The California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) radically changed privacy and data protection in the United States by providing consumers with expansive privacy rights and more control over the personal information that businesses collect about them, added new responsibilities for business and service providers, and created a new state agency, the California Privacy Protection Agency to handle enforcement. Every company with a California nexus will need to evaluate and implement changes across business lines to comply with the CCPA and CPRA.

We can also help you closely monitor similar laws and regulations enacted in other states (and countries), including the Virginia’s Consumer Data Protection Act (CDPA) and the General Data Protection Regulation (GDPR), ensuring that the privacy compliance program developed addresses any potential impact of the changing legal and regulatory landscape.

Consumer confidence and safety concerns over personal data related to technologies and digital products increasingly result in investigations by regulatory authorities, consumer class and collective actions, and securities and derivatives litigation. Through our compliance and risk management counseling, we work with clients to minimize their risk of becoming the target of investigations. In addition, we have had great success assisting clients in resolving government inquiries and investigations before they become litigation. We also counsel on federal, US State, UK and EU privacy-related legislation and rulemakings, including self-regulatory efforts to develop and implement new standards and best practices.

Cybersecurity incidents can be catastrophic to your company’s business and brand. We offer a comprehensive and multidisciplinary approach to legal advice and strategy on data security incidents, cybersecurity emergencies and ransomware. Our lawyers help bolster your enterprise security and breach response function, provide guidance on enhancing protections in third-party agreements, respond to actual or potential cybersecurity incidents, and defend your company in any litigation and regulatory inquiries. We have internalized the law and leverage best practices to provide prompt, informed, balanced and practical advice that goes beyond the legal minimums. Our free, proprietary interactive tool for United States data breach notification applies both the law and the firm’s deep knowledge base to any new event or potential threat.

Regardless of your industry, the Fair Credit Reporting Act (FCRA) is an important and frequently challenging act that may impact your corporation on various issues concerning data usage, hiring and other personnel decisions in employment, privacy and security. The FCRA’s complexity and the potential for imposition of penalties for non-compliance make it among the most dangerous consumer protection laws.

We are one of only firms to build a dedicated practice focused around issues pertaining to the FCRA, including big data analytics, employment screening processes and insurance recovery. Our team includes seasoned litigators with strong class action track records, former federal and state regulators with substantial FCRA compliance experience, employment lawyers who provide guidance regarding the use of consumer reports for employment purposes and derogatory reports, and insurance lawyers who provide coverage reviews to identify potential issues or exposure.

We can offer you advice and counseling on fundamental FCRA issues, including, but not limited to:

• Whether you are subject to the act’s restrictions pertaining to consumer reporting agencies (CRAs)
• Whether you are required to make certain credit score disclosures mandated by the act
• What steps you must take to comply with the procedural requirements of the act when obtaining consumer reports and investigative consumer reports for use in hiring, retention, promotion or reassignment decisions
• How you should report certain information to CRAs
• What actions you should and should not take following receipt of a report of a dispute of furnished information
• What processes for notice and disclosure you should follow upon receipt of negative information in a consumer report or investigative consumer report before taking adverse actions that will negatively impact the employment of a prospective or current employee
• What defense you need against investigations concerning the act
• How you insure they have proper coverage against claims under the act
• What steps you can take to assure that human resources and other representatives are complying with applicable FCRA requirements
• Whether you are subject to the requirements of the FCRA when performing investigations into allegations of employee misconduct

The General Data Protection Regulation (GDPR) is a seismic change to European data protection law to accommodate changes in the use of technologies over the last 20 years. Our team can help you understand the new obligations, navigate the path to compliance and limit your risk exposure to increased sanctions. We provide tailored training sessions and automated tools to help support your GDPR compliance and can guide your business on Binding Corporate Rules (BCRs). It is our goal to ensure your data protection measures are commercial, as well as compliant.

To help health care providers and other entities manage and protect sensitive health information, we maintain a sophisticated team of data privacy and security lawyers with a unique combination of privacy, security and health care industry experience. Our lawyers focus exclusively on counseling entities – like you –  doing business in the health care field, including providers (covered entities), business associates, and pharmaceutical and medical device manufacturers on data privacy and security matters. In particular, we regularly advise on a wide range of privacy and security issues under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), state privacy laws and applicable international privacy laws, such as the EU General Data Protection Regulation (GDPR).

With increased enforcement efforts by state attorneys general (AGs) on a wide variety of issues and industries, it is important that corporations are proactive in building bridges with AG offices with the goal of effectively and efficiently resolving problems before they become an issue for the business.

In an increasingly digital world, your corporation may be struggling to keep pace with developing technologies and navigating the use of robocalls and mobile devices to communicate with customers and consumers. Our team brings extensive capabilities to companies facing issues surrounding the use of unauthorized telephone calls made to mobile devices using autodialers and prerecorded messages, as well as unauthorized facsimiles and text messages.

We can defended you in class action lawsuits and FCC actions alleging such violations, and maximize potential insurance recovery of defense costs, settlements and judgments. We can assist you in developing customized compliance programs, providing counseling, and helping to influence the development of policy and the law.