Legal Determination of Customer Information as Trade Secret Protection and Corporate Management Recommendations

In today's highly competitive business environment, enterprises often regard technological R&D achievements as core secrets, yet easily overlook another important intangible asset explicitly protected by law-customer information.  Article 10 of China's Anti-Unfair Competition Law defines trade secrets as technical information, business information, and other commercial information that is not known to the public, has commercial value, and for which the right holder has taken corresponding confidentiality measures.  Article 1 of the Provisions of the Supreme People's Court on Several Issues Concerning the Application of Law in the Trial of Civil Cases Involving Trade Secret Infringement (hereinafter referred to as the "Judicial Interpretation on Trade Secrets") further clarifies that customer information, data, etc., related to business activities may be determined by the people's court as business information under the Anti-Unfair Competition Law.  This provides the legal basis for the protection of customer information.

I. Undercurrents of Risk: Three High-Risk Scenarios for Customer Information Loss

However, as many enterprises deeply rely on customer resources, associated legal risks surge beneath the surface.  In daily operations, three common scenarios are particularly perilous: First, employees engaging in "freelancing" or setting up "shadow companies" during their employment, utilizing the company's customer information and transaction channels to siphon off profits; second, key employees "starting anew" after leaving, directly contacting and using in-depth customer information brought from their former employer to compete; third, employees "bringing resources into the new job," directly applying comprehensive customer information and quotation plans accumulated at the former company to the new employer's business.  What these acts often exploit is no longer publicly available information, but rather in-depth customer information that may constitute "trade secrets" in the legal sense.

II. The Core of Legal Determination: The Threshold from "Basic Information" to "In-Depth Information"

So, what kind of customer information can constitute legally protected trade secrets? This article will briefly introduce this based on judicial interpretations and practice.

First, according to Article 2 of the Judicial Interpretation on Trade Secrets, if a party claims that a specific client is a trade secret solely on the ground of maintaining a long-term and stable transaction relationship with such client, the people's court shall not uphold such a claim.  This means that the law protects not the "relationship" itself, but specific "information."  Second, according to Article 3 of the Judicial Interpretation on Trade Secrets, information requested by the obligee for protection that, at the time of the alleged infringement, was not generally known by and easily available to the relevant personnel in the field shall be determined as "not known to the public."  Therefore, "basic information" merely containing customer names, addresses, contact details, etc., that are easily accessible publicly usually lacks "secrecy" and is difficult to protect.  For example, in Case (2023) Jing 73 Min Zhong 3597, the court explicitly stated that a list only containing customer names, without reflecting in-depth information such as special needs or transaction habits, does not constitute a trade secret.  Similarly, in Case (2016) Yue 05 Min Zhong 1048, the court held that a list with only customer names could not reflect special content distinguishable from publicly known information, failing to meet the requirements of a trade secret.

III. "In-Depth Information" in Judicial Practice: Specific Standards and Determination

The focus of legal protection lies in "in-depth information."  This includes customer transaction habits, specific needs, price tolerance ranges, historical transaction details, personality traits of key contacts, etc. Such information requires enterprises to invest significant time, manpower, and funds, formed through long-term stable transactions or continuous efforts, and is not generally known or easily available to personnel in the relevant field.  Judicial practice has refined this standard through numerous cases: In Case (2018) Zui Gao Fa Min Shen 1273, the court held that customer list information containing product varieties, specifications, quantities, unit prices, and special information reflecting transaction habits and intentions, not ascertainable through public channels, meets the condition of "not known to the public."  In Case (2014) Hu Yi Zhong Min Wu (Zhi) Zhong Zi No. 74, the court further elaborated that a customer list in trade secrets should be comprehensive customer information, including price tolerance, demand types, contact details of project leaders, personality traits, etc., which requires long-term accumulation to form.

IV. Flexibility in Judicial Standards: Protectability of Screened, Potential, and Single Customer Information

Notably, judicial practice also demonstrates flexibility.  For example, regarding screened customer lists, in Case (2017) Zui Gao Fa Min Shen 0192, the court considered that screening a small number of customers with transaction opportunities from a large amount of ordinary information incurs costs, and the list itself may constitute a trade secret.  For potential customers with no actual transactions yet, in Case (2022) Yu 0192 Min Chu 716, the court determined that information such as potential customer phone numbers and project intentions collected through social platforms, due to invested manpower and material resources and not being easily obtainable, constituted trade secrets.  Even for a single customer, in Case (2020) Zui Gao Fa Min Shen 401, the court held that the obligee's in-depth information on a single customer (the Sudanese Ministry of Finance), such as product specifications, models, transaction prices, and other special needs, was a protected trade secret.  These cases collectively indicate that the law protects in-depth information obtained through business efforts and having economic value, regardless of whether it pertains to the obligee's long-term stable customers, one-time transaction customers, or potential customers with no transactions.

V. Corporate Management Recommendations: Building Three Core Lines of Defense for Trade Secret Protection on Customer Information

Facing clear legal risks and determination standards, enterprises should systematically build a protection network for customer information in accordance with legal provisions.  We suggest establishing three core lines of defense: The first is institutional and contractual defense.  Enterprises should, in line with the requirement of "taking corresponding confidentiality measures" under the Anti-Unfair Competition Law, formulate detailed confidentiality systems, enter into stringent Confidentiality Agreements and Non-Competition Agreements with personnel with access to secrets, supplemented by regular compliance training, to delineate behavioral boundaries in terms of awareness and contract.  The second is technical control defense.  Through technical means such as tiered authorization for information access, encrypted storage of confidential data, prohibition of transmission via insecure channels, and establishment of operational log auditing, implement confidentiality measures to satisfy the legal element of trade secrets being "for which the right holder has taken corresponding confidentiality measures."  The third is departure control defense.  Strictly enforce work handover, equipment recovery, and data cleansing, require signing of Departure Confidentiality Undertakings, and promptly handle system permissions to ensure trade secrets are not lost due to personnel turnover.

VI. A Constant Warning: Severe Legal Consequences of Infringing on Customer Trade Secrets

Furthermore, we must be clearly aware that the legal consequences of infringing on customer information trade secrets are extremely severe.  According to Article 22 of the Anti-Unfair Competition Law, the infringer shall bear civil liabilities such as compensation for losses.  The amount of compensation may be determined with reference to the actual losses of the obligee or the benefits gained by the infringer.  If the circumstances are serious, the amount of compensation may be up to five times the amount determined as aforementioned.  If the infringement causes significant losses to the obligee, according to Article 219 of the Criminal Law, it may also constitute the crime of infringing trade secrets, facing criminal punishment of up to ten years of imprisonment and a fine.  This would be an unbearable burden for both individuals and enterprises.  Therefore, the protection of customer information, as an "invisible moat" built through long-term investment by enterprises and explicitly protected by law, must be elevated to a strategic level.  Only by internalizing the rules revealed by legal provisions and judicial cases into rigorous management systems and daily codes of conduct can enterprises effectively safeguard this core asset and ensure sustainable development on a compliant track.