You are here:
07 May 2018 / article

Personal data vs. business information in the European Union: recent developments

These are busy times for the protection of personal and business data in the European Union (“EU”): on May 25, the General Data Protection Regulation 2016/679 (“GDPR”) will become applicable, while on June 9 all EU Member States should (in principle) have adopted legislation implementing the so-called Trade Secrets Directive 2016/943. Let’s have a look at how these two important pieces of EU legislation could be of relevance for US companies.

As to its territorial scope of application, the GDPR first of all provides that it applies to any processing of personal data that takes place in the context of the activities of a European establishment of a data controller or processor, regardless of whether the processing itself takes place in the EU. This entails that not only EU affiliates of US-based companies should be GDPR compliant, but also US companies themselves, insofar as they would have a branch or representation office in the EU and this ‘establishment’ creates a data flow to the US. In addition, the GDPR applies to the processing of personal data by a controller or processor without any EU establishment, where the processing activities relate to (1) the (active) offering of goods or services to individuals in the EU, or (2) the monitoring of individuals’ behavior in the EU. US companies operating a web shop targeting European customers or a mobile application tracking the behavior of EU individuals will thus also be caught by the GDPR, even if they have no establishment in Europe.

On the other side of the spectrum, companies often also own important (non-personal) sensitive business information or technical knowhow. US companies should therefore also be attentive to the Trade Secrets Directive, aiming at the protection of such confidential business or technical information. As the Trade Secrets Directive does not set any territorial restrictions, it can perfectly be used by US companies to act against misappropriation of their trade secrets in the EU. In order to succeed, US companies should of course make sure that what they call “trade secrets” effectively meets the following definition: “any information that is secret, has commercial value because it is secret and has been subject to reasonable steps to be kept secret”. Such ‘reasonable steps’ generally include signing NDAs and adequate confidentiality clauses with employees, consultants and any third party having access to confidential information, protecting such information with passwords and access control, etc. As the EU and the US (via the Defend Trade Secrets Act effective since May 11, 2016) have defined trade secrets in a similar manner, this should not be too much of a challenge for US companies.

In sum, we encourage you to be aware of how much the protection of personal data, on the one hand, and business data, on the other hand, is a hot topic at the EU level and could potentially serve your international business.  



Belgian rules on use of surveillance cameras revised

This newsflash discusses the main provisions of the revised Belgian Camera Act. read more
Medical material

New obligation to register biobanks with the FAMHP

The Royal Decree of 9 January 2018 on biobanks (Royal Decree), published in the Belgian Official Gazette on 5 February 2018 and implementing the Law of 19 December... read more
Main take-aways of the Optional VAT regime for immovable letting

Main take-aways of the Optional VAT regime for immovable letting

The Minister of Finance has filed a draft bill dated 31 July 2018 setting up the optional VAT regime for immovable letting. read more