Privacy & Cyber Regulatory Enforcement

In the wake of a security or privacy incident, companies can find themselves the subject of one or more regulatory inquiries. Data breaches, vulnerability disclosures, security incidents, government data leakage, and privacy incidents can trigger the attention of regulatory bodies. You can call on our experience to effectively manage investigations of any size and complexity.

Federal Experience

Lead counsel to a major pharmacy benefit manager and care services group following a vendor’s data breach involving nearly 12 million patient records. Our team is responsible for coordinating the global response to the data breach and related regulatory inquiries, including a multistate AG investigation and federal HHS/OCR investigation.
Defending a leading rent-to-own company in class actions, as well as FTC and state AG investigations, across the country based on allegations that the company installed spyware on its leased computers and used it to take webcam photographs, log key strokes, and take screenshots of computing activities.
Defended a health care payment service in a privacy and data security FTC enforcement action involving alleged deceptive acts in violation of Section 5(a) of the Federal Trade Commission Act.
Represented one of the world’s largest data brokers in an FTC investigation involving the EU-U.S. Privacy Shield, resulting in the investigation being closed with no further action.
Defended multiple health care providers in an investigation that resulted in declining the case for action.
Represented a Fortune 50 company in an SEC inquiry following a significant data breach; resolved the inquiry without elevated investigation or further regulatory action.
Represented a telecommunications company in an FCC inquiry following a security incident; resolved the inquiry without further action.
Represented a global payment processor in a technical, complex computer crime investigation, including coordinating the activities of financial regulators, federal law enforcement, and other third parties.
Worked on numerous investigations by the Office of Civil Rights into HIPAA breaches, including for health care providers, health insurance companies, and HIPAA business associates. We have resolved many such matters without sanctions or corrective actions being imposed. We have also advised HIPAA covered entities and business associates on whether a HIPAA incident is reportable as a breach of unsecured protected health information (PHI) under HIPAA and also under various state breach notification laws. Examples of these HIPAA matters include software/coding errors, printing errors, incorrect mailings, snooping of patients’/coworkers’ PHI, IT equipment retained by a former employee, phishing emails, and third-party hackers (including international hackers), as well as employees and former employees posting PHI on social media.
Defended multiple businesses in a variety of industries in privacy and data security enforcement actions brought by the FTC under Section 5(a) of the Federal Trade Commission Act.

State Experience

Represented a major revenue cycle management provider in a vendor breach, including coordinating compliance with U.S. state and federal breach notification statutes and inquiries from a multistate investigation involving 42 state attorneys general.
Represented a global retail company in a sophisticated cyber-attack, including coordinating the activities of state and federal regulators and other third parties.
Represented one of the largest U.S. home improvement retailers in connection with a sophisticated cyber-attack and criminal intrusion, including inquiries from federal and state regulatory authorities.
Defending a major retailer in privacy-related investigations by the state attorneys general of California, Florida, Massachusetts, Pennsylvania, and Texas along with parallel multidistrict litigation.
Represented clients in payment card incidents involving two multistate investigations by more than 35 state attorneys general.
Represented a global provider of business information in connection with a sophisticated organized criminal group intrusion, including coordinating compliance with state, federal, and international breach notification statutes, regulations, and recommendations, and numerous state attorneys general inquiries.
Assisted an international retailer in a comprehensive overhaul of its privacy, security, PCI, and data management practices during both FTC and multiple state attorneys general investigations.
Represented a global company in connection with a sophisticated cyber-attack perpetrated by a former employee that resulted in access to sensitive data, triggering a state attorney general investigation.
Represented a company in a state attorney general investigation arising from a breach of sensitive data, resulting in no action or fine assessed.

Compliance Counseling

Federal Trade Commission Act Compliance. We have been advising clients on privacy and security compliance matters under the FTC Act for more than a decade. Our team includes a former chief of staff for the FTC’s Bureau of Consumer Protection. We develop and implement FTC Act–compliant privacy policies, advise clients on privacy policy compliance matters, and provide counsel on information security best practices, including oversight of vendors and subcontractors, based on FTC guidance on information security enforcement proceedings under the “unfairness” prong of the FTC Act. We maintain relationships with FTC commissioners and staff, and we monitor and keep up to date with FTC developments through our legislative and public policy practice.

Counseling a large, franchised restaurant business on compliance with FTC privacy and security issues associated with the maturation of its information security program as well as operational and supply chain developments.

International, Federal, and State Privacy and Data Breach Notifications Laws. We provide regular advice to companies designing high-level data breach protocols on the development and implementation of systems to comply with the growing array of international, federal, and state privacy laws, as well as to provide them advice on dealing with breaches when they happen, including issues relating to disclosures to regulators, contracts officers, and law enforcement at the international, federal, and state levels and covering a wide range of both regulated and nonregulated businesses. We maintain a database of all the state data breach notification laws and abstracts of each of the laws.

Representing a global logistics and shipping company in the development, implementation, and testing of its global data privacy protocols.
Representing several major financial institutions in the development and testing of their data breach protocols, including in response to evolving South American privacy and security laws.
Representing a large, franchised restaurant business in the development and testing of its data breach protocols, including franchisee and vendor relationships.
Representing a global equipment rental company in connection with its customer and business partner data privacy and security obligations across the U.S., Canada, UK, and Europe.

State Data Security Laws. We are closely familiar with the data security laws and regulations that have come into force at the state level over the last several years and have advised a number of clients on developing compliance programs and strategies.

Representing a global cryptocurrency marketplace in complying with state data security obligations for state licensing applications.
Representing multiple financial services and payments technology companies that are subject to oversight from multiple regulators, including the New York Department of Financial Services, in developing and maintaining their security compliance programs and in responding to regulatory audits and interviews.

Contacts

Kimberly Kiefer Peretti

Partner

Washington, D.C.

Phone: +1 202 239 3720

Email: kimberly.peretti@alston.com

Kathleen Benway

Partner

Washington, D.C.

Phone: +1 202 239 3034

Email: kathleen.benway@alston.com