Criminal conviction for using trade secrets to launch a rival firm (arts. 278-280 CP)

Executives leaving to found a competing business is perfectly legitimate: no one is bound to a company for life, and career changes are part of a free market. The problem arises when the departing person does not start from scratch, but takes with them their former employer's most valuable asset: the confidential information they came to know because of their position. The client portfolio, supplier lists, commercial offers, budgets, sales forecasts and strategic documentation are not the employee's personal knowledge, but trade secrets protected by law.

Articles 278 to 280 of the Criminal Code draw that line clearly. The scenario that most often reaches the criminal courts is that of someone who has held a senior position for years —commercial director, head of IT— and uses the confidential information they accessed by reason of that role to boost a competing company of their own. This article explains the offence of discovery and disclosure of trade secrets, the applicable penalties and how the criminal and civil routes relate.

The typical scenario: a leak from the inside

The pattern repeats itself: a significant volume of the employer's sensitive information is copied or accessed remotely —customer, supplier and employee data, commercial offers, budgets, sales forecasts, staffing plans and internal documentation, sometimes the business management application itself— and with that material a company operating in the same sector is set up and promoted, gaining a competitive edge that would otherwise have taken years of commercial effort to build.

There is a point here that matters to many businesses: in these cases the leak does not come from an external cyberattack, but from internal staff with legitimate access to the systems by reason of their roles. Computer forensic evidence is usually decisive, because it reconstructs the data flow through IP addresses, metadata and file timestamps and establishes the remote access and extraction of information.

The classification depends on each participant's role: seizing the information in order to discover the secret (art. 278 CP), disclosure or transfer by someone bound to confidentiality (art. 279 CP), or use of the already-disclosed secret, knowing its unlawful origin, by someone who took no part in obtaining it (art. 280 CP).

The offence of discovery and disclosure of trade secrets

Articles 278 to 280 of the Spanish Criminal Code protect the confidentiality of information that gives a company a competitive advantage. They do not punish the mere use of the experience or skills a worker acquires over a career, which belong to them, but the exploitation of someone else's secret data obtained or passed on unlawfully.

Article 278 CP penalises anyone who seizes data, documents, media or files to discover a trade secret, or intercepts communications for that purpose. Article 279 CP punishes the disclosure or transfer of the secret by someone legally or contractually bound to keep it confidential, as is typically the case with executives and trusted employees. Article 280 CP closes the loop: it punishes anyone who, knowing its unlawful origin, uses or exploits the disclosed secret, even if they did not take part in obtaining it.

For an offence to exist, the information must have the hallmarks of a trade secret: it must be confidential, derive value from being secret, and have been subject to reasonable protective measures by its holder. It is not enough for the company to consider it important; it must have taken steps to keep it confidential.

Penalties and the circumstances that modulate them

The penalty framework is severe. Seizing secrets under article 278 CP carries two to four years in prison plus a fine; disseminating, disclosing or transferring what was discovered increases the penalty. Disclosure by someone bound to confidentiality under article 279 CP carries two to four years and a fine, reduced if the secret is used only for the offender's own benefit. Use under article 280 CP carries one to three years in prison plus a fine.

Within that framework, the actual sentence depends on the mitigating and aggravating circumstances present. Two mitigating factors are especially common in these proceedings: reparation of the damage under article 21.5 CP, where the defendant repairs the harm or reduces its effects before the trial hearing, and extraordinary undue delay under article 21.6 CP, where the proceedings drag on through no fault of the defendant and out of proportion to the complexity of the case. If two mitigating factors apply, or a single highly qualified one, and there are no aggravating factors, the penalty is reduced by one or two degrees (art. 66.1.2 CP), which is why these proceedings often end in sentences close to the statutory minimum.

It is worth recalling that a prison sentence of under two years for someone with no prior record can usually be suspended, avoiding actual imprisonment, although the criminal conviction and civil liability remain in force.

Criminal route, Law 1/2019 and unfair competition

Protection of trade secrets in Spain is not only criminal. Law 1/2019 of 20 February, on Trade Secrets, which transposed Directive (EU) 2016/943, sets out the civil route: it defines a trade secret and allows claims for cessation of the conduct, damages, removal of effects and interim measures such as seizure of goods or media.

To this is added Law 3/1991 on Unfair Competition, which deems the violation of secrets and the inducement to breach a contract unfair, especially when the aim is to drive a competitor out of the market. The harmed company may therefore combine claims depending on the case.

The criminal route requires something more: intent and, depending on the offence, especially reprehensible conduct of seizing, disclosing or making lucrative use of the secret knowing its unlawful origin. Not every unfair act or contractual breach is a crime; but when those elements are present, the response can be a sentence of imprisonment, a fine and compensation.

How to protect yourself: companies and executives

For the company, the best defence is preventive. Adopting reasonable confidentiality measures (access controls, confidentiality clauses in contracts, information-use policies, download logs and IT traceability) not only reduces the risk of leaks, but is precisely what the law requires for information to qualify as a protected secret. Without those safeguards, proving the offence can be very difficult.

When a leak is suspected, acting early is key. The computer forensics that reconstruct access, metadata and data flows are usually the evidence that sustains a conviction, so it is essential to preserve the logs without altering them and to seek advice before acting.

For executives or employees changing jobs, the limit is clear: they may take their experience, their personal professional contacts and their general knowledge of the sector, but they may not copy or use the confidential documentation, databases or client portfolio of the company they leave. The line between legitimate entrepreneurship and crime lies precisely in the origin of the information being exploited.