In many areas of research and development, businesses justifiably expect to be able to protect their innovations through intellectual property. What about when those innovations are in data? Data takes on heightened importance in artificial intelligence (AI) applications, where both the data needed to effectively train AI systems and AI output data may be have tremendous value. Here, we explore the availability of copyright and trade secret protection for data compilations under US law.
The US Copyright Act protects original expression, not the underlying ideas or facts embodied in that expression.1 Still, the US Copyright Act recognizes rights in compilations, which are defined as "a work formed by the collection and assembling of preexisting materials or of data that are selected, coordinated, or arranged in such a way that the resulting work as a whole constitutes an original work of authorship."2
Courts have grappled with the level of selection, coordination and arrangement required before finding original expression and, accordingly, granting copyright protection. Importantly, the underlying facts themselves need not be protectable for the compilation as a whole to be accorded protection. The most cited case on this question, as it relates to databases, is Feist Publications, Inc. v. Rural Telephone Service Company, Inc.,3 in which the US Supreme Court reversed a ruling in favor of a phone book company against a competitor that had copied most of an entire phone book. The Supreme Court held that, in spite of the effort ("sweat of the brow") required to compile a phone book, the standard alphabetical listing of basic phone directory information was not sufficiently original to merit copyright protection. The Supreme Court noted, however, that "the originality requirement is not particularly stringent" and that "[p]resumably, the vast majority of compilations will pass this test."
Although Feist is often presented as the death knell for copyright protections in databases under US law, some cases applying the originality requirement soon after Feist actually found that particular data compilations merit protection, albeit narrow (see Key Publications, Inc. v. Chinatown Today Publishing Enterprises Inc. regarding a yellow pages directory and Kregos v. Associated Press regarding a baseball pitching form).4 We have not, however, seen a case testing this proposition for a modern database in which data scientists made specific decisions about the selection, coordination or arrangement of the database or the particular data to compile for use in analysis. Nor has any case considered the creativity that may be involved in selecting a training data set for an AI system. A company that makes numerous choices with respect to the data that it uses to train the AI system—for example, by deciding to collect specific data fields and modify the training data to correct possible errors—may argue that its database should enjoy copyright protection, at least against large-scale verbatim copying. Certainly such a company would also benefit by documenting its innovation process throughout, including any creative decisions made by the company.
In addition the models and output from AI tools may be creative works. However, these works are unlikely to be eligible for copyright protection if seen as machine output, as current US copyright law requires "an original work of authorship."5 Although the definition of "author" is not fixed by the US Copyright Act, courts have found a human authorship as a requirement for copyright protection. In Naruto v. Slater, for example, the court required that a "person" or "human being" is required for authorship under the Copyright Act.6 To achieve copyright protection, the company should have humans in any creative process using AI and documenting the human contribution to the work. The AI system may then be argued to be a tool, albeit a powerful tool, for humans to express human creativity in copyrightable works.
The US Defend Trade Secrets Act defines "trade secret" as:
"... all forms and types of financial, business, scientific, technical, economic, or engineering information, including patterns, plans, compilations, ..., whether tangible or intangible, and whether or how stored, compiled, or memorialized physically, electronically, graphically, photographically, or in writing if –
- the owner thereof has taken reasonable measures to keep such information secret; and
- the information derives independent economic value, actual or potential, from not being generally known to, and not being readily ascertainable through proper means by, another person who can obtain economic value from the disclosure or use of the information."7
Trade secret protection is, thus, potentially available to companies leveraging secret data from their operations. Unlike copyright, trade secrets do not require an original act of authorship. Instead, trade secret protection requires the owner to take "reasonable measures to keep such information secret."8 Like copyright, an intentional program of documented efforts to meet the legal standard will help to ensure protection.
Courts look to affirmative acts of the company claiming trade secret protection and may consider whether the company: (i) tracked database access and listed all employees, contractors, licensors, business partners or other third parties who could have misappropriated the company's compiled information; (ii) reviewed any agreements with employees, vendors, subcontractors and other service providers for confidentiality clauses, data security provisions, and restrictions on use of the data; and (iii) evaluated its database security measures and other internal confidentiality precautions at the start of the project and periodically thereafter.
To preserve trade secrets, companies should limit exposure to trade secrets (both within the company and outside of the organization) to those who need access. Companies can reduce the risk in any necessary access through confidentiality and other language in employee and independent contractor agreements. Courts often look for contract language between the parties to indicate that the disclosing company clearly communicated disclosure restrictions to the people receiving the trade secret and may consider non-disclosure agreements or non-compete language in services contracts as evidence in support of protecting a trade secret.9
Companies should perform a similar analysis with respect to vendors, subcontractors, data licensees and other agreements under which they allow another company to access data. Each third-party agreement that exposes a company's prospective trade secrets could threaten the company's claim for trade secret protection. In order to show that the company took "reasonable measures" to ensure secrecy, any such agreement should include clauses that require such reasonable measures from the licensee (such as a confidentiality clause) and specifically list the information to be protected (see Events Media Network, Inc. v. Weather Channel Interactive, Inc., where a general restriction on disclosure of "Confidential Information" was not sufficient to show that the plaintiff intended licensed information to remain confidential).10
Finally, a company may be required to prove the reasonability of its security measures in order to make a successful claim for trade secret protection. Though this requirement is open to interpretation, courts agree with respect to a few best practices, including implementing password protections and restricting access to sensitive areas of facilities.11 Of course, what is reasonable depends on the facts (the requirement is often stated as "reasonable under the circumstances"12). For example, companies that run AI systems may be required to prove spending on systems that comply with industry standards such as ISO 270XX and PCI DSS, implementing security protocols such as multi-factor authentication, and maintaining secure work environments for data scientists involved in AI projects.
AI is an emerging area where human creativity and control over secret data is a source of competitive advantage. However, copyright and trade secret laws were enacted before data became a substantial area of investment. To maximize the opportunities for legal protection, investors in data innovation should structure their projects with an eye to putting in place and continuing to maintain the best possible case for copyright and trade secret protections under the unique circumstances of the projects.
1. 17 USC § 102(b).
2. 17 USC § 101 (emphasis added).
3. 499 U.S. 340 (1991).
4. 945 F.2d 509 (2d Cir. 1991) and 3 F.3d 656 (2d Cir. 1993), respectively.
5. 17 USC § 102(a).
6. Naruto v. Slater, 2016 WL 362231, at *1 (N.D. Cal. Jan. 28, 2016).
7. 18 USCS § 1839(3) (emphasis added). In meaning, this definition is very similar to the Uniform Trade Secrets Act adopted in almost all US states.
8. 18 USCS § 1839(3)(B)
9. Duggan v. Am. Family Mut. Ins. Co., 2010 WL 1268175 (E.D. Wis. Mar. 30, 2010).
10. Events Media Network, Inc. v. Weather Channel Interactive, Inc., 2015 WL 457047, at *7 (D.N.J. Feb. 3, 2015).
11. Deepa Varadarajan, The Trade Secret-Contract Interface, 103 Iowa L. Rev. 1543, 1557 (2018).
12. GSI Tech., Inc. v. United Memories, Inc., 2015 WL 1802616, at *4 (N.D. Cal. Apr. 20, 2015).
Originally published October 21 2019
Visit us at mayerbrown.com
Mayer Brown is a global legal services provider comprising legal practices that are separate entities (the "Mayer Brown Practices"). The Mayer Brown Practices are: Mayer Brown LLP and Mayer Brown Europe – Brussels LLP, both limited liability partnerships established in Illinois USA; Mayer Brown International LLP, a limited liability partnership incorporated in England and Wales (authorized and regulated by the Solicitors Regulation Authority and registered in England and Wales number OC 303359); Mayer Brown, a SELAS established in France; Mayer Brown JSM, a Hong Kong partnership and its associated entities in Asia; and Tauil & Chequer Advogados, a Brazilian law partnership with which Mayer Brown is associated. "Mayer Brown" and the Mayer Brown logo are the trademarks of the Mayer Brown Practices in their respective jurisdictions.
© Copyright 2019. The Mayer Brown Practices. All rights reserved.
This Mayer Brown article provides information and comments on legal issues and developments of interest. The foregoing is not a comprehensive treatment of the subject matter covered and is not intended to provide legal advice. Readers should seek specific legal advice before taking any action with respect to the matters discussed herein.