What Is Misuse of Confidential Information in Arkansas?

Misuse of confidential information in Arkansas covers a range of conduct: stealing or disclosing a trade secret, mishandling customers’ personal data, breaching a professional duty of confidentiality, or accessing a computer system without authorization. Depending on what was taken and how it was used, the same act can lead to a civil lawsuit, criminal prosecution, regulatory discipline, or all three.

What Counts as Misuse

The conduct Arkansas law treats as misuse falls into several categories, each defined by a different statute.

Trade Secret Misappropriation

Under the Arkansas Trade Secrets Act, a trade secret is information with independent economic value because it is not generally known, where the owner has taken reasonable steps to keep it secret. Formulas, customer lists, manufacturing processes, pricing strategies, and software code all qualify.¹

Misappropriation means acquiring a trade secret through improper means — theft, bribery, or breach of a confidentiality obligation — or disclosing it without authorization. The law reaches further than the person who actually took the information: it also covers anyone who receives a trade secret knowing, or having reason to know, that it was obtained improperly.¹

Mishandling Personal Data

The Arkansas Personal Information Protection Act requires anyone holding computerized personal data — Social Security numbers, driver’s license numbers, financial account details — to notify affected Arkansas residents when a breach exposes that information in unencrypted form. The notice must go out “in the most expedient time and manner possible and without unreasonable delay.” If more than 1,000 people are affected, the Arkansas Attorney General must also be notified within 45 days of determining there is a reasonable likelihood of harm, or when consumers are notified, whichever comes first.²

Financial institutions have an added obligation under the FTC’s Safeguards Rule to maintain a written information security program scaled to their size and the sensitivity of what they hold. Since May 2024, covered entities must also report certain breaches and security incidents to the FTC.³

Breach of Professional Confidentiality

Several professions carry confidentiality duties enforced through their own rules. Arkansas attorneys are bound by Rule of Professional Conduct 1.6, which prohibits revealing information relating to client representation without informed consent or an applicable exception. Healthcare providers are restricted by the Patient Medical Records Privacy Act from disclosing patient medical information without authorization.⁴ Financial institutions face parallel limits under the Gramm-Leach-Bliley Act on sharing consumers’ nonpublic personal information with third parties.⁵

Beyond professional rules, employees, corporate officers, and business partners often owe a duty of loyalty that bars them from sharing sensitive information with competitors or using it for personal benefit. Nondisclosure agreements add contractual duties on top of those built-in obligations.

Unauthorized Computer Access

Intentionally accessing, altering, or destroying data on a computer system without authorization is criminal computer trespass under Arkansas law. This category reaches conduct that might not otherwise fit trade secret or privacy statutes — logging into a system you no longer have permission to use, copying files from a database you weren’t cleared for, altering records to cover tracks.⁶

Civil Lawsuits for Misappropriation

To win a trade secret misappropriation case under the Arkansas Trade Secrets Act, the owner has to prove three things: the information qualifies as a trade secret, the owner took reasonable steps to keep it secret, and the defendant acquired or disclosed it through improper means or in breach of a confidentiality duty.¹ “Reasonable steps” is where many cases fall apart. A company that shares proprietary data without password protection, access controls, or confidentiality agreements will struggle to convince a court the information was truly secret.

A misappropriation claim must be filed within three years after the owner discovers the misuse, or should have discovered it through reasonable diligence.⁷ Missing that deadline forfeits the right to sue under the Act entirely.

The federal Defend Trade Secrets Act gives owners the alternative of suing in federal court when the secret relates to a product or service used in interstate commerce, with the same three-year window.⁸ Claims can also come from a straight breach of a nondisclosure agreement or a fiduciary duty, though courts will scrutinize whether an NDA’s scope and duration were reasonable before enforcing it.

What a Court Can Order

The usual first step is an injunction barring further use or disclosure, often paired with an order to return or destroy materials containing the information. On damages, a successful plaintiff under the Arkansas Trade Secrets Act can recover actual losses plus any unjust enrichment the defendant gained that is not already captured in the loss figure.⁹ If neither can be pinned down with enough specificity, courts can award a reasonable royalty based on what the parties would have agreed to in a hypothetical license at the time the misappropriation began.⁸

For willful and malicious misappropriation, both state and federal law allow exemplary damages of up to twice the compensatory award.⁸ Attorney’s fees are not automatic. Under Arkansas law, a court may award them only if the misappropriation claim was brought in bad faith or if the misappropriation itself was willful and malicious.¹⁰

One often-missed point: settlement payments and damage awards in these cases are generally taxable as ordinary income under federal tax law, because lost profits from trade secret theft don’t fall under any exclusion the IRS recognizes.¹¹

Criminal Penalties

Arkansas prosecutes several forms of confidential information misuse as crimes, with penalties scaled to the offense and the harm caused.

Theft of a Trade Secret

Obtaining, disclosing, or copying a trade secret without authorization, with the purpose of depriving the owner of control, is a Class A misdemeanor punishable by up to one year in jail.¹²¹³ The classification doesn’t change based on the value of what was taken, which is one reason civil suits — with their broader damage awards — tend to be the primary enforcement tool for high-value thefts.

Computer Trespass

Penalties for unauthorized computer access escalate with the dollar value of the damage:⁶

First offense with no loss or damage: Class C misdemeanor, up to a $500 fine.¹⁴
Second or subsequent offense with no damage, or damage under $500: Class B misdemeanor, up to 90 days in jail.¹³
Damage of $500 to $2,499: Class A misdemeanor, up to one year in jail.¹³
Damage of $2,500 or more: Class D felony, up to six years in prison.¹³

Identity Fraud

Using another person’s identifying information without authorization to access financial accounts or obtain credit is financial identity fraud, a Class C felony, which becomes a Class B felony if the victim is elderly or disabled. Nonfinancial identity fraud — using someone’s information to evade law enforcement or obtain goods and services — is a Class D felony, escalating to Class C if the victim is elderly or disabled.¹⁵ A Class D felony carries up to six years in prison, with Class C carrying a longer sentence.¹³

When Disclosure Is Protected

Not every release of confidential information is unlawful. Under the federal Defend Trade Secrets Act, a person who discloses a trade secret to a government official or an attorney cannot be held criminally or civilly liable under any federal or state trade secret law, provided the disclosure is made in confidence and solely to report a suspected legal violation. If the trade secret ends up in a court filing, that document must be filed under seal.¹⁶

Employers are required to notify employees of these protections. If an employer leaves this notice out of a confidentiality agreement or employment contract, it loses the right to recover exemplary damages or attorney’s fees if it later sues that employee for misappropriation under the DTSA.¹⁶ The immunity does not cover someone who obtained the trade secret unlawfully in the first place; reporting a crime does not retroactively legitimize stolen information.

Who Enforces These Laws

Several Arkansas agencies share enforcement across different industries. The Arkansas Attorney General’s Office investigates violations of the Personal Information Protection Act, including failures to notify consumers after a breach. The Arkansas State Medical Board handles complaints about improper disclosure of patient records and can discipline healthcare providers up to license revocation. The Arkansas Securities Department monitors financial institutions and investment firms, with authority to impose administrative fines, revoke licenses, or refer matters for criminal prosecution. The Arkansas Department of Information Systems sets cybersecurity standards for how state government agencies store, transmit, and protect confidential data.

For businesses handling consumer financial data, the FTC’s Safeguards Rule adds federal oversight, requiring a written security program scaled to the institution’s size and the sensitivity of what it holds.³ Because the same incident can touch multiple statutes, a single act of misuse often draws responses from more than one agency and from private plaintiffs at the same time.

1
Justia. Arkansas Code 4-75-601 – Definitions
2
Justia. Arkansas Code 4-110-105 – Disclosure of Security Breaches
3
Federal Trade Commission. FTC Safeguards Rule: What Your Business Needs to Know
4
Justia. Arkansas Code 16-46-401 – Title
5
Federal Trade Commission. How To Comply with the Privacy of Consumer Financial Information Rule of the Gramm-Leach-Bliley Act
6
Justia. Arkansas Code 5-41-104 – Computer Trespass
7
Justia. Arkansas Code 4-75-603 – Statute of Limitations
8
Office of the Law Revision Counsel. 18 U.S. Code 1836 – Civil Proceedings
9
Justia. Arkansas Code 4-75-606 – Damages
10
Justia. Arkansas Code 4-75-607 – Attorneys Fees
11
Internal Revenue Service. Tax Implications of Settlements and Judgments
12
Justia. Arkansas Code 5-36-107 – Theft of a Trade Secret
13
Justia. Arkansas Code 5-4-401 – Sentence
14
Justia. Arkansas Code 5-4-201 – Fines – Limitations on Amount
15
Justia. Arkansas Code 5-37-227 – Financial Identity Fraud – Nonfinancial Identity Fraud – Restitution – Venue
16
Office of the Law Revision Counsel. 18 U.S. Code 1833 – Exceptions to Prohibitions