Ice Miller’s Data Security and Privacy Practice has extensive legal and real-world technological experience.
As former information technology professionals, system engineers, and analysts, our attorneys understand the technologies involved in data and are able to effectively and efficiently advise clients on all aspects of the complex business, technological, legal and regulatory issues that relate to protecting such information. With experience throughout multiple legal disciplines, Ice Miller provides end-to-end coverage of privacy and data security issues. We aid clients in developing information privacy and security programs, modifying such programs to reflect changes in the business or legal landscape and investigating and responding as quickly as possible to incidents that might arise.
In light of a significant portion of data breaches often being related to current or former employees, we advise businesses in dealing with data privacy issues and developing security plans depending on their particular industry. Employees are often at the front line of data breaches and we assist business and government clients with drafting appropriate employee policies, including bring-your-own-device (BYOD) policies, overall record/data retention procedures and training to heighten security awareness of management and other employees with data access. We also assist clients in dealing with employee social media and e-privacy issues.
Incident Response and Investigations
We have worked with clients to investigate and respond to many incidents and data breaches involving the loss or misuse of consumer, employee or business information. We have assisted private businesses ranging from restaurants, online retailers, investment firms, hospitals, universities, housing complexes, and multi‑national manufacturers in evaluating legal obligations across federal and state law in 47 states related to data breach notification requirements and response.
Our attorneys stay up to date on federal and state data breach laws and have experience working alongside internal client data security and privacy teams or outside vendors to find and understand the issues resulting from an incident based on these laws. Ice Miller also helps clients develop a practical strategy in an incident situation that includes accessing insurance coverage, responding to media inquiries, addressing consumer expectations, evaluating ransom demands against company information, and reacting to the incident as it evolves.
<go to top>
Information Security and Privacy Programs
Whether clients need an information security and/or privacy program built from the ground up or modified in light of the ever-changing legal and business landscape in this area, we are prepared to assist. Ice Miller attorneys have successfully worked with engineers, managers, executives and third parties to construct practical information security and privacy policies and processes that address regulatory compliance, applicable law and business needs.
<go to top>
Cyber-Liability Insurance Recovery and Counseling
Our practice includes assisting clients in insurance coverage matters arising out of data and network security matters, managing claims, coordinating claim activity with insurers and advocating policy construction that maximizes insurance recovery. We also provide policyholders with counseling on pre-loss issues, ranging from assessments of coverage for particular risks to help with securing favorable coverage terms under specialty technology and cyber-liability insurance policies.
<go to top>
HIPAA Compliance and Audit Response
The U.S. Department of Health & Human Services (HHS) is continuing to increase the frequency and rigor of HIPAA audits covering the Privacy and Security Rule. We work hand-in-hand with our covered entity and business associate clients to prepare for increased regulatory oversight by implementing or refining HIPAA compliance programs. In one example, our team includes a former HHS investigator who now conducts risk assessments for our clients to better understand how to protect patient information and remediate compliance gaps.
<go to top>
The collection, processing, transfer and retention of information may create issues in business to business transactions, including mergers, acquisitions, joint ventures, outsourcing, licensing and commercial agreements. Identifying and addressing privacy and data security issues in a deal prior to execution is critical for some deals. We work closely with Ice Miller’s Business Services team to help build successful transactions for our clients.
<go to top>
International Data Transfer and Protection
Clients seek and receive our counsel on the collection and processing information under international legal frameworks and changes to the same, including PIPEDA, Canada Anti-Spam Legislation and upcoming requirements found in the EU General Data Protection Regulation. This work includes assistance with transferring information outside of the EU through binding corporate rules, standard contractual clauses, and tracking of international agreements for transfer, like EU/US Privacy Shield.
<go to top>
Practice Areas of Concentration
Litigation and Investigations
-
Data Breach and Incident Response, Investigation and Litigation
-
Regulatory Agency Investigations into Data Privacy and Security Standards and Best Practices
-
Government Agency Data Requests
-
HIPAA-based Audits by the HHS Office for Civil Rights
-
Online Defamation, Right of Publicity
-
North American Electric Reliability Corporation Audits
-
PCI-DSS Compliance Audits
Counseling
-
EU Data Protection Issues
-
Cybersecurity and Network Intrusion Issues
-
Ransomware and Cyber Extortion Response, Prevention, and Remediation
-
Insurance Coverage Analysis and Loss Recovery
-
Global Data Protection and International Data Transfers
-
Public and Private School and University Data Privacy Compliance
-
Legal Compliance and Information Security Assessments
-
Issues with Collection and Use of Employee Information
-
Implementation of Industry Best Practices in Data Privacy and Security
-
Information Management and Governance
-
Data Analytics and Big Data Concepts
-
Proper Collection and Use of Financial Information, including Credit Card Information
-
Online Privacy Policies and Terms of Use
-
Data Mapping
-
HIPAA Security Rule Risk Assessments
-
HIPAA Privacy Rule, and Breach Notification Rule Compliance
<go to top>