DATA PRIVACY & CYBERSECURITY

Data Privacy & Cybersecurity (often referred to as just “Privacy”) practice covers counseling, litigation, negotiation, and other activities related to privacy and protection of personal information and other data under applicable law and cybersecurity best practices.

Data privacy practice is largely driven by applicable laws and regulations in the U.S. and in other countries.  Well-known examples include: GDPR (General Data Protection Regulation, a sweeping data privacy law in the European Union) and equivalents in other countries, CCPA (California Consumer Privacy Act), COPPA (Children’s Online Privacy Protection Rule), BIPA (Illinois Biometric Information Privacy Act), and other state and federal laws.  Although the U.S. does not have an overarching robust data privacy statute similar to the GDPR in the EU, many U.S. states have put such laws into effect or are in the process of doing so.

In addition to more general data privacy laws, other laws cover the protection of specific types of personal data – for example, HIPAA (Health Insurance Portability and Accountability Act) governs the use and privacy of individual’s health information and the Gramm Leach Bliley Act governs the treatment of personal information by financial institutions.

Data privacy practice at a BigLaw firm can take many forms, including:

—Transactional:  This can include negotiating contracts or portions of contracts related to data privacy (the most common example is a Data Processing Agreement/Addendum, required between two companies under GDPR and other laws where the transfer of personal data is involved), performing due diligence in mergers and acquisitions to analyze possible risks of a company’s data privacy and cybersecurity practices and history, negotiating data privacy- and cybersecurity-related terms of a merger agreements and other transactions, and other activities.

—Litigation:  This can include defending companies against lawsuits brought by classes of individuals or enforcement actions brought by state Attorneys General, the European Union, or other government bodies related to data privacy practices.  Such lawsuits can come out of violations of data privacy laws or in response to data breaches, where a company may be required to take certain actions (such as remedial measures, free credit monitoring to affected individuals, payment of damages, and others) – the latter is often referred to in practice as “data breach litigation” or “breach response litigation.”

—Counseling/Compliance:  It is common for law firm privacy practices to provide general regulatory compliance advice and counseling to clients.  Examples include assisting clients in establishing their privacy policies (also known as privacy notices), setting up data privacy and cybersecurity practices that meet legal requirements, industry best standards, and third-party certifications (such as the popular ISO and SOC-2 frameworks) and providing counsel on specific technology or practices on whether they pose a risk of legal violation, civil litigation, or data breach.

Some law firm privacy practice groups handle only certain categories of privacy matters (for example, focusing primarily on support for mergers and acquisitions with due diligence and negotiation of privacy-related terms or focusing only on privacy litigation), while some handle all of the above.  If you are a law student considering data privacy and cybersecurity practice at a BigLaw, it is critical to understand exactly the types of matters the group covers and make sure it aligns with your career goals. 

As new laws and regulations have come into effect over the past several years to govern emerging technologies, privacy practice has become one of the fastest-growing areas of law.  This is especially the case with the significant increase in popularity of artificial intelligence (AI), which brings considerable privacy implications.

Because privacy best practices and compliance are now a central legal concern for large companies, especially in the technology industry, data privacy legal roles are very common on in-house legal teams.

Within most BigLaw firms, the privacy practice group works closely alongside other adjacent groups, such as technology transactions, because of how commonly data privacy considerations come up in technology deals.  At many firms, the privacy team works as a subset of the technology transactions team, and/or the technology attorneys handle privacy matters in addition to their core technology transactions practice.

Many privacy attorneys are attracted to this area because it is at the forefront of a rapidly developing and relatively new area of law, provides a diverse set of exit opportunities (between law firm and in-house roles), and often provides a rare combination of transactional, litigation, counseling, and regulatory compliance practices.