Protecting Customer Lists and Proprietary Data Under the Oregon Uniform Trade Secrets Act

In today's digital economy, a company's most valuable assets are rarely the physical desks or computers; they are the intangible data, client rosters, software code, and manufacturing formulas that give the business its competitive edge. When a key employee resigns to join a competitor or start their own firm, the threat of intellectual property theft is immense. Fortunately, the Oregon Uniform Trade Secrets Act (OUTSA) provides robust legal remedies for businesses.

However, the law only helps those who help themselves. You cannot wait until a data breach occurs to start caring about security. To ensure your proprietary data holds up to legal scrutiny in court, you must establish preventative HR and IT strategies immediately. Consulting an experienced Oregon intellectual property and business lawyer found in our directory can help you implement protocols that satisfy statutory requirements and deter data theft.

What Qualifies as a Trade Secret in Oregon?

Under Or. Rev. Stat. § 646.461, a trade secret is defined as information (including a drawing, cost data, customer list, formula, or program) that derives independent economic value from not being generally known to the public, and is the subject of efforts that are reasonable under the circumstances to maintain its secrecy.

The critical phrase here is 'reasonable efforts.' If an Oregon judge finds that you left your highly valuable manufacturing formula sitting on a public server with no password protection, they will rule that it is not a trade secret. This precedent has been tested in cases like Pelican Bay Forest Products, Inc. v. Western Timber Products, Inc., 297 Or. App. 417 (OR Court of Appeals 2019), which emphasized that a customer list is only a trade secret if the employer actively protects it from public disclosure.

Safeguarding IT Source Code

For tech startups in Portland or Beaverton, software source code is the lifeblood of the company. To protect code under OUTSA, companies must restrict access strictly on a 'need-to-know' basis. Developers should not have access to repositories outside their specific project scope. Furthermore, code repositories must be encrypted, and developers must be required to sign robust Non-Disclosure Agreements (NDAs) before they are given access credentials.

Protecting Manufacturing Formulas

Whether you operate a craft brewery in Bend or a specialty manufacturing plant in Salem, unique recipes, formulas, and production processes must be guarded. Physical security is just as important as digital security. Formulas should be kept in locked filing cabinets or secure digital vaults. Access should require two-factor authentication, and visitors to the manufacturing floor should be required to sign an NDA and be escorted at all times to prevent unauthorized photography or observation.

Securing Client Rosters and Sales Data

A simple list of names and phone numbers pulled from a public phone book is not a trade secret. However, a curated CRM database containing client purchase histories, pricing tolerances, decision-maker contact preferences, and contract renewal dates is highly protectable. To ensure your CRM qualifies under the law, you must prohibit employees from downloading or exporting the database to personal hard drives or personal cloud storage accounts.

Best Practices for Physical and Digital Security

To prove to a court like the Washington County Circuit Court, Hillsboro that you took 'reasonable efforts' to maintain secrecy, implement the following protocols:

• Labeling: Physically and digitally stamp all sensitive documents with the words 'CONFIDENTIAL' or 'TRADE SECRET.'
• Access Logs: Use IT systems that track and log exactly who opens, edits, or downloads sensitive files, and when they do it.
• Password Policies: Enforce mandatory, complex password changes every 90 days and implement two-factor authentication for all remote access.
• Employee Training: Conduct annual training sessions reminding employees of their ongoing confidentiality obligations.

Essential Off-Boarding Procedures for Departing Staff

The most dangerous moment for a company's data is the two weeks after an employee gives notice. A strict off-boarding procedure is your best legal defense against misappropriation.

• Step 1: Immediate IT Triage. The moment notice is given, IT must immediately revoke the employee's access to highly sensitive trade secrets, remote VPNs, and CRM export privileges.
• Step 2: Device Return. Demand the immediate return of all company-owned laptops, flash drives, and cell phones. Have your IT department conduct a forensic review of the devices to check for massive data transfers immediately prior to resignation.
• Step 3: The Exit Interview. Conduct a formal exit interview. Provide the employee with a copy of the NDA they signed upon hiring. Have them sign a written acknowledgment that they have returned all company property and possess no confidential data.
• Step 4: Threat Assessment. If you discover evidence of data theft, your lawyer can immediately file an ex parte motion for a temporary restraining order under ORCP 79 to legally compel the former employee to return the stolen data before they can use it at their new job.

Frequently Asked Questions (FAQ)