Overview
Our multidisciplinary Privacy and Data Security team counsels clients along the entire privacy and data security spectrum, including pre-breach preparation and risk management, security and vulnerability assessments, policy and procedure creation and review, breach response planning and drills, table-top exercises, as well as board and management education on reducing cyber risk.
Industry-leading qualifications
Several members of our team are recognized by the International Association of Privacy Professionals (IAPP), the global gold standard for privacy professionals, as a Certified Information Privacy Professional in both the United States (CIPP/US) and Europe (CIPP/E). In addition, F. Paul Greene, head of our team, is a Distinguished Fellow of the Ponemon Institute, the pre-eminent research center dedicated to privacy, data protection and information security policy. Our exceptionally qualified attorneys have experience at Am Law 100 firms, judicial clerkships, handling high-stakes litigation, and have earned many accolades in respected law firm ranking programs, including Chambers USA, The Best Lawyers in America®, Best Lawyers: Ones to Watch in America, and Super Lawyers.
Deep industry experience
We are trusted privacy and data security advisors to organizations of all sizes—from start-ups to Fortune 100 corporations—in numerous industries including retail, health care, financial services, defense manufacturing, critical infrastructure, information technology, software development and sales, higher education, not-for-profit organizations and more. This enables our team to provide deep insight across a number of regulatory spaces, giving our clients a broader view of how best to manage regulatory risk.
Efficiency, cost-effectiveness and plain talk
The deep knowledge of each of our team members allows us to provide robust analysis and advice, without multiple layers of review. Moreover, clients tell us that we explain complex issues in a way they can understand, as we advise them on the full range of privacy and data security issues, such as:
- Breach notification requirements under federal and state laws
- Privacy and breach notification policies
- Data security/Privacy risk assessments
- Preparing for and avoiding a data breach or loss
- Incident response tabletop exercises
- Contracts with data security and privacy concerns
- Organizational readiness for a breach
- Comprehensive privacy management programs
- Crisis management and remediation in response to a data breach
- Internal investigations arising out of a data breach, including interaction with law enforcement and regulators
- Indemnification and insurance claims
- Potential litigation related to data breaches
- Transactional due diligence concerning privacy and data security
- Health Insurance Portability and Accountability Act (HIPAA)
- California Consumer Privacy Act (CCPA)
- The EU’s General Data Protection Regulation (GDPR)
- The NY SHIELD Act
- 23 N.Y.C.R.R. Part 500
- Health Information Technology for Economic and Clinical Health Act (HITECH)
- Payment Card Information Data Security Standard (PCI-DSS)
- Family Educational Rights and Privacy Act (FERPA)
- Gramm-Leach-Bliley Act (GLBA)
- Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA)
- Fair and Accurate Credit Transactions Act (FACTA)
- Freedom of Information Act (FOIA)
- Fair Credit Reporting Act (FCRA)
- Americans with Disabilities Act (ADA)
For immediate access to our Privacy and Data Security team and their deep connections with information security professionals, forensic investigators, crisis communication professionals, with maximum protection offered by the attorney-client privilege, call our Cybersecurity Incident and Breach Response Line at 1-800-232-3021.
What We See On the Horizon
California Consumer Privacy Act (CCPA)
The most comprehensive and far-reaching data privacy law yet enacted in the U.S., CCPA took effect on January 1, 2020, with compliance obligations affecting businesses worldwide. Many of these obligations are novel, creating new requirements regarding data protection, responding to consumers, and reporting to regulators. HSE has developed CCPA and privacy management programs for clients in a number of industries including retail, financial services, adtech, information technology, and more.
State-Level Data Breach Notification Laws
All 50 states now have data breach notification laws – a web of sometimes conflicting regulations which can be difficult for companies to navigate. Our Insights on State Data Protection Laws webpage contains information to educate you on potential applicability and the impact the patchwork of state requirements may have on your business, as well as a summary of each state’s notification laws.
Continued Reputation and Financial Risk Related to Privacy and Cyberattacks
Your regulatory obligations in the event of a breach depend on the types of data that hackers are able to access, and each generation of malware varies in the sorts of data it seeks to access. Because we work continuously with data security experts, we stay up to date with current threats and can advise you quickly about your legal obligations in the event of a breach.
