Privacy & Data Security
BuckleySandler provides advice and litigation advocacy to clients, particularly financial services institutions, on matters involving the full spectrum of privacy issues affecting their business operations, including:
- Gramm-Leach-Bliley Act restrictions on sharing nonpublic personal information and the requirements for safeguarding information
- Fair Credit Reporting Act restrictions with respect to the use and disclosure of customer information
- Section 5 of the Federal Trade Commission Act claims
- USA PATRIOT Act and Office of Foreign Assets Control (OFAC) requirements
Cross-border information sharing, including the European Union Privacy Directive - Data safeguarding requirements, including identity theft and "red flag" requirements
- State restrictions on information sharing and data security breach notification responsibilities
- General marketing restrictions involving privacy and data security issues
BuckleySandler assists clients in proactively recognizing privacy and data issues to identify and mitigate risks to the organization and its customers, aggressively addressing data security incidents, and responding to regulatory examinations or enforcement actions or litigation involving privacy or data security compliance. Our practice in this area includes:
- Providing advice regarding privacy and data security compliance matters, including working with federal and state regulators
- Working with clients to draft and revise privacy notices, including the use of the federal model notice form
- Assisting clients in developing comprehensive privacy and data security policies and procedures
- Advising clients on creation of identity theft red flags programs and employee education materials
- Crafting affiliate marketing plans
- Structuring joint ventures and marketing relationships to meet legal requirements
- Assisting clients in structuring outsourcing arrangements to ensure compliance with US and international requirements, including the European Union Privacy Directive
- Negotiating contractual privacy and data security provisions
- Advising clients on strategic planning and development of public policy positions
- Advocacy with legislators and regulators to ensure that overly broad regulatory language and interpretations do not create undue regulatory burdens
- Assisting numerous clients, including hedge funds and investment management companies, in developing policies to ensure compliance with USA Patriot Act and OFAC requirements
In the event of litigation or regulatory enforcement, BuckleySandler Privacy and Data Security attorneys provide comprehensive representation and advice to clients. We have represented clients in an array of privacy and data security incidents including data security breaches, information sharing and telemarketing. Representative experience includes:
- Incident investigations, including the selection of external investigators as appropriate
- Negotiating with law enforcement and regulators regarding criminal investigations
- Consumer and regulatory notice requirements under US and international standards
- Drafting notice letters and customer service center call scripts
- Formulating customer service and media strategies
- Preparing materials for possible subsequent litigation
Members of the group frequently speak at privacy and data security and financial institutions conferences including those of the International Association of Privacy Professionals, the American Conference Institute, the Information System Security Association, and the International Information Systems Security Certification Consortium. Group members also have authored articles and papers on privacy and data security topics.
