"Commercial Know-How": information on Ludens' clients, e.g. client lists, documents outlining Ludens' marketing strategy, sales, turnover and financial data;

"Technical Know-How": documents listing the patents protecting Ludens' diagnostic tools describing the technology on which Luden relies (projects and drawings, manufacturing and maintenance manuals, user manuals); and

"Health Data": data relating to certain patients who were diagnosed using Ludens' diagnostic tools. Ludens processes health data by anonymising and aggregating individual patient data and then selling the datasets of anonymous data to hospitals and researchers.

Shikari's data centre was recently the target of a cyber incident, and as a result certain Data of Ludens' was hacked.

Following the incident, Ludens sent Shikari a warning letter, whereby Ludens sought damages for Shikari's alleged breach of its obligation to store Data. Ludens' claim relies on the following main arguments:

Ludens' Commercial Know-How and Technical Know-How was material confidential information which gives Ludens an advantage over its competitors (the "Breach of Confidence Claim");

There was a breach of the health data pertaining to patients who had been diagnosed and treated with Ludens' tools. Therefore Shikari is liable under the GDPR (Art. 5) for having failed to put in place the necessary security measures aimed at preventing unauthorised data processing (the "Data Protection Claim").

Questions

For each claim, please:

• Summarise the grounds on which the claim relies;
• Outline potential arguments rebutting the claim; and
• Identify next steps, i.e. what actions Shikari and/or your firm need to take to prepare for litigation. Consider whether you have all the necessary information and request any additional documents required to establish the facts and legal obligations.