The Unlawful Copying by Third Parties of the Customer List - Partner List of an Enterprise in the Light of Criminal Law

Legal Insight

May 2022

Daphne Sfyri, LL.M

Summary: The trade secret of a business is protected by our legal system because of the significant economic value contained in it. The unauthorized and illegal copying of trade secret data, such as a company's partner and customer lists, is punishable - under certain conditions - by our Criminal Code and is part of the broader concept of espionage in business.

Every business is required to disclose certain information about its activities that is required by law for the security of transactions and in the general public interest. Beyond that, however, each undertaking is entitled to choose which information will or will not be made accessible to all, when and how. In other words, it has the right to choose to protect certain data when it is deemed necessary. However, there is no doubt that the illegal appropriation or disclosure of business secrets of companies to third-party competitors for financial reward has become particularly worrying nowadays, thereby undermining the development of a healthy, competitive and innovative economy. Such actions fall within the broader concept of espionage in the field of business. More specifically, the following phenomenon is often encountered in practice: Former employees and associates of companies with a wide range of clients/partners who had access to trade secrets in the course of their duties - after their departure or even before the termination of their cooperation - enter the information systems of companies and subsequently copy their trade secrets, in particular those of their clients/partners. How and why, then, are businesses protected against such illegal tactics? What does the law provide for in such cases? These are precisely the questions addressed in this article.

To begin with, the customer and partner lists are one of the most basic manifestations of a company's commercial confidentiality, as they are intended to be known only to the employees of the company for the realisation of its commercial purpose and, indeed, to a specific circle of employees, while there is a strong economic interest in not disclosing them to third parties, in particular to competitors. It is a fact that the acquisition of a stable and large customer base requires each undertaking to make a considerable and long-term effort, which is valued financially at very significant sums. The same entrepreneurial effort is, of course, also required in the formation of a company's partner list. They are therefore assets of considerable economic value to the undertaking, the violation of whose confidentiality leads to the facilitation of competitors, since the latter make no business effort to form their own list of customers and partners. They are able to compete with the undertaking from day one without incurring any development and/or expansion costs. On the contrary, by acquiring the customer/partner list in this way and by knowing the specific data, they can at any time in the future address these customers/partners and approach them in order to include them in their own customer/partner list. They know from the inside the particularities of each cooperation with each customer and partner and are able to propose 'more favourable' cooperation proposals by improving targeted terms. Similarly, they carry out their business activities by selecting partners and customers whose efficiency and solvency have already been 'tested' and established through another company. 

Having therefore analysed the economic value for each undertaking of its customer/partner list, the criminal implications of such illegal actions and the dissemination of trade secrets are analysed below:

1. Initially, according to Article 370C PC par. 1 and 2: "2. Whoever unlawfully copies, reproduces, copies, uses, discloses to a third party or in any way violates computer data or computer programs which constitute state, scientific or professional secrets or secrets of a public or private sector enterprise, shall be punished by imprisonment of at least three months. Those which the lawful holder of the information treats as secrets out of a legitimate interest, in particular when he has taken measures to prevent third parties from gaining knowledge of them, shall also be regarded as secrets. 2. If the perpetrator is in the service of the holder of the data, as well as if the secret is of particularly great economic importance, imprisonment of at least one year shall be imposed". 

The crime of Article 370C of the Penal Code is partly common, since its subject may be any natural person and partly non-genuine particular because of the special relationship between the perpetrator and the holder of the data, which acts as an aggravating circumstance and increases the criminality of the first paragraph of the common crime of the provision of Article 370C of the Penal Code. Simply put, under the above conditions, if the perpetrator of the crime is in the service of the trade secrets holder, then the act is punished more severely with a minimum of one year's imprisonment instead of three months. 

The criminal conduct of the perpetrator anticipates the existence of muscular movement and therefore constitutes an energy crime, instantaneous, since its completion takes place at a certain moment of "copying", "imprinting", "using", "disclosing" to a third party, or "definitely tampering" with computer data or programs. In addition, the crime of Article 370C PC is defined as an abstract risk, i.e. it is not necessary to prove the actual occurrence of a risk, but it is sufficient to meet the elements of the objective basis of the article.

The object of the crime is "computer data or computer programs which constitute state, scientific or professional secrets or the secrets of a public or private sector enterprise". With regard to the meaning of the terms 'computer program or data', such data shall be deemed to be those which have a direct link only with the concept of software, which includes the set of information or data of computer programs and their components, i.e. computer components. As far as protected secrets are concerned, this includes, inter alia, the secrets of a public or private sector undertaking. At this point, it should be clarified that the acts provided for in Article 370C of the PC are prosecuted exclusively by means of a complaint.

In any case, it should be stressed that the relevant issue is also regulated by the provisions of Law 146/1914. However, to a very significant extent the provisions of Law 146/1914 are overlapped by the offences of the Penal Code.

Relevant to the issue of the protection of the clientele of a business is also the decision of the Supreme Court (Sixth Criminal Chamber) No. 121/2003, according to which "the two appellants, who in their capacity as such had access to the files of the installer's computer, acting together and with common malice, copied onto floppy disks the clientele of the installer which was registered in the above-mentioned program and constituted a trade secret, with the aim of using it in the family business of general tourism which they set up after the appellant left the office of the installer on 29-12-1995, which they did by sending to those clients of the installer information leaflets and letters concerning ticket prices, offers, etc. With these considerations, the Court of Appeal declared the appellants guilty of violating Article 370 B(1) and (2) of the PC , namely that they, while in the service of the instigator, unintentionally copied and used a computer program that was a trade secret of the instigator. The Court of Appeal accepted that the contested judgment contains a specific and comprehensive statement of reasons in the above sense, since it sets out in full and clearly the facts constituting the objective and subjective circumstances of the offence in question and, moreover, correctly interpreted and applied the abovementioned substantive criminal provision, which it did not breach even indirectly. In particular, the assumptions of the judgment concerning the above-mentioned professional secrecy are clear and compatible, which does not concern the names, addresses and other details of the persons registered in the above-mentioned programme which the appellants unintentionally copied, but concerns, according to those assumptions, their status as customers of the business of the person who initiated the proceedings, that is to say, persons interested in making travel arrangements. That status of those persons refers to the business of the instigator as the holder of the programme and was known, according to the assumptions of the judgment, as registered in the programme only to the instigator and the appellants. The Court of Appeal's assumption that that list of customers, which was entered in the computer program, constituted a trade secret of the instigator's business also contains an element of the will of the instigator, as the owner of the program, to keep secret the status of those persons as customers of his business".

2. At the same time, it should be stressed that, if personal data of natural persons are found within trade secrets, the offence of communicating personal data to non-entitled persons for the purpose of illegal pecuniary gain is also committed.

More specifically, according to Article 38 of Law no. 4624/2019: "1. Anyone who, without right: (a) interferes in any way with a personal data filing system, and by this act takes knowledge of such data; (b) copies, removes, alters, damages, collects, registers, organizes, structures, stores, adapts, modifies, retrieves, searches for information, correlates, combines, restricts, deletes, destroys, shall be punished by imprisonment for up to one (1) year, if the act is not punished more severely by another provision. " and "2. Whoever uses, transmits, disseminates, communicates by transmission, makes available, communicates or makes accessible to non-entitled persons personal data, which he acquired pursuant to subparagraph 1, letter a), or allows non-entitled persons to obtain knowledge of such data, shall be punished by imprisonment, if the act is not punished more severely by another provision." 

The above mentioned disposal/disclosure of personal data of natural persons is punishable when it is carried out without right, i.e. by a person who is not entitled to process the data or by extension of the limits of his or her competence. The offender is, of course, the natural person to whom the personal data belong, but criminal proceedings can also be initiated ex officio, since the law does not require the filing of a criminal complaint.

Furthermore, according to par. 4 of the same article: "4. The perpetrator of the acts of the preceding paragraphs shall be punished with imprisonment of up to ten (10) years, if he intended to obtain for himself or another illegal pecuniary benefit or to cause pecuniary damage to another or to harm another and the total benefit or the total damage exceeds the amount of one hundred and twenty thousand (120,000) euros." The crime provided for in paragraph 4 is a crime of purpose, because the perpetrator, in addition to the data breach, also seeks an additional result consisting of obtaining an illegal pecuniary benefit or causing pecuniary damage exceeding €120,000. Therefore, in these cases the offender will be punished for the commission of a felony. The illegal processing of a company's trade secrets may - under certain conditions - constitute a felony in the light of the criminal provisions on personal data.

Finally, an undertaking that accepts the violation of its trade secret, apart from the above-mentioned protection under criminal law, is also protected under civil law, but the analysis of the relevant civil claims is beyond the scope of this article. In brief, it is stated that the undertaking is entitled to claim compensation for the damage caused in accordance with the provisions on tort and - subject to certain conditions - for the non-material damage suffered as a result of the infringement of its reputation and credibility, while Article 1 of Law No. 146/1914 on unfair competition, he has the right to claim damages and the cancellation and omission of an act where it is done with a view to competition and is contrary to accepted principles of morality. 

In conclusion, a company's trade secret is an important asset, the violation of which - especially by relevant competitors - can cause significant damage to the owner of the trade secret. For this reason, trade secrets are protected, and the relevant crimes arising from their violation have been standardised in our Criminal Code. In any case, however, it must be stressed that the existing legal framework specifically for the protection of trade secrets does not act as a particular deterrent due to the misdemeanour nature of the crime and needs to be reformed.