Industrial Espionage (Art. 278 CP) in Spain: Criminal Defence

The offence of industrial espionage, governed by Articles 278 to 280 of the Spanish Criminal Code, protects one of any company's most valuable assets: its trade secrets. Client databases, product designs, formulas, algorithms and proprietary technology are common targets of unlawful discovery. As criminal defence lawyers, we analyse the offence, its line with civil unfair competition and the most effective defence strategies.

The Basic Type: Art. 278 CP

Article 278.1 punishes with prison of 2 to 4 years and a fine of 12 to 24 months anyone who, to discover a trade secret, seizes by any means data, written or electronic documents or other objects relating to it, or uses the means of Article 197.1 (wiretapping, interception of communications). Paragraph 2 raises the penalty to prison of 3 to 5 years where the discovered secrets are disseminated, revealed or transferred to third parties.

What Is a Trade Secret?

Law 1/2019 on Trade Secrets — transposing EU Directive 2016/943 — defines a trade secret as information that cumulatively meets three requirements:

• Secret nature: not generally known or readily accessible.
• Business value: real or potential, deriving precisely from its secret nature.
• Reasonable protection measures: the holder has adopted measures to keep it secret.

The absence of any of these three requirements excludes the status of "trade secret" and, with it, criminal liability. Many defences rest precisely on proving the lack of the third requirement.

Line With Civil Unfair Competition

Not every appropriation of business information is an offence. The key criterion is the means used: if the information was obtained by legitimate mechanisms (negotiation, due diligence, hiring an employee) and then used unfairly, the route will be civil. If it was hacked, spied on or communications were intercepted, it will be criminal.

The Employee Who Leaks to a Competitor: Art. 279 CP

Article 279 is the most frequent form in practice: it punishes anyone who disseminates, reveals or transfers a trade secret to third parties when legally or contractually obliged to keep it confidential. The penalty is 2 to 4 years in prison and a fine of 12 to 24 months. Typical cases: an executive moving to a competitor with the client base; an engineer leaking designs or source code; a salesperson taking the CRM on changing employer.

The Receiving Company: Art. 280 CP

Article 280 punishes anyone who uses or reveals trade secrets for their own benefit or that of a third party, knowing they were obtained in the circumstances of Art. 278, where they did not take part in the discovery. The penalty is prison of 1 to 3 years. This makes corporate criminal prevention (compliance) essential for companies that recruit talent from competitors.

Criminal Defence of the Accused

1. Denial of the secret nature. Proving the information was public, readily accessible or that the company adopted no reasonable protection measures.
2. Prior personal knowledge (the worker's know-how). Case law distinguishes trade secrets (protected) from the employee's personal know-how (lawful).
3. Non-existence of unlawful seizure. If the information was lawfully accessed, the "seizure" of Art. 278 does not concur.
4. Atypicality for lack of a contractual confidentiality obligation.
5. Limitation. 5 years from commission or the last dissemination.

Private Prosecution: the Harmed Company

When representing the harmed company, the key actions are: the immediate securing of digital evidence (forensic IT, access logs), parallel civil interim measures (Law 1/2019), a confidential internal investigation before reporting, the criminal complaint with a complete technical-expert dossier, and the claim for civil liability arising from the offence.