Our multidisciplinary Privacy and Data Security team counsels clients along the entire privacy and data security spectrum, including pre-breach preparation and risk management, security and vulnerability assessments, policy and procedure creation and review, breach response planning and drills, table-top exercises, as well as board and management education on reducing cyber risk.
Industry-leading qualifications Several members of our team are recognized by the International Association of Privacy Professionals (IAPP), the global gold standard for privacy professionals, as a Certified Information Privacy Professional in both the United States (CIPP/US) and Europe (CIPP/E). In addition, F. Paul Greene, head of our team, is a Distinguished Fellow of the Ponemon Institute, the pre-eminent research center dedicated to privacy, data protection and information security policy. Our exceptionally qualified attorneys have experience at Am Law 100 firms, judicial clerkships, handling high-stakes litigation, and have earned many accolades in respected law firm ranking programs, including Chambers USA, The Best Lawyers in America®, Best Lawyers: Ones to Watch in America, and Super Lawyers.
Deep industry experience We are trusted privacy and data security advisors to organizations of all sizes—from start-ups to Fortune 100 corporations—in numerous industries including retail, health care, financial services, defense manufacturing, critical infrastructure, information technology, software development and sales, higher education, not-for-profit organizations and more. This enables our team to provide deep insight across a number of regulatory spaces, giving our clients a broader view of how best to manage regulatory risk.
Efficiency, cost-effectiveness and plain talk The deep knowledge of each of our team members allows us to provide robust analysis and advice, without multiple layers of review. Moreover, clients tell us that we explain complex issues in a way they can understand, as we advise them on the full range of privacy and data security issues, such as:
Breach notification requirements under federal and state laws
Privacy and breach notification policies
Data security/Privacy risk assessments
Preparing for and avoiding a data breach or loss
Incident response tabletop exercises
Contracts with data security and privacy concerns
Organizational readiness for a breach
Comprehensive privacy management programs
Crisis management and remediation in response to a data breach
Internal investigations arising out of a data breach, including interaction with law enforcement and regulators
Indemnification and insurance claims
Potential litigation related to data breaches
Transactional due diligence concerning privacy and data security
Health Insurance Portability and Accountability Act (HIPAA)
California Consumer Privacy Act (CCPA)
The EU’s General Data Protection Regulation (GDPR)
The NY SHIELD Act
23 N.Y.C.R.R. Part 500
Health Information Technology for Economic and Clinical Health Act (HITECH)
Payment Card Information Data Security Standard (PCI-DSS)
Family Educational Rights and Privacy Act (FERPA)
Gramm-Leach-Bliley Act (GLBA)
Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA)
Fair and Accurate Credit Transactions Act (FACTA)
Freedom of Information Act (FOIA)
Fair Credit Reporting Act (FCRA)
Americans with Disabilities Act (ADA)
For immediate access to our Privacy and Data Security team and their deep connections with information security professionals, forensic investigators, crisis communication professionals, with maximum protection offered by the attorney-client privilege, call our Cybersecurity Incident and Breach Response Line at 1-800-232-3021.
What We See On the Horizon
California Consumer Privacy Act (CCPA) The most comprehensive and far-reaching data privacy law yet enacted in the U.S., CCPA took effect on January 1, 2020, with compliance obligations affecting businesses worldwide. Many of these obligations are novel, creating new requirements regarding data protection, responding to consumers, and reporting to regulators. HSE has developed CCPA and privacy management programs for clients in a number of industries including retail, financial services, adtech, information technology, and more.
State-Level Data Breach Notification Laws All 50 states now have data breach notification laws – a web of sometimes conflicting regulations which can be difficult for companies to navigate. Our Insights on State Data Protection Laws webpage contains information to educate you on potential applicability and the impact the patchwork of state requirements may have on your business, as well as a summary of each state’s notification laws.
Continued Reputation and Financial Risk Related to Privacy and Cyberattacks Your regulatory obligations in the event of a breach depend on the types of data that hackers are able to access, and each generation of malware varies in the sorts of data it seeks to access. Because we work continuously with data security experts, we stay up to date with current threats and can advise you quickly about your legal obligations in the event of a breach.
This website presents only general information not intended as legal advice. Although we encourage calls, letters and emails from prospective clients, please keep in mind that merely contacting Harter Secrest & Emery LLP (HSE) does not establish an attorney-client relationship between us. Confidential information should not be sent to HSE until you have been notified in writing by HSE that a formal attorney-client relationship has been established. Information sent to us before then may not be treated as confidential by HSE or the court.
