While it will likely be a year or more before a final regulation takes effect, and there will almost certainly be amendments along the way, American companies – including those involved in the field of personalized medicine, where personal data is paramount by definition – should start paying attention now, since they may have to change the way that they do business in Europe.

We will provide a more detailed analysis of the Draft Regulation at a later date. In the meantime, here are some of the key issues we are examining:

• It is significant that the Commission is acting by Regulation rather than Directive (as was the case with the current privacy law, enacted by Directive in 1995). A regulation is top-down, imposed uniformly throughout the EU, whereas a directive is adopted country-by-country, which gives individual nations the chance to make adjustments.
• The EU is taking a very aggressive approach to jurisdiction, or its authority to regulate—and impose penalties on—U.S. and other foreign companies that do business in Europe. The Draft Regulation would cover all data processing activities (very broadly defined) by non-EU companies that involve offering goods or services to EU data subjects or monitoring their behavior.
• Data subjects (also broadly defined) will have significantly more rights than under current EU law. For example, the company will have the burden of proving that every subject has given consent for the processing of their data for specified purposes. Consent is defined as “any freely given specific, informed and explicit [emphasis added] indication of will,” and can be withdrawn at any time. The subject will also have a controversial “right to be forgotten and to erasure.” This means that when the subject withdraws consent or “the data are no longer necessary” for the purposes for which they were collected, the company must render the data inaccessible, including on the Internet.
• Along with data pertaining to race or ethnic origin, political opinions, religion or beliefs and trade-union membership, the Draft Regulation identifies “genetic data” as category of personal data designated for special protection. (The Draft Regulation defines “genetic data” broadly to include “all data, of whatever type, concerning the characteristics of an individual that are inherited or acquired during early prenatal development,” thus presumptively sweeping in all genetic information as well as family medical histories and other related health information.) Special protections include impact assessment and prior authorization of data processing operations, and activities lacking sufficient identification or mitigation of risks to individuals may be prohibited.

These are just a few of the more important features of the 96-page, 91-Article Regulation.

Elsewhere, the Draft Regulation would create other new rights and responsibilities and reaffirm and/or strengthen many provisions of existing law, including the current restrictions on transferring data outside of the EU. Ironically, the Draft Regulation notes that the “practical challenges to enforcing data protection legislation” across boundaries and the “risk of different levels of protection…creat[ing] restrictions on cross-border flows of personal data” between jurisdictions. While the Draft Regulation may ease some of these concerns within the EU, global companies seeking to move personal data in and out of the EU face a different calculus.

The draft must now be reviewed by several Directorates of the EU Commission before being submitted for review and approval by the Parliament and Council. But while full implementation will take some time—more than a year in most estimates—the proposed changes are so dramatic and far-reaching that U.S. companies doing business in Europe will require at least that much lead time to plan their compliance.

There are two key issues to consider when evaluating trade secret protection: what type of information can an entrepreneur protect and what does she have to do to protect it? In general, any information can be a trade secret if (1) it is non-public information that has value because it is not publicly known and (2) the holder of the information is taking adequate steps to hold it in confidence. Trade secrets can include things as diverse as business plans, business contacts, financial analysis, inventions, formulas, designs and methods.

Non-public Information. The first prong of this test may seem obvious. Publicly available information cannot be a trade secret. And even non-public information does not qualify as a trade secret if there is no value in keeping it secret.

However, the requirement that trade secrets be non-public can actually present difficult choices in choosing between the maintenance of a trade secret and the public disclosure of information in a patent application or issued patent. Assume for example that an inventor develops a novel and complex method of making genomic sequencing more efficient. Whether the entrepreneur should pursue a patent or trade secret approach—or even a combination of the two—will depend on the specific nature of the invention and the commercial realities.

The first question to ask is whether secrecy will really be an option. Would the novel method have to be disclosed to commercialize it or could the entrepreneur practicably commercialize the development by keeping the method secret while using it to provide sequencing results to customers (including researchers, individual consumers or patients, and healthcare providers)? Would users, payors, regulators or other stakeholders demand to review and understand the method to confirm its validity? Even if secrecy is a viable option, is it a better option than patent protection? It is important to remember that there can be a wide gap between the relative ease of filing a patent application with broad claims and actually obtaining a meaningful patent. Is the new method unique enough that the entrepreneur has a chance of obtaining a broad patent or would any granted patent likely be so limited that competitors could avoid the patent by “inventing around it”? Does the entrepreneur have the resources to pursue and maintain patent protection?

Even if it is clear that patent protection is the best long term choice, there may be twists and turns in developing the best strategy. In some cases, trade secret protection may be a useful way to augment patent protection. For example, if an inventor files a patent application in the United States, there will be a limited period of time (generally eighteen months) during which information in the application is not publicly available and can be treated as a trade secret. If this provides a meaningful head start for the business, it may be able to have the best of both worlds: short term trade secret protection and long term patent protection. In other cases, trade secret protection may be a necessary first step in obtaining patent protection. A patent is barred if the invention is in “public use” or “on sale” for more than a year before the patent application is filed, so it may be essential to keep any early stage prototypes and customer testing confidential to avoid losing the patent option.

The “no public information” requirement will also limit trade secret protection for information that can be easily “reverse engineered” by legal means. For example, an inventor may view the design of her product as confidential and proprietary. But if any purchaser of the product can reconstruct the design merely by measurement and observation, that trade secret will be lost.

Adequate Protection. The second prong of the trade secret test is often the undoing of entrepreneurs: the requirement that the trade secret owner take reasonable steps to maintain the secrecy of the trade secret. Much of this is common sense. Confidential information must actually be held in confidence. This means the trade secret owner should keep the written or electronic documentation of the trade secret in a secure place, limit copies and avoid unnecessary disclosure. It accomplishes nothing to stamp documents as “CONFIDENTIAL” and then carelessly leave them lying around accessible to anyone who takes the time to look, and the entrepreneur will run an unnecessary risk that the trade secret will be lost if it is stored in unencrypted form on a laptop that is not password protected.

Confidentiality agreements are critical. The starting point should be enforceable agreements with every employee and contractor involved in the business. Beyond that, it is important to require third parties to sign confidentiality agreements whenever they need access to the trade secret. This can encompass a diverse group of people, including potential investors, suppliers, customers and service providers.

Finally, timing is everything. In trade secret law, it is important to remember the oft-quoted adage that “you can’t shut the barn door after the horse escapes.” Once a trade secret has been publicly disclosed, the trade secret protection is permanently lost and cannot be resurrected by tardy attempts at secrecy. There is no substitute for the entrepreneur paying careful attention to trade secret protection at a very early stage of the business’ life.

For the purpose of this post, we assume that the entrepreneur has already taken the required steps to be sure the company owns all necessary rights in the invention. (See our earlier Bench to Market articles: “What Happens When Professors Have Valuable Inventions?” and “Don’t Overlook Agreements with the Inventors.”) How can she now have the discussions with outside parties (such as venture capital firms) that may be necessary to commercialize the invention, without risking the loss of important intellectual property rights?

The most obvious answer is to use a well-written confidentiality agreement that restricts the right of the other party to use or disclose any proprietary information relating to the invention. While this approach has the advantage of being very low cost, there are limits to its use. Many potential investors will be in the business of evaluating multiple opportunities and they will simply refuse to sign any confidentiality agreement that might limit those activities. A negotiated confidentiality agreement that the other party will agree to sign may have loopholes that permit some kinds of disclosure. Even with a well written agreement, it can be difficult to prove that the other party acquired the suspect information from the entrepreneur as opposed to some other legitimate source. Our entrepreneur could be understandably nervous about relying solely on a confidentiality agreement for protection.

What are the other options? Most entrepreneurs know that patents offer potentially powerful protection of an invention, but obtaining a patent can be too expensive to be practical at an early stage of product development. A provisional patent application may be the answer, at a much lower cost.

A provisional patent application is a “placeholder” that allows the entrepreneur to start the process of seeking a patent, without a major expenditure, and to establish a filing date that can help protect against theft of the invention. Filing a provisional patent application also permits the entrepreneur to use the term “Patent Pending” with respect to the invention, which may be useful in dealing with other parties.

The application process is not complicated, requiring only an informal document that can be prepared without the help of an attorney. The entrepreneur need not identify exactly what aspects of the invention are claimed to be patentable nor specify the types of formal “claims” that are at the heart of a full patent application. Some other formal requirements of a full patent application, such as an oath or declaration, also can be omitted. To file a provisional patent application, the entrepreneur must simply prepare a basic written description of the invention and how it will be used. If the invention is a product, the description must include the manner and process of making it. The description can be in normal non-legal language, but it must be full, clear, concise, and exact. The test for adequacy is whether a person skilled in the field of the invention could make and use the invention after reading the description. If there are multiple ways in which the invention could be used, the provisional patent application must set forth what the inventor thinks is the “best mode” of use. A drawing must be included if it is reasonably necessary for a person to understand the invention.

Applications can be filed with the Patent and Trademark Office on-line or in written form. The PTO website includes links to all of the required forms and instructions.

There are limits on the use of provisional patent applications. A provisional patent application is temporary in nature. It is not examined by the PTO on its merits and lapses twelve months from its filing date. To obtain a patent, the entrepreneur must follow up by filing a non-provisional patent application (a much more expensive full application using a licensed patent attorney) within the twelve-month window. An entrepreneur who misses that deadline can no longer use the “Patent Pending” designation and loses the right to use the earlier priority date of the provisional patent application. More significantly, the entrepreneur could lose the right to seek a patent on the invention altogether if she has publicly attempted to commercialize the invention during the twelve-month period. In that case, the invention might be considered to have been “in use” or “on sale” for more than twelve months at the time the provisional application lapses, thus barring the grant of a patent.

Finally, even though no attorney is required for the provisional patent process, there may be times when the entrepreneur decides that using an attorney, at least in a limited way, makes sense. While the description of the invention in the provisional application may be informal, it needs to be broad enough to adequately support the claims in any later-filed non-provisional application. This is a potentially daunting task for a non-lawyer since the scope of some biotechnology method patents (medical diagnostic techniques, for example) is uncertain pending the Supreme Court’s decision in In re Bilski. Whether the cost of an attorney can be justified may depend on whether the entrepreneur’s primary goal is merely to protect the invention while assessing its value or to maximize the potential scope of any patent that is ultimately granted.

The participants often do not worry much about this until the day when something potentially valuable is discovered. Then the world changes. Suddenly the participants are focused on allocating rights (including the now important economic rights) to the invention. As they move to the likely next stage of seeking venture capital, they will be asked to prove that the development company owns the invention that it is trying to commercialize. Any misunderstanding about the rights to the invention can become a major problem if they are not addressed before this point.

How can early stage entrepreneurs handle this potentially difficult problem at an acceptable cost? The answer is clear and deceptively simple. From the start of a project, there should be written agreements in place that expressly assign all relevant intellectual property rights to the development company and allocate the various rights of the participants.

Under patent law, our starting point in reaching this conclusion is clear. Unless there is an exception, the individual inventor, and not the company, owns the patent rights to any invention. One common exception is the “hired to invent” doctrine which makes the company the owner of the patent if the employee was specifically hired or assigned duties for the purpose of using his or her inventive facilities to address the specific problem that resulted in the invention. Another exception is the equitable right of the company to force certain company owners and insiders to assign patent rights to the company. Even if an individual inventor is deemed to own the invention, the company may in some circumstances have limited “shop rights”, which is a nonexclusive royalty-free right to exploit the invention. Finally, if multiple inventors are involved, each joint inventor may have the right to freely exploit the invention on his or her own, without any permission from the other inventors.

After the development company examines the application of all of these doctrines, it may think it has a reasonably good idea of what rights it will own. The problem with relying on these doctrines and their various exceptions, however, is that they all raise difficult factual and equitable issues. This means there will be less certainty about who owns the rights. Venture capital investors usually hate uncertainty, and may well force the company to solve that problem by getting agreements with the inventors. Sadly, agreements that everyone was eager to sign at the start, when the company’s project was just a hopeful idea, may look much less attractive to the inventors when real dollars are involved.

Even obtaining signed agreements from all involved may not solve all of your problems, and there will still be some areas of potential concern. First, inventors can only assign the rights they own. If the invention is really just an improvement to an earlier invention, you can not ignore the rights of the earlier inventors. If development started while the inventors were employed by other companies, you cannot ignore the possibility that another company will have rights in the invention. This is a complicated problem and one that does not lend itself to easy low-cost solutions. But, even at an early stage in the project, you should ask the necessary questions to understand the scope of this problem and be sure the direction of your development plan makes sense, given any potentially conflicting rights.

Finally, if you are going to rely on agreements, you should be sure they are enforceable. This is usually not a problem so long as the agreements are clear and reasonable in scope. At a minimum, the agreements should have clear and express assignments of all relevant intellectual property rights. Ideally, the agreements will also minimize future arguments by dealing with the allocation of the possible future profits from the commercialization of inventions. To avoid the risk of unenforceability, the agreements should be supported by adequate legal “consideration,” although this is unlikely to be a problem with respect to an agreement with any inventor who will be sharing in the profits from commercialization. Many states limit the scope of permissible assignments, but that is generally not a problem so long as the assignment is limited to inventions relating to the proposed development project, and does not purport to assign rights in unrelated inventions that the inventor develops entirely on his or her own time without any use of company facilities, supplies or trade secrets.

Note: for more about ownership of inventions, see John Conley’s previous post in the Bench to Market series, “What Happens When Professors Have Valuable Inventions.”

Two recent developments may add further fuel to this debate. First, California recently issued a report on the first five months of results from a new state law (effective January 1, 2009) requiring health care organizations in California to report breaches in the security of personally identifiable health information. In publishing the report the California Department of Public Health was surprised at the high volume of reports and confirmed 116 privacy breaches during the five-month period, most of which were inadvertent. Given the early results, the agency expects the number of reported breaches to increase dramatically as organizations become more familiar with their reporting obligations.

Second, two Carnegie Mellon researchers recently published research that calls into question the commonly accepted practice of using social security numbers as a presumably anonymous identifier of user data sets. Previously, much of the concern surrounding this practice centered around ensuring that careless data security practices did not result in the misappropriation of social security numbers. But the Carnegie Mellon report identified a new concern: patterns in the assignment of social security numbers that permitted the researchers to use publicly available information to accurately predict the social security numbers of 8.5 percent of people born after 1988 in no more than 1000 guesses, a feat easily within the capability of many automated data intrusion programs.

These recent developments illustrate the difficult and multi-faceted nature of preserving privacy in an increasingly wired world, in both genomics and in the much broader context of medical and other personal information. While the most common source of problems continues to be human error — the failure to carefully and systematically follow practices and procedures that promote security in handling data — there is an underlying and growing threat to data privacy that is dependent not on human error, but on the very nature of the data itself. In the case of human genomics, the declining cost of genomic sequencing and the rising demand for large-scale databases combining genomic and phenotypic information is driving a proliferation of potentially sensitive data. With at least 19 states providing specific penalties for genetic privacy violations, governments, academics and corporations alike would be well advised to take a critical look at their privacy policies to ensure that they can and do live up to their promises.

At present, although there is some national coordination of newborn screening programs, there is no uniform policy governing the disposition of newborn blood samples after screening is complete.  Some states store the samples for a limited period of time and then discard them.  Others, including Minnesota and Michigan, permit researchers to use the samples, including to conduct pilot studies designed to develop additional newborn screening tests.  Michigan is even facilitating (although not funding) the development of a “Neonatal BioTrust” in the hopes of drawing biomedical companies to the state.

And additional guidance from the federal government is likely forthcoming.  Late last year the National Institute of Child Health and Human Development, a division of the National Institutes of Health (NIH), awarded the American College of Medical Genetics (ACMG) a $13.5 million, 5-year contract for the development of a National Newborn Screening Translational Research Network.  One of the network’s many aims is to facilitate the creation of a “reliable repository of residual dried bloodspots that is either virtual or physical and comprised of those stored by state newborn screening programs and other resources.”

As pointed out in an article in today’s Washington Post, the increasing focus on what happens to newborn blood spots after screening has led some parents and advocacy groups to question the existing practices.  In Minnesota, an advocacy group has questioned that state’s practice of retaining newborn blood spots for research use, arguing that parental consent for ongoing storage and use, including research, should be required.  Litigation is ongoing in both Minnesota and in Texas.  In response, the ACMG recently published a position statement on the Importance of Residual Newborn Screening Dried Blood Spots.

The newborn blood spot debate covers ground that is all too familiar in the context of more traditional genetic testing, including whether and when informed consent should be required prior to reusing samples or data for research and to what degree individuals (or in this case the parents of newborns) should have control over the types of studies for which such samples are used.

Under the 2008 Newborn Screening Saves Lives Act, the Advisory Committee on Heritable Disorders in Newborns and Children, which reports to the Secretary of Health and Human Services, has been tasked with a review of the issues surrounding current and proposed newborn screening programs and practices.  As these issues continue to draw considerable public attention, the committee’s analysis — which may be presented as soon as its next meeting in September — is a development to keep an eye on.

For more:

• Overview of the CDC’s role in newborn screening, including information on the Newborn Screening Quality Assurance Program (NSQAP) and the Newborn Screening National Contingency Plan.
• A list of Newborn Genetic and Metabolic Disease Screening statutes prepared by the National Conference of State Legislatures.