Areas of Experience

Our privacy and cybersecurity practice group focuses on providing legal services in the following areas:

• Compliance with all US federal and state privacy and information management requirements, including the California Consumer Privacy Act (as amended by the California Privacy Rights Act), Colorado Privacy Act, Virginia Consumer Data Protection Act, the Gramm-Leach-Bliley Act, HIPAA, the Children’s Online Privacy Protection Act, the Fair Credit Reporting Act, Fair and Accurate Credit Transactions Act of 2003, the Driver’s Privacy Protection Act, CAN-SPAM, Telephone Consumer Protection Act (TCPA), state and federal security breach notification laws, state Social Security laws, the Payment Card Industry Data Security Standard, and other federal and state requirements;
• Compliance with all international data protection laws, including the EU General Data Protection Regulation and e-Privacy Directive and member state implementations thereof (including the EU-US Data Privacy Framework, standard contractual clauses and binding corporate rules), the Canadian Personal Information Protection and Electronic Documents Act (PIPEDA) and China’s Personal Information Protection Law (PIPL);
• Comprehensive assistance with significant information security breaches, including network intrusion investigations, customer notification, state and federal regulatory negotiations, discussions with payment card issuers, as well as public relations, call center and investor relations communications and training;
• Preventing and managing cyber events, from security planning and developing proactive, breach-readiness solutions, including incident response and table top exercises, to handling of litigation and disputes arising from such events;
• Performance of comprehensive privacy and information management assessments, including preparation of data flow maps, and privacy policies and procedures;
• Development and implementation of privacy and data use policies and procedures that comply with applicable laws and generate consumer and business partner confidence, revenue and flexibility;
• Development and implementation of programs to protect global information assets, including legislative and regulatory advocacy;
• Assistance with information product life cycle issues, including product promotion, customer profiling, targeted marketing, channel definition and expansion, franchising, branding, advertising, warranties and pricing;
• Drafting and negotiation of vendor contracts and information use and distribution agreements; and,
• Assistance with dispute resolution, management of consumer concerns, response to allegations of misuse of data, state and federal investigations (including actions and requests for information from state attorneys general and the Federal Trade Commission) and litigation.

Relevant Experience

• Serve as global privacy counsel to a Fortune 50 retailer. We assisted the client in developing a global privacy framework, including privacy governance documents, a vendor management program, data transfer documents and an information security program for emerging business initiatives. In addition, we have drafted the company's global privacy policy.
• Advise a Fortune 10 company on various US and international privacy and data protection compliance initiatives, including assisting the company with cross-border data transfer strategy, employee monitoring, numerous records management compliance projects, and several significant information security issues that had global impact in nearly 80 countries.
• Assist a Fortune 500 financial services company with US and EU data protection compliance issues impacting the company, and also are working with the company on its cross-border data transfer strategy, binding corporate rules.
• Regularly advise a Fortune 150 retail company on significant privacy and data security issues. We assisted the company with its data security breach remediation, including the development and implementation of a global comprehensive, written privacy and information security program. In addition, we have assisted the company with Payment Card Industry Data Security Standard (PCI) compliance activities and issues related to new payment card and loyalty card programs. We also have worked with the company to develop numerous privacy statements and notices (online and offline) worldwide and to manage privacy risks where vendors process personal data on behalf of the company.
• Provide global privacy and data security advice to a leading technology company, including advising on numerous aspects of US and EU privacy law in connection with cutting-edge privacy issues and compliance with new and existing EU rulings (such as the GDPR), monitoring and mobile issues.