Data Security and Privacy

Representative Experience

• Assisted Fortune 100 information technology provider in analysis of fraud activity and management of forensic vendors, fraud loss analysis team, and insurance.
• Assisted consumer software and device company in response to active data breach and extortion situation, including coordination between multiple forensics vendors, insurance, and company IT resources.
• Assisted a retail brand, large data provider, investment firm and other entities in navigating insurance policies and litigation opportunities to recover losses from data breaches, including forensic and legal expenses and losses attributable to the breaches.
• Represented a large data provider in identifying the scope of and responding to a data breach where a malicious third party utilized a distributed denial of service attack as a cloak over data exfiltration and a wire fraud attack.  Our work included handling public-facing communications, evaluating contractual obligations, and assessing federal and state legal obligations.
• Advised a private businesses ranging from a small-town restaurant to a multi‑national manufacturer in evaluating legal obligations across federal and state laws related to data breach notification requirements and response.
• Assisted a multi-state landlord in addressing international laws as they relate to data breach response for foreign visitors.
• Counseled a direct-mail marketing company in assessing whether misdirected mailings constituted a reportable security incident under Indiana law.

• Ongoing advice to health care providers in assessing and responding to a patient privacy complaint and determining whether a HIPAA breach of unsecured PHI had occurred.
• Assisted a health care provider in determining whether handling of paper medical records constituted a HIPAA breach of unsecured PHI.
• Representation of clients under audits of HIPAA compliance during audits from the Office for Civil Rights at the U.S. Department of Health and Human Services.

• Advised domestic and international clients in developing employee policies to protect corporate and customer data, including bring-your-own-device (BYOD), acceptable internet/e-mail use, mobile access and secure travel protocols.
• Provided managerial and key staff training on the importance of data security and corporate security policies, as well as what constitutes a breach and how to appropriately respond if a breach occurs.

• Defended, and continue to defend, litigation filed by several plaintiffs based on a reported data breach.
• Defended clients in class action litigation due to privacy related matters including claims under the Telephone Consumer Protection Act (TCPA).
• Pursued and defended claims under the Computer Fraud and Abuse Act (CFAA).

• Advised many IT service providers, including IaaS, PaaS, and SaaS providers on development and implementation of information security and privacy programs designed to assess risk and/or comply with industry standards and frameworks.
• Assisted a real-time operator and vertically integrated utilities in preparation of and acted as lead counsel during federally mandated cyber security audits.
• Evaluated contracts with a lens towards data security and privacy during the IT procurement process.
• Developed and implemented consumer-facing privacy statements and contracts that provide privacy commitments, acceptable use, and a privacy complaint process.
• Evaluated and responded to consumer privacy complaints on behalf of IT service providers.
• Developed, implemented, and been involved in testing of incident response plans.