Privacy & Data Security

Our privacy and data security attorneys assist clients in developing best practices for information governance, assessments, audits, privacy policies, procedures, training tools, and cross-functional programs that affect the handling and protection of a company’s data. This work includes identifying privacy and cyber risks in corporate transactions and employee benefit plans and advising on the structure of employee-facing privacy and security policies and practices to ensure compliance with the various domestic and foreign data protection laws. These laws include the California Consumer Privacy Act (CCPA), the New York SHIELD Act, and other emerging U.S. state privacy laws, as well as the EU and UK’s General Data Protection Regulation (GDPR) and rapidly developing privacy regulatory regimes in Asia. We provide strategic counsel on the legal issues surrounding the cross-border transfer of personal information between countries, including China, the UK, EU Member States, and the United States. We also regularly advise boards and senior executives concerning the risks of cybercrime, data theft, data governance and record retention, and privacy and security incidents.

We leverage both the firm’s counseling and litigation offerings for companies looking for practical and solution-oriented assistance navigating the compliance, regulatory enforcement, and class action risks presented by the emerging patchwork of complex (and often conflicting) privacy laws with private rights of action. In this area, we primarily focus on three privacy statutes that have become active breeding grounds for debilitating class action litigation: the federal Telephone Consumer Protection Act (TCPA), the Illinois Biometric Information Privacy Act (BIPA), and the California Consumer Privacy Act (CCPA). We have experience with other key privacy laws, including the California Invasion of Privacy Act (CIPA), the Florida Telephone Solicitation Act (FTSA), the Florida Security of Communications Act (FSCA), and the Video Privacy Protection Act (VPPA). These laws contain private rights of action and provide for uncapped statutory damages, often leading to “bet-the-business” class action damage calculations. Consequently, they are heavily used by the plaintiffs’ bar. We help companies across all industries understand and address their obligations under these laws while proactively taking steps to mitigate potential regulatory and class action exposure.

Learn More

We have extensive experience defending our clients in class action and other privacy and consumer-protection actions, including those resulting from data breaches. We are particularly experienced in defending clients against litigation involving claims of a violation of the TCPA, BIPA, CCPA, CIPA, FTSA, FSCA, or the VPPA, among other privacy laws and statutes. Notably, we have established teams located in the most significant jurisdictions for privacy litigation, including Illinois, California, and Florida. We have a proven record of success handling class action cases in state and federal courts, at both the trial and appellate levels.

Our Privacy & Data Security Practice includes attorneys dedicated to helping clients protect their valuable data with proactive strategies. With the benefit of our computer forensic and data-security expertise, we have deep experience in leading significant trade secret investigations to catch and quantify the theft of valuable corporate data. We are well positioned to help companies respond to trade secret misappropriation by pursuing all legal remedies, including civil litigation and criminal prosecution.

Learn More

We are highly experienced in leading significant data-security investigations, including cyber, data breach, ransomware, insider data theft, and third-party vendor and cloud investigations. Winston is one of the only firms that has attorneys with computer forensics expertise—a valuable differentiator that provides our clients an edge in handling complex data investigations, incident response, and litigation. Once the investigation is complete, we deftly navigate a patchwork of complex laws that require companies to notify third parties and, if notification is required, we help clients formulate communications to the relevant governmental agencies, employees, and third parties. Additionally, our robust regulatory defense team remediates risk in government investigations or enforcement actions.

We work with clients to develop, negotiate, and execute major contracts that implicate the use, sharing, disclosure, and safeguarding of personal information. As companies increasingly rely on vendors (including cloud platform companies) to perform tasks like administering employee benefits, hosting e-commerce websites, and contacting customers on their behalf (e.g., via text message), they must transfer the sensitive personal information under their purview into the care of third parties. We help clients develop strategies to address material risks in this area, including responsibilities related to breach notification and indemnification, and negotiate contracts that give them maximum protection. We also assist in vetting potential vendors and negotiating licensing and service agreements, particularly with respect to the privacy and data-security provisions in such contracts.

Our team includes a former federal regulator from the U.S. Department of Health and Human Services – Office for Civil Rights, uniquely positioning us to provide practical advice about how to navigate HIPAA and HITECH compliance obligations and address related risks. Outside the United States, our capabilities extend to some of the most challenging jurisdictions, such as the EU and China, where our locally qualified data lawyers advise multinational health care services providers on the collection, storage, process, and transfer of health care data and assist in designing and implementing local data strategies, including telemedicine.

We emphasize not only meeting regulatory requirements, but also creating compliance infrastructure that can be effectively and successfully implemented in our clients’ business environments. Our goal is to create a compliance program where employees understand how to appropriately secure and maintain the privacy of patient information without these obligations interfering with the critical care that they provide. We also assist in reviewing business associate and other vendor agreements, advising on the use of patient information for marketing and advertising purposes, and crafting incident response and breach-notification plans.

We represent more clients in the financial services industry than in any other sector. Our extensive financial industry knowledge includes a long history of representing companies before domestic and international regulatory agencies, legislatures, and courts. We regularly help clients navigate arbitration panels and international tribunals. Our experience includes assisting clients with the electronic delivery of financial services and the establishment of online banking programs, advising financial institutions on Gramm-Leach-Bliley compliance, and representing clients before the Consumer Financial Protection Bureau.

Our team has extensive experience working with emerging technologies, including artificial intelligence (AI), facial recognition, and Internet of Things (IoT). We have built data-privacy compliance programs applied to new technology. We provide strategic counseling to help companies best position themselves to comply with existing privacy and data-security laws and employ privacy by design in anticipation of future legal requirements. We take a comprehensive approach to these deeply complicated matters by working with our Intellectual Property lawyers, who bring technical know-how to help our clients protect the technology, and data-security experts, who help meet the challenge of applying best practices and reasonable security.

We represent some of the world’s largest and most well-known brands and retailers and help their business teams understand how they can leverage their cache of consumer personal information while meeting global privacy obligations. We assist with the creation of consumer-facing privacy policies and website terms of use, and the development of back-end compliance infrastructure to address various levels of consumer notice, choice, and opt-outs that satisfy the requirements of global companies interacting with myriad laws, including, among others, GDPR and CCPA. We also work with our clients to review websites and develop mobile applications to identify privacy-related issues like marketing consent and cookie consent language. We also assist clients with respect to issues surrounding the analysis of large data sets and the de-identification, aggregation, and sharing of personal information, as well as other “big data” matters.

Many of our clients engage in marketing activities using email, automated telephone dialing systems, text message marketing, artificial or prerecorded calls, or fax machines. In the United States, the CAN-SPAM Act, TCPA, and related state laws impose strict requirements around how this marketing must be conducted. We help our clients build marketing programs that address and mitigate related risk. We counsel clients about interest-based advertising, mobile marketing, programmatic, and advertising matters. Our team has extensive knowledge regarding the Children's Online Privacy Protection Act (COPPA), the Federal Trade Commission Act, the Digital Advertising Alliance’s Self-Regulatory Principles, and similar legal requirements and industry guidelines.

Our clients operate on a worldwide basis and constantly encounter issues related to complying with the various privacy and data-security laws in jurisdictions in which they operate, as well as navigating data localization and cross-border data issues. In the EU and UK, our attorneys work together to address GDPR and member-state implementing measures.