Database Rights and Trade Secrets

The legal framework

There is no single right in "data". Protection comes from three regimes that can overlap, plus contract.

The sui generis database right

Directive 96/9/EC grants the maker of a database a right of its own, independent of copyright. Every member state has transposed it. Its conditions are:

• The database is a collection of independent works, data or other materials, systematically or methodically arranged and individually accessible.
• There has been a substantial investment, qualitative or quantitative, in the obtaining, verification or presentation of the contents (Article 7(1)).

The right lets the maker prevent extraction or re-utilisation of the whole or a substantial part of the contents, and also the repeated and systematic extraction of insubstantial parts that conflicts with normal exploitation (Article 7(1) and (5)). It lasts 15 years from completion, and a substantial new investment, such as a major update, can start a new term (Article 10).

The Court of Justice has limited the right. In British Horseracing Board v William Hill (C-203/02), it held that "obtaining" refers to collecting existing materials, not creating the data. The cost of generating data, such as fixture lists or sensor readings made by the maker itself, does not count. Only the investment in seeking out and collecting independent materials, verifying them and presenting them counts. That is why many machine-generated datasets fall outside the right.

Copyright

Copyright protects a database whose selection or arrangement is the author's own intellectual creation (Article 3 of the Directive). It protects structure, not the data. A comprehensive but mechanical listing is rarely original. Software that runs the database is separately protected by copyright.

Trade secrets

Directive (EU) 2016/943, transposed by every member state, protects information that:

• is secret, meaning not generally known or readily accessible to people in the relevant circles;
• has commercial value because it is secret; and
• has been subject to reasonable steps under the circumstances to keep it secret (Article 2(1)).

Acquisition by independent discovery or reverse engineering of a lawfully obtained product is lawful (Article 3). Unlawful acquisition, use or disclosure gives rise to injunctions, damages and the destruction of infringing goods. The weak point is the third condition. Secrecy that is not actively managed is hard to prove.

Contract

Where neither right applies, contract and technical measures remain. In Ryanair v PR Aviation (C-30/14), the Court held that the Directive does not prevent the owner of a database that is not protected by it from setting contractual limits on its use. Terms of use, API terms and licences are therefore an important tool, though they bind only those who accepted them.

The Data Act

The EU Data Act changes the picture for connected products. The database right does not apply to databases containing data obtained from or generated by a connected product or related service (Article 43), and data holders must share such data with users on request. Trade secrets are respected, but sharing requires agreed safeguards.

In practice

A start-up compiles a catalogue of 200,000 product records by sourcing, checking and standardising information from many suppliers. A competitor copies the catalogue through automated scraping. The start-up has documented its investment in collecting and verifying the data and can invoke the database right against extraction of a substantial part. Its terms of use, which prohibit scraping, add a contractual claim.

A logistics firm sells vehicles that record their own telemetry. A database of that telemetry is generated by the products themselves. The firm should not count on the database right, and under the Data Act customers can ask for access. Its protection lies in contract terms, in confidentiality for the analytical models it builds on top, and in the trade secret status of those models.

A consultancy shares a pricing model with a client, without a written confidentiality clause, and the client forwards it to a competitor. Because it took no reasonable steps to keep the model secret, it will struggle to prove a trade secret.

Frequently asked questions

Do we have to register a database right?

No. The right arises automatically if the investment condition is met. What helps is evidence of the investment: budgets, staff time, verification procedures and dated versions.

Is a list of customers a trade secret?

It can be, if it is not generally known, has commercial value, and you have taken reasonable steps such as restricted access and confidentiality clauses.

Can I stop someone who scrapes publicly available data?

Possibly, under the database right if they take a substantial part, or under contract if they accepted your terms. Technical measures and clear terms improve your position.

Does using a public AI tool endanger a trade secret?

It can, if confidential information is entered without suitable contractual and technical safeguards. Check the vendor's terms on data use and retention.

How this connects

We turn this framework into protection and contracts through data and database rights protection, and into controlled commercial use through data licensing and sharing. The contract review tests agreements for ownership, use and confidentiality clauses, the Document Studio prepares the terms, and the rights and obligations register tracks the duties after signature. See also the EU Data Act.