Data Privacy & Cybersecurity

EM³'s Data Privacy and Cybersecurity practice takes a comprehensive, integrated approach to cybersecurity and data privacy challenges. The Firm offers clients strategic advice on the cyber threats they face (to consumer or employee information, intellectual property, or product safety) and on the legal, commercial, and reputational risks that accompany them. A multidisciplinary approach helps clients take practical steps to address these risks effectively.

Our Data Privacy and Cybersecurity practice includes attorneys from multiple disciplines, including litigation, regulatory, corporate, government affairs and global trade, intellectual property, enforcement, employment, and technology and intellectual property transactions. With this range of disciplines, the Firm can provide focused counsel on privacy and security law, which keeps growing more complex.

The Firm designs and implements enterprise-wide privacy and data governance programs that align with clients' business objectives and regulatory obligations. Our compliance work spans privacy impact assessments, data mapping and inventory exercises, vendor due diligence programs, employee training protocols, and the development of privacy policies, notices, and consent frameworks. For clients deploying artificial intelligence and machine learning systems, the Firm advises on AI governance frameworks, algorithmic accountability requirements, and the data privacy implications of automated decision-making.

In the United States, the Firm advises clients in the healthcare industry regarding the Health Insurance Portability and Accountability Act (HIPAA), HITECH, and state-specific legislation, including the California Consumer Privacy Act (CCPA) and Illinois's Biometric Information Privacy Act (BIPA) and Genetic Information Privacy Act (GIPA). The Firm represents HIPAA covered entities and business associates, drafts privacy policies and notices, and counsels clients regarding the privacy and security requirements of the use and disclosure of protected health information. Our litigators have also defended actions brought against employers under both BIPA and GIPA.

The Firm's international reach allows it to provide coordinated counsel to clients around the world. Our expansive network of local counsel located throughout the Americas, Europe, and Asia possesses deep knowledge of the cybersecurity and data privacy regimes in their home countries and surrounding regions. This global capability allows the Firm to assist with clients' most complex international matters, whether advising on enterprise-wide privacy frameworks, counseling on international data transfers, or coordinating multi-jurisdictional data breach responses.

The Firm works with clients' business, technical, and compliance leaders on practical, efficient, and proactive responses to international regulatory developments, including the European Union's General Data Protection Regulation and the many evolving regulations and regulatory regimes in the Asia-Pacific region.

When a data breach or cybersecurity incident occurs, the Firm mobilizes cross-disciplinary teams to manage the legal, regulatory, and reputational dimensions of the response. Our breach response capabilities include forensic investigation coordination, notification obligation analysis across multiple jurisdictions, regulatory agency communications, and post-incident remediation planning. The Firm guides clients through the critical first 72 hours and continues through regulatory investigations, litigation defense (including class action defense), and program improvements designed to prevent recurrence.

• Enterprise privacy and data governance programs
• HIPAA, HITECH, and healthcare data compliance
• BIPA and GIPA defense and compliance
• GDPR and international data transfer frameworks
• AI governance and algorithmic accountability
• Data breach response and incident management
• Vendor and third-party risk management
• Privacy policies, notices, and consent frameworks