Criminal conviction for using trade secrets to launch a rival firm (arts. 278-280 CP)

Executives leaving to found a competing business is perfectly legitimate: no one is bound to a company for life, and career changes are part of a free market. The problem arises when the departing person does not start from scratch, but takes with them their former employer's most valuable asset: the confidential information they came to know because of their position. The client portfolio, supplier lists, commercial offers, budgets, sales forecasts and strategic documentation are not the employee's personal knowledge, but trade secrets protected by law.

A recent judgment of the Criminal Section of the Barcelona Court of Instance (seat 28), no. 289/2026 of 15 May, draws that line clearly. Two former executives who had held senior positions for nearly two decades, one as commercial director and the other as head of IT, were convicted of using their old employer's confidential information to boost the competing company they themselves created. This article explains the offence of discovery and disclosure of trade secrets, the applicable penalties and how the criminal and civil routes relate.

What the Barcelona judgment decided

According to the ruling, the two defendants copied and remotely accessed a significant volume of sensitive information belonging to their former employer: customer, supplier and employee data, commercial offers, budgets, sales forecasts, staffing plans and internal documentation, as well as a business management application. With that material, they set up and promoted a company operating in the same sector, gaining a competitive edge that would otherwise have taken years of commercial effort to build.

The court stressed a point relevant to many businesses: the leak did not come from an external cyberattack, but from internal staff who had legitimate access to the systems by reason of their roles. Computer forensic evidence proved decisive, reconstructing the data flow through IP addresses, metadata and file timestamps, and establishing the remote access and extraction of information.

The conviction was for the offence of lucrative use of a disclosed trade secret, framed under article 280 of the Criminal Code, within articles 278 to 280, which criminalise the discovery and disclosure of trade secrets.

The offence of discovery and disclosure of trade secrets

Articles 278 to 280 of the Spanish Criminal Code protect the confidentiality of information that gives a company a competitive advantage. They do not punish the mere use of the experience or skills a worker acquires over a career, which belong to them, but the exploitation of someone else's secret data obtained or passed on unlawfully.

Article 278 CP penalises anyone who seizes data, documents, media or files to discover a trade secret, or intercepts communications for that purpose. Article 279 CP punishes the disclosure or transfer of the secret by someone legally or contractually bound to keep it confidential, as is typically the case with executives and trusted employees. Article 280 CP closes the loop: it punishes anyone who, knowing its unlawful origin, uses or exploits the disclosed secret, even if they did not take part in obtaining it.

For an offence to exist, the information must have the hallmarks of a trade secret: it must be confidential, derive value from being secret, and have been subject to reasonable protective measures by its holder. It is not enough for the company to consider it important; it must have taken steps to keep it confidential.

Penalties and why one year here

The penalty framework is severe. Seizing secrets under article 278 CP carries two to four years in prison plus a fine; disseminating, disclosing or transferring what was discovered increases the penalty. Disclosure by someone bound to confidentiality under article 279 CP carries two to four years and a fine, reduced if the secret is used only for the offender's own benefit. Use under article 280 CP carries one to three years in prison plus a fine.

In the case decided, the penalty was set at one year in prison and a fine of around 1,080 euros for each defendant, plus joint compensation of 22,500 euros. That sentence, close to the minimum, is explained by two mitigating factors: partial reparation of the damage under article 21.5 CP, as each defendant had paid 2,500 euros before trial, and, above all, the mitigating factor of extraordinary undue delay under article 21.6 CP, since the investigation lasted more than seven years.

It is worth recalling that a prison sentence of under two years for someone with no prior record can usually be suspended, avoiding actual imprisonment, although the criminal conviction and civil liability remain in force.

Criminal route, Law 1/2019 and unfair competition

Protection of trade secrets in Spain is not only criminal. Law 1/2019 of 20 February, on Trade Secrets, which transposed Directive (EU) 2016/943, sets out the civil route: it defines a trade secret and allows claims for cessation of the conduct, damages, removal of effects and interim measures such as seizure of goods or media.

To this is added Law 3/1991 on Unfair Competition, which deems the violation of secrets and the inducement to breach a contract unfair, especially when the aim is to drive a competitor out of the market. The harmed company may therefore combine claims depending on the case.

The criminal route requires something more: intent and, depending on the offence, especially reprehensible conduct of seizing, disclosing or making lucrative use of the secret knowing its unlawful origin. Not every unfair act or contractual breach is a crime; but when those elements are present, as the Barcelona court found, the response can be a sentence of imprisonment, a fine and compensation.

How to protect yourself: companies and executives

For the company, the best defence is preventive. Adopting reasonable confidentiality measures (access controls, confidentiality clauses in contracts, information-use policies, download logs and IT traceability) not only reduces the risk of leaks, but is precisely what the law requires for information to qualify as a protected secret. Without those safeguards, proving the offence can be very difficult.

When a leak is suspected, acting early is key. The computer forensics that reconstruct access, metadata and data flows are usually the evidence that sustains a conviction, so it is essential to preserve the logs without altering them and to seek advice before acting.

For executives or employees changing jobs, the limit is clear: they may take their experience, their personal professional contacts and their general knowledge of the sector, but they may not copy or use the confidential documentation, databases or client portfolio of the company they leave. The line between legitimate entrepreneurship and crime lies precisely in the origin of the information being exploited.