-compete period and the company would have suffered no injury. 

If, however, the former employee began to engage in competitive activities shortly after he separated from employment on January 1, 2012, and the company discovered the breach on April 1, filed a lawsuit on April 15, and obtained a preliminary injunction on July 1, according to the decisions in More and Finkel, the non-compete would only remain in effect  until January 1, 2013, the date the non-compete period would have ended pursuant to the contract.  In this case, the employer would suffer two separate injuries: (1) the loss of the 12-month non-compete period it bargained for; and (2) the damages incurred by the former employee’s nefarious activities in breach of the agreement.

Employers should be aware that the current rule generally enforces a non-compete provision only through the contractual expiration of the term, which only partially addresses the employer’s injury.  To make the injured party whole, a 12-month injunction (to address the first injury), in addition to monetary damages (to address the second injury) would be necessary to provide the company a complete recovery from a former employee’s breach of a non-compete agreement.   

An Alternative Solution

Because courts may continue to issue preliminary injunctions focusing on the non-compete period provided in the agreement, employers may want to consider adding language to the non-compete agreements to ensure they will receive the benefit of the full non-compete period in the event of the employee’s breach.  In a recent New York Appellate Division case, the court supported this creative solution. 

In Delta Enterprise v. Cohen [pdf], a New York appellate court held that, in issuing a preliminary injunction, the trial court should have enforced the tolling provision set forth in a confidentiality agreement.  In Cohen, the agreement contained language that provided for the tolling of various restrictive periods “during any period in which the Employee is in violation” of the restrictive covenants, and that “all restrictions shall automatically be extended by the period Employee was in violation of any such restrictions.”  In determining that the company was entitled to the restrictive period contained in the agreement, the court rejected the employee’s arguments that the tolling provision was, as a matter of law, unenforceable or in violation of public policy, particularly in light of the consideration the employee received. 

In light of Cohen, companies should consider adding tolling language to their non-compete agreements to ensure they will receive the benefit of the full non-compete period anticipated by the agreement.  Without such language, a company can expect to receive only partial recovery for the injuries incurred due to a former employee’s failure to abide by his non-compete obligations. 

By Lena K. Sims

Last week, the Ninth Circuit published its long awaited en banc decision, authored by Chief Judge Alex Kozinski, in United States v. Nosal [pdf].  The 9-2 reversal of the 3-judge appellate decision holds that the Computer Fraud and Abuse Act's phrase “exceeds authorized access” is limited to violations of restrictions on physical access to information and does not extend to violations of restrictions on the use of information.  Prosecution under the CFAA thus requires proof of “hacking” and employers will not be able to bring a claim for violation of the CFAA based on a violation of a computer use policy.    

The decision calls out for United States Supreme Court review.  It departs from the Fifth, Seventh and Eleventh Circuit decisions concerning interpretation of the same statutory language and criticizes those courts for taking a short-sighted approach that focused on the facts of the cases before them while criminalizing acts that are wide-spread, commonplace and trivial.  

Unlike those cases, the Nosal decision makes only a quick introductory recitation of the facts of the case.  Those following the case will recall that Nosal persuaded his former colleagues still working for his former employer to help him start a competing business by accessing information from the company’s database and then transferring that information to Nosal.  The employees had access to the database, but use of the information was restricted by policy:  “This product is intended to be used by Korn/Ferry employees for work on Korn/Ferry business only.”  Nosal was criminally prosecuted for aiding and abetting the employees in “exceeding their authorized access” with intent to defraud the employer.       

The Nosal decision sets aside its factual underpinnings and takes an expansive and some may say alarmist view of the CFAA’s potential impact, focusing on the ubiquity of computers and internet use in contemporary society generally and in the workplace.  It envisions employees being charged with federal crimes for “g-chatting with friends, playing games, shopping, or watching sports highlights” while at work and in violation of their employer’s policies prohibiting use of the employer’s computer systems for those activities.  These are “minor workplace dalliances” that employers’ policies would turn into federal crimes.  While the CFAA could be interpreted to criminalize violations of such use policies, the en banc panel rejected that interpretation to avoid the undesirable result of criminalizing common-place conduct that is not inherently wrong and which is without criminal intent.    

Where does this leave employers?  While Nosal was a criminal case, it is not limited to application in the criminal context. Very few employment cases are prosecuted criminally, and because the decision itself arises out of the employment context, its application in the civil context is expected.  While California employers may still bring claims for trade secret misappropriation, breach of contract, and certain torts, they will likely not have a basis for claiming federal subject matter jurisdiction under the CFAA. While they may no longer have a federal claim, employers will still want to have policies that clearly and appropriately restrict both access to and use of their information.  

By

Under the Uniform Trade Secrets Act, a “trade secret” is information that (1) derives independent economic value by virtue of its being secret; and (2) is the subject of reasonable efforts by the plaintiff to maintain its secrecy.  Although the first criterion is often discussed in judicial opinions, the second is not. The recent Seventh Circuit Court of Appeals case Fail-Safe, LLC v. A.O. Smith Corporation [pdf], No. 11-1354 (Mar. 29, 2012) is among the few reported cases that turn on the second prong of analysis.

Fail-Safe, LLC and A.O. Smith Corporation (AOS) held a series of discussions over the course of two years concerning a possible joint project to develop technology to make swimming pool drains safer.  Throughout these meetings and conversations, Fail-Safe shared with AOS sensitive technical information.  Yet Fail-Safe never entered an agreement requiring AOS to keep that information confidential, nor did Fail-Safe even identify the information it provided to AOS as confidential.  (AOS, by contrast, required Fail-Safe to sign a one-way confidentiality agreement.)  After the two companies decided not to pursue the joint development project, Fail-Safe alleged AOS introduced two pump motors incorporating Fail-Safe’s trade secrets.  Fail-Safe then filed a complaint alleging, among other things, that AOS thus violated the Uniform Trade Secrets Act.

The district court granted summary judgment in favor of AOS, reasoning (in relevant part) that, because Fail-Safe failed to take reasonable steps to protect the secrecy of its data, the information that AOS allegedly incorporated into its pump motors was not a trade secret.  The Seventh Circuit affirmed on the ground that, because Fail-Safe “failed to take any steps” to maintain the secrecy required for trade secret protection, its claim failed as a matter of law. 

Although Fail-Safe did not arise in the employment context, and the Seventh Circuit aptly characterized Fail-Safe as an “extreme case,” it underscores the importance of an employer’s documenting the steps it took to maintain the secrecy of any information it seeks to protect.  For example, an employer may include in its employees’ restrictive covenants a provision identifying the categories of the employer’s secrets, noting how those secrets are protected (e.g., via employee confidentiality agreements, password protections, etc.), and requiring the employee’s acknowledgment that such protections are reasonable under the circumstances.  Employers should also periodically audit their categories of secret information and update their security procedures.  Fail-Safe emphasizes that, although the bar is low for proving that information was the subject of reasonable efforts by the plaintiff to maintain its secrecy, that bar does exist.  Companies that lose sight of that burden may forfeit protections for their sensitive data.

A New Jersey district court recently held that an employee handbook provision could not be enforced as a valid confidentiality agreement between a company and a former employee.  Metropolitan Foods, Inc. d/b/a Driscoll Foods v. Kelsch [pdf] involved a former employee of Driscoll Foods (Kelsch), who was accused of soliciting orders for his new employer while still working for Driscoll.  Driscoll sued Kelsch under a number of causes of action, including breach of contract.  This claim was based upon a provision in the Driscoll employee handbook which stated that employees may “not disclose to unauthorized persons, including subsequent employers, Driscoll Foods’ confidential information.”

Usually, it is a plaintiff-employee replying upon an employee handbook as a basis for suing an employer for breach of contract, e.g., the employer did not follow proper procedures in the handbook when discharging the employee.  Woolley v. Hoffman-LaRoche, Inc., 99 N.J. 284 (1985).  In this case, the employer tried to use the provisions of the handbook as a basis to sue the employee.

However, as with most handbooks that were drafted with the advice of counsel, the Driscoll handbook was “rife with” disclaimers and statements that the handbook was “not a contract.”  Therefore, while Driscoll had other valid causes of action to sue Kelsch, namely, breach of the duty of loyalty, the court held that the handbook provision concerning confidentiality could not be enforced as a valid contractual provision.

Employers with concerns about employee access to their confidential information can avoid this result by having employees sign a short confidentiality agreement apart from the employee handbook.  Such an agreement puts the employee on notice that he or she will be using confidential information in the course of his or her employment, and that the company expects the employee to protect such information.  Employers should consider including the following in confidentiality agreements:

• a definition of confidential information;
• a commitment by the employee to keep such information in absolute confidence;
• a provision stating that the agreement survives the termination of employment (unless the information becomes part of the public domain);
• a provision providing that the company shall be entitled to all remedies, including injunctive relief, for breach of the agreement; 
• a provision providing that the employee shall return all confidential information upon termination of employment; and
• a provision stating that the agreement does not change the employee’s at-will status.

By Stephen C. Tedesco

Companies seeking to prohibit unlawful solicitation of customers should be encouraged by a recent federal court decision.  In the U.S. District Court for the Eastern District of California, Magistrate Judge Hollows issued an injunction that prohibited the defendant from directly or indirectly initiating any contact with any current Northern California or Hawaii customer of the plaintiff with whom he had contact or for whose accounts he had responsibility while employed by the plaintiff, for the purpose of encouraging, inviting, suggesting or requesting transfer of their business from plaintiff.  The Pyro Spectaculars North, Inc. v. Steven Souza [pdf] court distinguished its case from the decision in Retirement Group v. Galante 176 Cal. App. 4th 226 (2009), finding that California Business and Professions Code section 16600 does not constrain a court in equity from fashioning an appropriate remedy for tortious conduct in violation of the California Uniform Trade Secret Act.  The case provides a clear rebuke to the now common argument that Galante prohibits non-solicitation restraints.

The defendant in Pyro Spectaculars North, Inc. downloaded and retained detailed information on the plaintiff's customers. The court found that the information downloaded provided "a virtual encyclopedia of specific PSI customer, operator and vendor information at a competitor’s fingertips, allowing the competitor to solicit both more selectively and more effectively without having to expend effort to compile the data."  The evidence also showed that the defendant solicited numerous customers of the plaintiff using the stolen information.  The court also found that the conduct explicitly targeted the plaintiff’s customer goodwill and therefore supported the existence of irreparable harm for preliminary injunction.

The court declined to adopt a narrow reading of Galante that would effectively bar any non-solicitation restrictions under Business and Professions Code section 16600. The court noted that the paramount issue is how a court might fashion an appropriate relief via injunction.  While a court should be cognizant of the policies embodied in section 16600, that section does not constrain a court in equity from fashioning an appropriate remedy to prevent the misappropriation of trade secrets.  The court concluded "that a narrow, time-limited non-solicitation restriction is necessary to prevent defendant's misuse of PSI trade secret information in competing with PSI.”

For those practitioners attempting to prevent someone who stole trade secrets from soliciting customers, this case provides clear guidance of the evidence needed to support a non-solicitation injunction and how to fashion such an injunction. The case provides a much needed counterpoint and balanced view as to the scope of remedies available to a court to prevent the misappropriation of trade secrets.

By Dylan W. Wiseman and Todd M. Ratshin

In the ongoing battle between competitors in the aesthetics field, the court in Allergan, Inc. v. Merz Pharmaceuticals, LLC, et al. recently completed a nine-day bench trial resulting in an injunction [pdf] against the defendants to prevent the actual or threatened misappropriation of Plaintiff Allergan, Inc.’s (Allergan) trade secrets.

Allergan produces several different prescription medicines, including Botox Cosmetics and Juvederm, which are injectable treatments used to correct facial wrinkles and folds.   Merz Aesthetics also had for years been in the facial aesthetics market, and had a product that competed with Allergan’s Juvederm product.

In July of 2010, Merz Aesthetics announced that it received FDA approval for a new product to compete with Allergan’s Botox Cosmetic product.  A related company, Merz Pharma, announced that it too would begin selling a product to compete with Cosmetic Botox by the end of the year.

In the summer of 2010, four of Allergan’s employees, who sold Botox Cosmetic, left and were hired by Merz Aesthetics.   Shortly thereafter, three more regional sales representatives left Allergan and were hired by Merz Pharma as territory business managers.  All of Allergan’s former employees had signed confidentiality agreements, executed Allergan’s employee handbook, and agreed to the terms of Allergan’s Code of Business Ethics.   Allergan’s employment agreement identified as confidential numerous categories of information including, “information relating to investigational or market products . . . business studies . . . marketing and sales programs and data . . . design and engineering specs [and] product development plans.”

When the departing employees arrived at the two Merz entities, they too signed written agreements committing they would not “improperly use, disclose, or induce [the Merz entities] to use any proprietary information or trade secrets of any former employer,” and they also agreed not to bring to Merz or transfer to its computer systems any confidential data from any prior employer.  The same obligations were found in Merz Pharma’s and Merz Aesthetics’ employment offers to the former Allergan employees.

After sending a cease and desist letter, Allergan filed a lawsuit in the Orange County Superior Court and sought a temporary restraining order.  At the TRO hearing, counsel for the Merz defendants expressly disavowed having or wanting Allergan’s trade secret information.   At the hearing counsel for the Merz defendants proclaimed Merz “[has] never seen it, [Doesn’t] know what it is. [Doesn’t] want it, and [hasn’t] done anything.”  The court denied the TRO, and Allergan proceeded with further investigation and discovery, and the action was apparently removed to the federal court.

Allergan’s discovery and investigation revealed that, contrary to the statements made at the TRO hearing, Merz Pharma and Merz Aesthetics had in fact been in possession of Allergan’s confidential information months before the TRO hearing.  Indeed, the court’s factual findings [pdf] chronicle the extensive use and transmission of Allergan’s data via email within both Merz Pharma and Merz Aesthetics.

To its credit, Merz Pharma sought to educate its employees about compliance with their confidentiality obligations.  Merz also engaged in a program to identify those involved in the hiring of the former Allergan employees to determine whether they had received any of Allergan’s information.  Merz Pharma’s in-house counsel also gave a presentation to the entire sales force reminding them not to solicit or use any competitors’ confidential business information. 

The Merz defendants also hired a private computer forensics firm.  However, the Merz defendants’ own computer forensic review was arguably superficial.  The search terms were developed by the Merz defendants without consultation or input from their computer forensic expert.  Further, the search terms oddly did not include the term “Allergan.”  The Merz defendants also did not search the computers belonging to the four former Allergan employees who had joined Merz Aesthetics.   The Merz defendants also did not include any portable storage media from the 50 custodians they had identified as potentially having Allergan’s information.  Likewise, the results of the Merz defendants’ computer forensics, which produced “thousands” of hits, were not analyzed by its own consultant, but rather were turned over to the Merz defendants and their outside counsel.  The court concluded that “the Merz Defendants’ searches for Allergan’s trade secrets and confidential information were inadequate.” 

Allergan’s initial computer forensic discovery revealed that while working at Allergan several of its former sales employees who joined Merz sent “numerous documents and electronic files” to their personal email addresses.  Those files included “the entire nationwide list of nearly 24,000 physician customers, contact information, and details concerning sales volumes and future targets . . .” and other lists, new product information, and sales presentations.  Allergan’s further computer forensic review established similar facts and showed that certain employees had transferred files to portable electronic storage media.  Indeed, one of the departing employees backed-up over 700 Allergan files to a 2 terabyte hard drive.  That same former Allergan employee returned a 320 gigabyte drive to Allergan during her exit interview and made no mention of the 2 terabyte drive.  The computer forensics also established that other former Allergan employees had copied and transferred to external devices numerous files and spreadsheets about “top doctors” and “target physicians.”

Nearly a year after the TRO hearing, and just hours before the parties’ pretrial conference, counsel for Merz Pharma and Merz Aesthetics hand-delivered a box containing a hard drive, a CD containing electronic documents, and various hard copy records.  Among the materials “returned” to Allergan were email messages containing Allergan’s files as attachments, information about Allergan’s customer loyalty program, a confidential PowerPoint presentation, and other confidential information belonging to Allergan.  The Merz defendants then also sent two subsequent packages claiming they had “returned” Allergan’s confidential information.

Contrary to the Merz defendants’ assertions, the court made the express findings that “[t]here is overwhelming circumstantial and direct evidence that Defendants . . . improperly acquired, disclosed, or used [Allergan’s trade secrets] and that Allergan faces a substantial threat of impending injury as a result of this misappropriation.”  The court also concluded that “numerous witnesses affiliated with the Defendants were not credible.”

The court also took note that “[n]either Merz Aesthetics nor Merz Pharma has terminated or reassigned” any of the former Allergan employees even after they were “found to be in possession of Allergan information.”

The court also made several important legal conclusions.  First, the court found that the information which had been taken by the former Allergan employees was a “trade secret” under California’s Uniform Trade Secrets Act (CUTSA).  In doing so, the court found that Allergan had taken reasonable measures under the circumstances to maintain the secrecy of the information, which “need not be overly extravagant, and absolute secrecy is not required . . . .” 

Next, the court concluded that the Merz defendants had engaged in a “misappropriation” under the CUTSA.  The theft of the data and copying it to external media was also a breach of the former Allergan employees’ confidentiality obligations, and amounted to an “acquisition by improper means.”  

Third, the court concluded that the Merz entities were “liable for the acts of misappropriation committed by their employees and former employees” because the CUTSA imposes liability where an employer knew or should have known of an employee’s wrongdoing.   In making that finding, the court discounted the Merz defendants’ argument that the former Allergan employees had “secretly taken” the information unbeknownst to the Merz defendants because “an act of this nature was generally foreseeable as part of [his] duties to solicit customers for Defendant.”

In issuing an injunction, the court also made several important factual findings.   For the element of irreparable injury, the court determined it was appropriate to “presume that Plaintiff will suffer irreparable harm if its proprietary information is misappropriated.”  The court further concluded that “the risk of losing established customers to defendants’ new business due to the defendants’ improper use of plaintiff’s proprietary information would obviously create lasting, irreparable harm.” 

The court also concluded that Allergan’s monetary damages were insufficient resulting from the misappropriation “where the threat of injury is imminent and the measure of that injury defies calculation, damages will not provide a remedy at law.”   Most importantly, in response to the Merz Defendants’ stated position that “they have returned, and no longer possess, any of Allergan’s trade secrets, the court concluded “[i]t is the duty of the courts to beware of efforts to defeat injunctive relief by protestations of repentance and reform, especially when abandonment seems timed to anticipate suit, and there is a probability of resumption.”

The practical lessons learned from Allergan are significant.  First, when hiring sales personnel from a direct competitor, employers should be expected to make thorough, meaningful, and diligent efforts to ensure that their new hires have not taken any of their employer’s electronic or hard copy records.  Second, in this electronic era, conducting a superficial computer forensic review is completely inadequate, particularly in the face of evidence of actual wrongdoing.   Third, any efforts to “return” electronic and hard copy records may likely have little impact on the issuance of injunctive relief.   The fact that new hires may have “secretly” or without the approval of the employer taken files may be of little consequence, particularly where it was foreseeable by their job duties to solicit customers.  Lastly, when confronting obvious wrongdoing, the failure to discipline or re-assign employees who have engaged in a misappropriation can certainly be problematic.

Recently, a Minnesota federal district court construed the federal Computer Fraud and Abuse Act narrowly and dismissed an employer’s CFAA claim against three former high-level employees.   In Walsh Bishop Associates, Inc. v. O’Brien, et al. [pdf], the court held that civil liability under the CFAA does not extend to an employee’s alleged later misuse of information that the employee was authorized to access.  Thus, the court concluded that civil liability under the statute turns on whether the former employees were authorized to access the data at issue, not on whether the former employees allegedly misused the data after accessing it. 

The CFAA makes it unlawful for any person to obtain information from a computer by intentionally accessing the computer without authorization or by exceeding authorized access.  Employers frequently include a CFAA claim in suits against former employees for trade secret misappropriation.    

In Walsh Bishop, the defendants were former executive-level employees.  Among other things, the employer alleged that the defendants accessed documents the employer claimed were confidential and took those documents with them after leaving the employer’s employ.    

In reaching its decision regarding the scope of civil liability under the CFAA, the Walsh Bishop court recognized a split of authority among federal courts on the issue of whether the statute’s “exceeds authorized access” requirement was intended to include the alleged misuse of information properly accessed.  In rejecting the employer’s argument for a broad reading of this requirement, the court referenced the CFAA’s legislative history and emphasized that Congress amended the statute in 1986 to remove “use” as a basis for exceeding authorization.  The court relied on the plain language of the statute and focused on whether the defendants accessed information that they were forbidden to access. 

In its complaint, the employer alleged that the defendants had the “highest level” of access to the employer’s confidential and proprietary information.  The court concluded, therefore, that the employer had authorized the defendants to access  the data at issue and dismissed the CFAA claim, reasoning that the statute does not impose liability on individuals who have permission to access information, but later allegedly use it for an improper purpose.

Minnesota’s federal courts likely will continue to address the scope of civil liability under the CFAA and the issue of prohibited access versus use, given the relatively small number of CFAA cases that exist in that district.  The recent Minnesota case adopts the narrower reading of the CFAA’s “exceeds authorized access” requirement (following other, similar decisions from that district and other districts) and tightens the requirements needed before an employer can prevail against former employees under the CFAA.  In most trade secret cases, a former employee is accused of taking and using confidential information that was accessible to him or her in the course of employment.  The typical trade secret case does not involve employees gaining unauthorized access to confidential electronic data.   If Minnesota’s courts continue to read the CFAA narrowly, as the court did in Walsh Bishop, civil liability under the CFAA will not usually be a claim that employers may rely upon as part of their arsenal of claims against departing employees.