Overview

We advise on all aspects of privacy and cybersecurity law, including undertaking comprehensive privacy and security assessments, building global compliance programs for businesses operating across multiple jurisdictions and industries, negotiating contracts concerning data and vendor relationships, and assessing and addressing the privacy and security risks in corporate transactions.

Our compliance and counseling team is composed of attorneys in the firm’s offices in Asia, Europe and the United States, allowing us to provide real-time global advice to clients in diverse business sectors, including financial services, asset management, technology, retail, consumer products, health care and life sciences, manufacturing, food and beverage, media, academic institutions, and energy.

In jurisdictions in which we do not have an office, we work seamlessly and efficiently with our network of data protection experts to address local laws, cultural nuances and geographical considerations. This network allows us to deliver efficient, cost-effective advice on every continent, streamlining multinational reviews and reducing administrative burdens. We drive positive privacy and security change across our clients’ platforms—wherever our clients do business.

Our capabilities encompass:

Privacy and Data Protection Advice: We provide day-to-day advice on how privacy and data protection laws affect business operations, new product and service deployment, and potential transactions.
Cybersecurity Compliance and Risk Mitigation: We advise clients on the law of cybersecurity and related requirements. We regularly work with the best cybersecurity consultants in the business to perform privileged vulnerability assessments, “red team” assignments, cyber-readiness exercises and to test hardware and software, including applications and systems, before or after deployment to identify and mitigate risks to corporate systems and information.
Service Provider Relationships: We negotiate contracts for, and on behalf of, service providers that process personal data or other client information, including software as a service providers and providers handling sophisticated technology transactions.
Online Advertising and Electronic Marketing: We advise clients on issues related to online advertising, data collection and processing, and electronic marketing.
Affiliate Marketing Rules: We counsel clients on their compliance obligations with regard to the sharing of nonpublic personal information among affiliated entities (including between parent and subsidiary companies; joint ventures; or private investment, mutual or private equity funds).
“Red Flag” Rules: We advise our clients on FTC regulations, commonly known as “red flag rules,” that require certain financial institutions to adopt identity theft prevention programs; we also provide written policies and develop training materials.
Payment Card Company-Related Issues: We counsel on the Payment Card Industry Data Security Standards (PCI DSS) and related card brand rules, help clients build PCI compliance programs, design e-commerce platforms to reduce legal risk, and negotiate PCI-related agreements.

Experience

Ropes & Gray’s privacy & cybersecurity advisory team has wide-ranging experience. Highlights include:

Performed a privacy, security and digital risk assessment for a consumer products company with operations in more than 100 countries, including assessments for compliance with the EU Data Protection Directive (as implemented nationally).
Advised major private equity businesses on global compliance strategy, including risk assessment of portfolio company liabilities under the EU General Data Protection Regulation (GDPR).
Rolled out a global privacy policy, terms of use and corresponding user dashboard for a popular suite of fitness apps using teams of local counsel spanning five continents.
Managed a global team of privacy and security experts providing advice to a U.S.-based technology company on privacy and security compliance relevant to planned expansion in Europe, the Middle East, Africa and Asia.
Developed a global privacy program for a food products company in more than 40 countries.

Developed a privacy and security strategy for integration of multiple mobile app platforms, addressing global issues of user consent, control and transparency, which included advising on the EU Directive on Privacy and Electronic Communications and the Telephone Consumer Protection Act
Addressed privacy and security aspects for a U.S. and EU rollout of a popular mobile application and provide continuing support through the rollout of additional versions, features and technologies, particularly as the company contemplates new data uses
Drafted and revised a website privacy statement for an intelligent media company to address data collection use and disclosure through multiple platforms, including the website, mobile and social media, and integrated the client’s existing international transfer policy, which included advising on the EU-U.S. Privacy Shield and other international data transfer mechanisms
Regularly conduct privileged, confidential investigations—focused on a multitude of national and state privacy and data breach notification laws—into cyberincidents, data misuse and trade secret misappropriation concerns for clients across the technology sector
Advised a number of asset managers on data flows in fund structures and compliance management under EU data protection laws as well as the Gramm-Leach-Bliley Act
Advised on the privacy and cybersecurity aspects of home automation systems, wearable devices, and geolocation tracking components, including privileged security assessments (testing of both hardware and software), security vulnerability remediation, and the implications of the GDPR, Children’s Online Privacy Protection Act, Fair and Accurate Credit Transactions Act and Fair Credit Reporting Act
Developed and successfully negotiated a Binding Corporate Rules application for a multinational health IT company