Is that information confidential?

By Nicholas Mavrakis and Michael Legg.

Key Points:
A subjective belief of confidentiality, while necessary, is not sufficient for the protection of information.

Confidential information is important to businesses as a source of competitive advantage. It may take various forms, including trade secrets, know how and customer databases, all of which a business may wish to protect. Equally, businesses may receive information, such as during a commercial negotiation or transaction that they wish to use but are informed they cannot because it is confidential.

Autodata Limited v Boyce's Automotive Data Pty Limited [2007] FCA 1517 provides a timely reminder that for information to be protected as confidential, it must not only be regarded as confidential by the persons seeking to protect it, but must also be objectively confidential. This means it must have the necessary quality of confidence about it, that is, it is not in the public domain.

The information in question

The two parties were in dispute over alleged breaches by Boyce of Autodata's copyright in manuals and CD-ROMs. The parties attended mediation on this matter and a settlement deed was signed. As a condition of settlement, Boyce was required to investigate and implement appropriate measures to address any copying of specific Autodata publications, and prepare a written report for Autodata outlining these investigations and measures.

Boyce claimed that the report contained sensitive information about its internal business actions, procedures and decisions and should thus be afforded protection. Boyce submitted that the bulk of the report either explicitly set out, or was in some way predicated upon, information concerning Boyce's internal business decisions.

Such information included the circumstances in which Boyce conducted the investigations and reached the conclusions in the report, the internal business procedures Boyce was planning to implement to prevent further copyright infringements, and steps taken, or to be taken, to rectify the previous infringements. Notably, these steps included removing all infringing material in current Boyce publications from any future Boyce publications. Boyce also claimed that a small amount of material was information of a personal nature about a Boyce employee.

As the settlement deed did not provide that the report was confidential, Boyce sought to impose confidentiality through correspondence and eventually an application to the court.

Subjective confidentiality

In his decision, Justice Tamberlin explained that the required subjective factor was that the information in relation to which the claim was made must be important or significant "not necessarily in the sense of commercially valuable ... but in the sense that the preservation of its confidentiality or secrecy is of substantial concern to the plaintiff" [emphasis in original].

Justice Tamberlin was satisfied on the basis of evidence that the information the subject of the claim was subjectively confidential. In arriving at this conclusion, he noted that the report had been marked "Confidential" by Boyce, and that correspondence between the parties had indicated Boyce's concern that the information in the report would be disclosed to the public. Importantly, Justice Tamberlin was "persuaded that Boyce believe[d] that the information [was] important to its business and confidential in nature".

Objective confidentiality

Once subjective confidentiality had been established, the issue according to Justice Tamberlin, was whether "the information, considered objectively, [could] be said to have the requisite degree of confidentiality".

Justice Tamberlin accepted that information in the report pertaining to an employee's health could be properly classified as confidential. However he restricted protection to this section of the report only. The remainder of the report was held to be either already in the public domain, or of an "ordinary nature".

The finding that the majority of information in the report was already in the public domain was based on evidence that a previous, openly available publication, had effectively disclosed the information. Justice Tamberlin stated that "any member of the public is able to compare the two relevant versions and ascertain what has been removed, thereby stripping the information of the objective quality of confidence which grounds the granting of a confidentiality order". The remainder of material in the report that, according to Boyce, disclosed its internal business procedures, was said to be of an "ordinary nature" as it was "expressed very broadly and in the abstract".

Accordingly, in both instances Justice Tamberlin held that the information could not, objectively considered, "be considered to possess the necessary degree of confidence to warrant an order restraining its disclosure".

Conclusion

The above examination of Autodata highlights that a subjective belief of confidentiality, while necessary, is not sufficient for the protection of information. Despite Boyce's efforts to impose confidentiality through correspondence and the marking of the report as "Confidential", the lack of objective confidentiality was fatal to the claim.

Thanks to Brianna Quinn for her help in writing this article.

For further information, please contact Nicholas Mavrakis and Michael Legg.