NDAs and NDAAs: Protecting Sensitive Data in a Competitive Market

NDAs and NDAAs: Protecting Sensitive Data in a Competitive Market

The recent filing of a lawsuit in a Texas federal court has shed light on the problems that can arise when two competitors share sensitive information through Non-Disclosure and Access Agreements (NDAAs). At its core, the case involves Cognizant Technology Solutions accusing India-based Infosys of misusing trade secrets obtained from TriZetto, a software company owned by Cognizant.

The lawsuit centers on the idea that Infosys gained access to sensitive technology details about TriZetto’s proprietary software under the guise of NDAAs. Despite strict definitions of authorized access and limited purposes, Infosys allegedly misappropriated trade secrets and used them to develop or enhance its own competing software offerings.

Risks of Sharing Sensitive Data

For CIOs, this case raises important questions about how far a contract will protect a company when sensitive data is shared with a potential rival. The typical element of an NDA violation is not at issue here — there’s no accusation that Infosys officials shared the sensitive data with anyone outside their company.

The complaint alleges that they misused the information, highlighting the risk of extrapolation, which is typically referred to in legal circles as the fruit of the poisonous tree. In law enforcement cases, if some piece of information is improperly obtained, not only can that information not be used, but anything that is obtained because of that information is also blocked.

Managing NDA/NDAAs Effectively

Larry Levine, an attorney who serves as an Ernst & Young managing director, emphasizes the importance of considering these agreements realistically. Companies should ask themselves ‘Does it make sense to go ahead with this course of business?’ and whether they have a high degree of trust in the other side.

Levine advises companies to narrow the information they are sharing so there is less potential harm. Another attorney, Mark Rasch, recommends putting in place extreme separation efforts when receiving restricted information from potential rivals.

Best Practices for CIOs

Rasch suggests that CIOs focus on what an agreement says and what it does not spell out. He advises enterprises to discuss this and negotiate it at the onset, but noted that he hardly ever sees that happening.

For companies receiving sensitive information from potential rivals, Rasch recommends extreme separation efforts, such as assigning an entirely new team to receive the restricted information and walling off one project from another.