The Defend Trade Secrets Act in the Eleventh Circuit: Ten Decisions That Shape Trade Secret Litigation in Florida — and Key Points for Florida Technology Companies

The Defend Trade Secrets Act (DTSA) of 2016 gave trade secret owners, for the first time, a federal civil cause of action for misappropriation, with nationwide service, a uniform definition of a trade secret, an ex parte seizure remedy, exemplary damages and attorney’s fees for willful and malicious misappropriation, and a federal forum without the need for diversity. In the decade since, the DTSA has become the claim of first resort for Florida technology companies whose code, data, customer information or product designs walk out the door with a departing employee, a former partner or a scraping bot. Because the DTSA’s definitions of “trade secret” and “misappropriation” track the Uniform Trade Secrets Act on which Florida’s own statute is based, the Eleventh Circuit and Florida’s district courts analyze DTSA and Florida Uniform Trade Secrets Act claims together—and the body of law that has developed applies to both.

This post identifies the ten decisions from the Eleventh Circuit and Florida’s federal district courts that, in our judgment, most define how DTSA claims are pleaded, proved, defended and remedied in this circuit, and then sets out the key points Florida technology companies should take from them.

For an overview of our trade secret practice, see Trade Secret Matters; for our work with technology companies, see Technology & Start-Up Services; for enforcement, see Litigation & Enforcement.

The DTSA in Brief

Under 18 U.S.C. § 1836(b), the owner of a trade secret that is misappropriated may sue in federal court if the secret is related to a product or service used in, or intended for use in, interstate or foreign commerce.

A trade secret is information that the owner has taken reasonable measures to keep secret and that derives independent economic value from not being generally known to, or readily ascertainable through proper means by, others who could obtain value from it.

Misappropriation is the acquisition of a trade secret by improper means, or its disclosure or use by a person who acquired it by improper means, or who knew or should have known that it was derived from someone who did, or who acquired it under a duty to maintain its secrecy.

Remedies include injunctions (which may not prevent a person from entering an employment relationship and may not conflict with state law on lawful professions), actual loss plus unjust enrichment or a reasonable royalty, exemplary damages up to twice actual damages for willful and malicious misappropriation, and attorney’s fees for willful and malicious misappropriation or a bad-faith claim.

The limitations period is three years from discovery, and the statute reaches misappropriation for which any act occurs on or after May 11, 2016.

The Ten Decisions:

1. M.C. Dean, Inc. v. City of Miami Beach, 199 F. Supp. 3d 1349 (S.D. Fla. Aug. 8, 2016) — information handed to a government agency without a confidentiality designation is not a trade secret

Three months after the DTSA took effect, Judge Altonaga issued one of the first decisions in the country construing it. An electrical subcontractor on the Miami Beach Convention Center project was required by its subcontract to submit certified payroll records to the general contractor and the City. A union requested the records under Florida’s Public Records Act, the City produced them unredacted, and the subcontractor sued the City and the union under the DTSA and FUTSA. The court dismissed. The subcontractor had not alleged that it took any steps to keep the payroll information secret when it delivered it: no contractual restriction, no written confidentiality designation, and an oral assurance from a City employee that the records would be redacted was not a reasonable measure. Moreover, the subcontract provided that the data would be the City’s property to use “without restriction.” Because the union obtained the records through a lawful public-records request, there was no acquisition by improper means and therefore no misappropriation.

The decision remains the leading Florida authority that information voluntarily supplied to a public body without a written trade-secret designation loses its protected status, and that a plaintiff must plead the specific measures it took to protect the information at the moment of disclosure.

2. Adams Arms, LLC v. Unified Weapon Systems, Inc. (M.D. Fla. Sept. 27, 2016) — the DTSA reaches misappropriation that continues after its effective date

A Tampa rifle manufacturer shared its designs, manufacturing processes and supplier information with a partner under confidentiality agreements to pursue a Peruvian military contract. The partner won the bid using those specifications and then cut the manufacturer out. Judge Covington denied the motion to dismiss the DTSA count and, in doing so, addressed the question every early DTSA plaintiff faced: whether the Act applies to conduct that began before May 11, 2016. The court held that it does where the plaintiff alleges acts of misappropriation—including disclosure or use—occurring after the effective date, even if the initial acquisition preceded it. The decision also confirmed that a complaint need only allege the elements plausibly, it does not need to prove trade-secret status at the pleading stage.

Adams Arms is frequently cited for the proposition that the DTSA is available in continuing-misappropriation cases, and, by extension, that each new use or disclosure of a misappropriated secret is a fresh act on which the claim can rest.

3. Yellowfin Yachts, Inc. v. Barker Boatworks, LLC, 898 F.3d 1279 (11th Cir. Aug. 7, 2018) — “reasonable measures” means actual measures, not just intentions

A Florida boat builder sued its former vice president of sales and the competing company he founded, alleging trade dress infringement and misappropriation of customer information and boat-design specifications. The Eleventh Circuit affirmed summary judgment against the trade secret claim because Yellowfin had not taken reasonable measures to protect the information. The record showed that Yellowfin had asked the executive to sign a confidentiality agreement when he was hired, but never followed up when he declined, allowed him to keep customer information on his personal phone and laptop, did not require him to return or delete the information when he left, and that the customer information was, in any event, largely ascertainable from public sources.

The court’s message was unmistakable: a company that knows its information is valuable and takes no concrete steps to protect it—no signed agreement, no access restriction, no device policy, no exit protocol—cannot ask a court to treat the information as a trade secret after the fact. Yellowfin is now the first case cited by every Florida defendant moving for summary judgment on the reasonable-measures element.

4. Trinity Graphic, USA, Inc. v. Tervis Tumbler Co., 320 F. Supp. 3d 1285 (M.D. Fla. July 30, 2018) — what a well-pleaded DTSA complaint looks like

A printing company that had developed a proprietary process for inserting high-resolution graphics between the double walls of Tervis tumblers alleged that Tervis and two competing printers conspired to obtain the process and eliminate it as a supplier. Judge Bucklew denied the motions to dismiss the DTSA, FUTSA, contract and fraud counts.

The decision is useful for its description of what sufficed: the complaint identified the process with enough specificity to show independent economic value, described the confidentiality agreement and the other measures used to protect it, named the individuals involved, and set out the dates, locations and mechanics of the alleged scheme. The court rejected the defendants’ demand for greater technical detail at the pleading stage, holding that whether information is in fact a trade secret “is a question of fact normally resolved by a jury after full presentation of evidence,” and that a plaintiff need not disclose the secret itself in a public complaint to state a claim.

5. Digital Assurance Certification, LLC v. Pendolino (M.D. Fla. 2017–2018) — identify the trade secrets with reasonable particularity before demanding discovery

A municipal-bond compliance software company sued a former employee under the DTSA, FUTSA, the CFAA and Florida’s CADRA after forensic evidence showed he had connected a USB drive to the company’s shared drive in the days before his termination and joined a competitor that soon launched a similar product.

Two rulings by Magistrate Judge Smith define the discovery phase of a Florida trade secret case. In 2017, the court quashed a subpoena seeking a $100,000 forensic examination of the competitor’s entire cloud infrastructure as disproportionate to a claim resting “largely on the basis of speculation,” while approving targeted hash-value and keyword searches. In 2018, the court required the plaintiff to identify each alleged trade secret with reasonable particularity—ultimately compiling an eleven-category list—before the defendants had to produce their own confidential materials, applying the principle that “a party may not assert a cause of action for misappropriation of trade secrets without identifying for the opposing party the trade secrets at issue.”

Florida’s federal courts have not adopted a rigid pre-discovery identification rule of the kind some states impose, but Pendolino shows that they will impose one case-by-case, and that a plaintiff who cannot say what was taken will not get discovery into what the defendant has.

6. Compulife Software, Inc. v. Newman, 959 F.3d 1288 (11th Cir. May 20, 2020) — scraping a public website can be misappropriation by improper means

Compulife, a Florida company, licenses a database of life-insurance rates and operates a public website on which consumers can generate quotes. Competitors, working with a hacker, obtained a copy of Compulife’s licensed software and launched a “scraping attack” that harvested millions of quotes from the public site in a matter of days, then used the data on competing quote sites. After a bench trial, the magistrate judge found no misappropriation, reasoning that each quote was publicly available.

The Eleventh Circuit vacated. It held that a compilation of publicly available data can be a trade secret even though each individual entry is public, because the compilation as a whole is not readily ascertainable through proper means. The question is whether the manner of acquisition was improper, not whether the information could theoretically have been gathered lawfully. Scraping at a scale and speed no human could match, in circumvention of the site’s intended use, could be an improper means even where a human user could have obtained a single quote without objection. The court also held that the district court had erred by failing to consider whether the defendants’ use of the scraped data—as opposed to its acquisition—was a separate act of misappropriation.

Compulife is among the most-cited trade secret decisions of the decade and is the foundation of every data-scraping claim brought in this circuit.

7. Financial Information Technologies, LLC v. iControl Systems, USA, LLC, 21 F.4th 1267 (11th Cir. Dec. 22, 2021) — proving damages and drafting the injunction

Fintech, a Tampa company whose software processes alcohol-distribution invoices, sued a competitor that had hired two of its employees, both bound by nondisclosure agreements, and within months released a competing product at lower prices that replicated Fintech’s solutions to several technical problems and an internal document at the competitor contained screenshots of Fintech’s password-protected portal with instructions to copy it. A jury found willful and malicious misappropriation and awarded $2.7 million in actual damages and $3 million in exemplary damages.

The Eleventh Circuit, in an opinion by Judge Newsom, affirmed liability but reversed on damages and affirmed the denial of a permanent injunction. Three holdings matter. First, circumstantial evidence—the timing of the product, the identity of the solutions, the screenshots—was sufficient for a jury to infer use of the trade secrets, and because the competitor had not moved for judgment as a matter of law at trial, its sufficiency challenge on appeal was reviewed only for a complete absence of evidence. Second, a lost-profits award must deduct the marginal costs the plaintiff would have incurred to earn the lost revenue. Fintech’s evidence that those costs were “minimal” was not enough, because “minimal doesn’t equal zero.” Third, an injunction that would have barred the competitor from using its own software indefinitely was properly denied as overbroad: trade secret injunctions must be specific about what is prohibited and limited to the time reasonably necessary to eliminate the commercial advantage the misappropriation conferred.

8. Future Metals LLC v. Ruggiero (S.D. Fla. 2021) — Florida does not recognize “inevitable disclosure,” so prove actual or threatened misappropriation

A long-tenured sales executive at an aerospace-metals distributor accepted a position with a competitor in November 2020 but continued for two months to attend his employer’s strategy meetings, download confidential documents and forward business plans to his new employer before resigning. The employer sued under the DTSA and the trade secret statutes of three states and sought to enjoin him from working for the competitor at all.

The court’s orders in the case—including its holding that Florida has not adopted the inevitable-disclosure doctrine—confirm that a Florida court will not enjoin a former employee from taking a job merely because he knows the plaintiff’s secrets and will inevitably use them. The DTSA itself provides that an injunction may not “prevent a person from entering into an employment relationship” and that any conditions on employment must be based on evidence of threatened misappropriation, “not merely on the information the person knows.” The plaintiff in Future Metals had that evidence—the downloads and the forwarded plans—and the case illustrates the distinction: a Florida court will enjoin the use and disclosure of identified secrets on proof of actual or threatened misappropriation, but a restriction on employment itself must come from a valid restrictive covenant under Fla. Stat. § 542.335, not from trade secret law.

9. Compulife Software, Inc. v. Newman, 111 F.4th 1147 (11th Cir. Aug. 1, 2024) — the sequel: liability affirmed, joint and several, and scraping distinguished from legitimate use

On remand from the 2020 decision, the district court found that the defendants had misappropriated Compulife’s trade secrets and entered judgment against them jointly and severally. The Eleventh Circuit affirmed the trade secret judgment (while remanding the separate copyright claim for further analysis). The court held that the defendants—the competitors and the hacker they had engaged—acted “in concert” as intentional tortfeasors and could be held jointly and severally liable for the full injury without apportionment, that the scraping attack was an improper means notwithstanding that “scraping and related technologies ... may be perfectly legitimate” and that “[m]uch of the modern internet is built on those technologies”, and that the compilation of quotes remained a trade secret despite the public availability of each quote.

Compulife II closes the loop on the 2020 decision and establishes that everyone who participates in a coordinated acquisition of trade secrets—including the technical contractor who writes the bot—answers for the whole of the resulting harm.

10. Global Marine Exploration, Inc. v. Republic of France (11th Cir. Aug. 19, 2025) — a defendant that receives your secret from a regulator has not misappropriated it

A Florida marine-exploration company discovered the wreck of la Trinité, a sixteenth-century French royal vessel lost off Cape Canaveral, and, as its state exploration permit required, submitted the precise GPS coordinates to Florida’s Division of Historical Resources. When France asserted sovereign ownership and refused to negotiate a salvage arrangement, the company sued France for, among other things, misappropriation of the coordinates as a trade secret.

In an opinion by Chief Judge Pryor, the Eleventh Circuit affirmed summary judgment for France. The company had disclosed the coordinates to the State because its permit required it to. France played no role in obtaining them and the company “failed to bring forth any evidence proving that France knew that the precise location data ‘was improperly obtained’” or that France used improper means. The decision is the Eleventh Circuit’s most recent statement of the misappropriation element and, read with M.C. Dean, closes the circle on regulatory disclosures: information a company is required to give a government agency may remain a trade secret if the company designates it as such and the agency is bound to protect it, but a third party who obtains the information through the agency’s lawful processes, without knowledge of any impropriety, is not a misappropriator.

What the Decisions Add Up To

Together the ten decisions describe a trade secret regime in this circuit that is generous to plaintiffs who have done the work and unforgiving to those who have not.

The trade secret must exist before the dispute: the company must have taken concrete, documented measures to protect it (Yellowfin), including when it shares the information with partners, contractors and government agencies (M.C. Dean, Global Marine).

The plaintiff must be able to say what the secret is, with enough specificity to plead a claim (Trinity Graphic) and to identify it for the defendant before demanding discovery (Pendolino). Misappropriation is judged by the manner of acquisition and by use, not by whether the information could theoretically have been obtained lawfully, so that mass scraping of public data is actionable (Compulife I and II) but lawful receipt from a regulator is not (Global Marine).

The DTSA reaches misappropriation that continues after its effective date (Adams Arms). Damages must be proven with a real accounting of costs, injunctions must be specific and time-limited, and appellate arguments must be preserved at trial (Fintech). And an employee’s mere knowledge of secrets will not support an injunction against his employment; that requires either evidence of threatened misappropriation or an enforceable restrictive covenant (Future Metals).

Key Points for Florida Technology Companies:

1. Build the “reasonable measures” record before you need it

Every element of a DTSA claim can be litigated, but reasonable measures is the one on which Florida defendants win most often. The measures should be layered and documented: signed confidentiality agreements with every employee, contractor and business partner who receives confidential information (and a follow-up file showing that the agreement was actually signed—Yellowfin turned on a request that was never enforced), role-based access controls and logging on repositories, databases and cloud environments, confidentiality markings on documents and source files, device and bring-your-own-device policies that prohibit storing company data on personal devices or, if permitted, require remote-wipe capability, written exit protocols requiring return and certified deletion of information, and periodic training.

A technology company should be able to produce, on a day’s notice, a document describing its trade secret program and the evidence that each measure was applied.

2. Inventory and describe your trade secrets now

Pendolino and Trinity Graphic both reward the plaintiff who can articulate what its trade secrets are. Maintain an internal trade secret register—a confidential document identifying each category of protected information (source code modules, algorithms, model weights and training data, architecture documents, customer and pricing data, product roadmaps, negative know-how), where it resides, who has access, and what measures protect it.

The register is what allows counsel to draft a complaint that satisfies Trinity Graphic without disclosing the secret, and to serve the identification that Pendolino requires without weeks of delay.

3. Control disclosures to partners, customers and government agencies

M.C. Dean and Global Marine show that a trade secret is most often lost not by theft, but by voluntary disclosure without protection.

Every disclosure to a prospective acquirer, investor, joint-venture partner, systems integrator or customer should be preceded by a written agreement that identifies the information as confidential and restricts its use. Every submission to a government agency—permit applications, procurement bids, regulatory filings, grant applications, public-records-eligible correspondence with state and local bodies—should carry a written trade-secret designation invoking the applicable statutory exemption (in Florida, the trade secret exemptions to Chapter 119) and, where possible, should be limited to the minimum necessary. Florida’s Public Records Act makes this discipline especially important for companies that contract with state and local governments.

4. Treat scraping and mass extraction as misappropriation — and design against it

Compulife gives Florida technology companies a powerful tool against competitors who harvest their data, but only if the record supports it. Terms of service should prohibit automated extraction and commercial reuse, rate limits, CAPTCHAs, authentication requirements and bot detection should be deployed and their logs retained, and the compilation itself—the database, the price list, the aggregated dataset—should be identified in the trade secret register.

Conversely, companies that use scraping or third-party data in their own products should evaluate each source against Compulife: automated extraction that circumvents a site’s intended use, at a scale no human user could match, is the fact pattern that produced joint and several liability for the operator, the customers and the contractor who wrote the bot.

5. Include the DTSA whistleblower-immunity notice in every agreement

The DTSA conditions an employer’s right to recover exemplary damages and attorney’s fees against an employee, contractor or consultant on the employer’s having given notice of the Act’s whistleblower immunity (18 U.S.C. § 1833(b)) in the agreement governing confidential information. The notice costs nothing to include and its omission forfeits the statute’s most valuable remedies against the individuals most likely to misappropriate.

Every employment agreement, contractor agreement, consulting agreement and NDA with an individual should contain it, and legacy agreements should be amended.

6. Do not rely on trade secret law to restrict employment

Because Florida has not adopted inevitable disclosure and the DTSA forbids injunctions that prevent employment based on knowledge alone, a company that wants to keep a key engineer from joining a competitor needs a restrictive covenant that satisfies Fla. Stat. § 542.335—supported by a legitimate business interest, reasonable in time, area and line of business, and in writing signed by the employee—and, for the most sensitive roles, should consider the expanded garden-leave and non-compete provisions Florida enacted in 2025. Trade secret claims and restrictive covenants are complementary, neither substitutes for the other.

7. Prepare the damages case from the outset

Fintech reversed a $2.7 million verdict because the plaintiff could not show its marginal costs. Damages under the DTSA can be measured by the plaintiff’s actual loss, the defendant’s unjust enrichment, or a reasonable royalty, and each theory has evidentiary requirements: lost profits require revenue and cost data, unjust enrichment requires evidence of the defendant’s gains or avoided development costs, and a royalty requires a basis for the rate. Retain a damages expert early, preserve the financial records that support the chosen theory, and—because exemplary damages and fees depend on it—develop the evidence of willfulness and malice, which in Fintech was an internal document with screenshots and copying instructions.

8. Move fast, but ask for the right injunction

Injunctive relief is available under the DTSA for actual or threatened misappropriation, and courts in this circuit grant it where the evidence is concrete and the request is specific: an order barring use and disclosure of identified information, requiring return or destruction of copies, and requiring a forensic protocol. Fintech shows that a request to bar a competitor from using its own products indefinitely will be denied as overbroad. The ex parte seizure remedy exists but is reserved for extraordinary cases in which a standard injunction would be ineffective because the defendant would evade it or destroy the evidence. It should be requested only on a record that meets each statutory prerequisite.

9. Preserve, investigate and plead with precision

When a departure or breach is discovered, image the relevant devices and accounts under a chain of custody, pull access logs, and retain a forensic examiner before sending a demand. Plead the DTSA and FUTSA counts with the specificity Trinity Graphic describes, allege post-May-2016 acts of use or disclosure to satisfy Adams Arms, and be prepared to serve a Pendolino identification at the outset. At trial, move for judgment as a matter of law on every issue you intend to appeal, Fintech’s defendant lost the benefit of de novo review because it did not.

10. Sue everyone who acted in concert — and expect to be sued as one

Compulife II holds that participants in a coordinated misappropriation are jointly and severally liable for the entire harm. Plaintiffs should name the competitor, the individuals and the technical contractors who participated. Technology companies engaged to build tools for others should recognize that building a scraper or an extraction tool for a client’s use against a competitor exposes the builder to the same liability as the client.

Conclusion

Ten years after its enactment, the DTSA has settled into a predictable body of law in the Eleventh Circuit. The statute protects information that its owner has genuinely protected and can specifically identify. It treats the manner of acquisition, not the theoretical availability of the information, as the measure of impropriety. It further reaches the modern methods of taking data—scraping, bulk downloads, coordinated schemes—by holds every participant liable, but it demands rigor in proving damages and precision in requesting relief.

For Florida technology companies, the decisions are less a list of pitfalls than a specification: implement documented protective measures, keep a trade secret register, control every disclosure, include the whistleblower notice, pair trade secret protection with enforceable covenants, and prepare the evidentiary record before the dispute arrives.

If your company would like a review of its trade secret program and agreements against these decisions, or is facing the departure of a key employee, a data-extraction incident, or a trade secret claim, please visit our Trade Secret Matters and Litigation & Enforcement pages, or contact us at 305-374-8303.