Maeve Malik

Maeve’s practice focuses on privacy and cybersecurity law. Maeve regularly advises clients across various industry sectors on developing or enhancing existing global privacy compliance and records management programs to help manage privacy risks. She also has extensive experience advising clients on cybersecurity incident response, including for several large-scale, high-profile cybersecurity incidents. In addition, Maeve regularly assists clients with proactive cyber incident readiness activities, such as tabletop exercises and incident response procedures.

Maeve is a co-chair of the firm’s veteran’s pro bono program and serves on the pro bono committee of Hunton Andrews Kurth’s New York office. Her active pro bono practice includes providing legal services to veterans, focusing on claims related to military sexual trauma. In addition, Maeve has represented undocumented children in immigration court matters, and has volunteered with the New York City Bar Justice Center’s Legal Clinic for the Homeless, advocating for clients facing denials and reductions of public benefits.

• Regularly advises clients on all aspects of cybersecurity incident response, including engaging third-party services (such as forensic investigation firms, cyber extortion specialists, credit monitoring services, PR firms and call centers), preparing breach notifications, managing customer service responses to incident-related inquiries, developing media strategies, and preparing investigative reports.
• Assists clients with proactive cyber incident readiness activities and other cyber governance policies and procedures, such as tabletop exercises, data breach notification toolkits, incident response plans and procedures (including cyber extortion procedures), Acceptable Use policies, and related policies and procedures.
• Advises clients on developing or enhancing existing privacy compliance programs, including assessing federal, state and global legal requirements, developing gap assessments and compliance roadmaps, and drafting or revising policies and procedures such as privacy notices, data subject rights procedures, consent mechanisms, contract templates, privacy program policies.
• Among other large-scale cybersecurity incidents, advised a technology company in all aspects of responding to the two largest reported data breaches affecting more than 3 billion user accounts.
• Assisted a global retail and technology company with a cybersecurity incident affecting approximately 150 million user accounts, handling response efforts including notification and multi-jurisdictional investigations by regulators and data protection authorities.
• Counseled a variety of clients in different industries, including retail, hospitality, health care and manufacturing, on all aspects of responding to ransomware attacks, cyber extortion events and other data breaches, including the forensic investigation, recovery from the attack, ransomware/extortion negotiations, engagement with law enforcement, breach notification, and other internal and external communications strategies.
• Advises clients on managing federal, state and international regulatory inquiries in connection with alleged privacy and data security violations, including FTC, OCR and state Attorney General investigations and enforcement actions.
• Advises clients on building compliance programs and managing risk associated with cutting-edge technologies such as biometric technology initiatives and artificial intelligence (AI).
• Negotiates complex privacy and data security provisions and indemnities in vendor agreements.
• Helps companies design and evaluate privacy impact assessments.
• Advises clients on cross-border data transfer strategies, including compliance with the Data Privacy Framework.
• Develops and enhances comprehensive records management programs.
• Prepares employee training materials focusing on privacy and data security practices and requirements.
• Assists with internal investigations of privacy- and data security-related allegations.