(123rf.com image)
Employee theft of trade secrets is not only on the rise
but is now easier than ever before due to widespread access to rapidly evolving
and affordable technology. Employees continue to use personal email
accounts, thumb drives, phone cameras, personal cloud-based accounts (such as
OneDrive, Google Drive, and iCloud), and external hard drives to mass-transfer,
store, and retain their employer’s trade secret information post-separation.
But are these types of technological advances the biggest threat to trade
secret protection?
With the rise in popularity and availability of
generative artificial intelligence (“gen AI”), many employers fear that
safeguarding their trade secret information in the future may become even more
difficult.
How employees are using gen AI in the
workplace
Employers may be surprised to hear that, according to one
survey recently conducted by McKinsey & Company, 61 percent of workers are
either using or plan to use Gen AI in conjunction with their work. In
some instances, employee use of AI is employer-driven, such as where employers
automate information/knowledge management or customer service
functions. But in many instances, employee use of AI is employee-driven,
and the employer may even be unaware of its use. Also according to McKinsey
& Company, at least three times more employees are using gen AI for a third
or more of their work than their leaders imagine, with millennials 1.4 times
more likely to report extensive familiarity with AI tools than peers in other
age groups.
For example, employees are using chatbots such as ChatGPT
to draft documents and other content for work purposes, with some even
inputting their employer’s confidential code and asking the chatbot to fix
errors. Otter AI Chat is another popular chatbot used by employees to
obtain real-time automated transcription and summarization of workplace
meetings. Not only do these chatbots retain and store the information
input, in many instances they use the information to “learn” and generate
future output that they provide to other unrelated users.
As of early April 2025, ChatGPT reported having more than
800 million users, with more ChatGPT users (upwards of 67 million) located in
the United States than in any other country. At present Otter AI reports
having upwards of 25 million users worldwide, with the tool having transcribed
more than 1 billion meetings.
How Gen AI could threaten trade secret
protection
An employee’s public disclosure of a trade secret —
including via gen AI — could, potentially, destroy the “secret” nature of the
item, stripping it of protection under the federal Defend Trade Secrets Act
(“DTSA”) and other very similar and widely-adopted state laws. This is
because, for information to receive protection under these laws, a trade
secret’s owner must take reasonable measures to keep the information secret,
and must prove that the information derives independent economic value from not
being generally known or readily ascertainable through proper means by someone
who can obtain economic value from the disclosure or use of the
information.
Widespread or even inadvertent publication on gen AI
platforms will likely prevent a company from meeting this bar. Indeed,
some courts have observed that, once a trade secret is publicly disclosed via
publication on a publicly accessible platform, its owner will be unable to
avail themselves of the DTSA’s protections.
How employers can protect against theft of
trade secrets via gen AI
Standing in stark contrast to the rapid development and
popularity in employee use of gen AI in the workplace is how slowly companies
are recognizing their associated risk, let alone developing a risk mitigation
plan. As noted above, employers are obligated to take reasonable measures
to protect their trade secrets from public disclosure, else the information can
lose its trade secret status. This means that employers must stay abreast
of the rapidly changing gen AI tools that their employees may potentially use
to publicly disclose their trade secrets. Further, because many employers
are unaware that their employees are even using gen AI tools in conjunction
with their work, employers often miss that a departing employee could retain
confidential information in various personal chatbot and other gen AI accounts
post-separation.
Failure to demand and ensure the return and/or
destruction of any such information may also undermine its trade secret status
and expose its owner to an argument that it failed to take required reasonable
measures.
Employers should regularly and openly communicate their
expectations to employees regarding the permissible and impermissible use of
gen AI in conjunction with their work, and explain the risks presented to the
company and to the employee individually if they fail to comply. Many
employers elect to include these provisions in employment or confidentiality
agreements. Employers should also carefully draft and implement internal
policies governing the permissible use of AI. These policies should
specify what gen AI services employees may and may not use in conjunction with
work, with greater — if not outright — restrictions on employee use of publicly
available systems that cannot or do not distinguish between confidential and
non-confidential input.
Employers may also elect to implement automated IT
features that prohibit employees from uploading more than a certain volume of
information to a gen AI platform using company-owned devices or servers, or
that notify IT when an employee is frequently accessing or uploading data to
such a platform. Employers must also regularly train employees on what
constitutes confidential and trade secret information and, where possible,
include clear labeling of the information as such, so that employees understand
what they may and may not share with gen AI. Of course, some companies also
elect to build and input information into their own gen AI app, and grant
limited access to such applications on a need-to-know basis within the
company.
In sum, employers must continue to monitor changing
technology and, accordingly, adapt the measures they take to protect their
trade secrets from disclosure and preserve their secret nature. Provided
employers do so, they will retain strong arguments that they took reasonable
measures to protect their trade secret information, despite the rise in
employee use — and potential abuse — of gen AI.
Jennifer S. Cluverius is a shareholder with Maynard Nexsen.
