IAPP Privacy Law Specialist

Good advice starts with facts. You run a privileged fact-finding exercise, build an inventory of data and flows with the client, and turn it into a list of the laws that apply and where the client falls short.

• Interviewing business and technical staff
• Data inventories and flow diagrams as legal work product
• Identifying applicable federal, state and foreign laws
• Gap analysis against the client’s practices
• Protecting privilege during a compliance review
• Writing a findings memo the client can act on

You build A privileged fact-finding plan and a gap analysis memo for one client.

Most advice is given before launch. You review a product for privacy risk, draft and test notices and consent flows, answer advertising and tracking questions, and settle differences with the product team.

• Privacy review in the product development process
• Drafting notices that match what systems do
• Consent, opt-outs and choice architecture
• Advertising technology, cookies and tracking
• Children, health and other sensitive-data features
• Documenting advice and its assumptions

You build A product privacy review memo with redlined notice language.

Contracts allocate privacy risk between companies. You draft and negotiate data processing agreements, vendor terms and data sharing arrangements, and handle the mechanisms for international transfers.

• Processor and service provider terms under state and foreign law
• Negotiating liability, indemnity and audit rights
• Data sharing and data sale arrangements
• Vendor due diligence questionnaires
• International transfer mechanisms in contracts
• Ending a relationship and returning data

You build A negotiated data processing agreement with a clause-by-clause issues list.

Privacy lawyers hold client secrets and often advise on security. You apply the duties of technological competence, confidentiality, conflicts and candor, and the limits of acting in business roles such as an outsourced privacy officer.

• Competence with technology and the duty to keep up
• Confidentiality and safeguarding client data in your own practice
• Conflicts when representing a company and its executives
• Candor to regulators and courts
• Advising on conduct that may be unlawful
• Acting as an outsourced privacy officer: roles and risks

You build An ethics analysis of three practice scenarios, with a recommended course for each.

A data breach is a legal event first. You direct a response so that forensic findings are protected, decide which notices are owed under which laws, coordinate with regulators and law enforcement, and manage communications.

• Engaging forensic experts under privilege
• Containing and documenting the incident
• Notification analysis across state, federal and foreign laws
• Notifying regulators, individuals and business partners
• Working with law enforcement and insurers
• Ransomware and extortion decisions
• Preserving evidence and litigation holds

You build A breach response plan and a notification analysis for a multi-state incident.

When a regulator calls, the first weeks shape the outcome. You respond to inquiries and civil investigative demands, negotiate with agencies, and understand how consent orders and settlements are shaped.

• FTC investigations and civil investigative demands
• State attorney general and other state inquiries
• HHS and other sector regulator investigations
• Responding to a regulator: scope, production and privilege
• Negotiating settlements and consent orders
• Living with a consent order

You build A regulator response plan and a draft reply to a formal information request.

Privacy claims reach courts through class actions and statutory damages. You assess standing and damages, the common claims, motion practice and discovery, and the path to settlement.

• Standing and harm in privacy cases
• Class actions after breaches
• Statutory claims: biometric, wiretap and video privacy laws
• Pleading and motion practice in privacy cases
• Discovery of data systems and personal data
• Settlements, notices and administration

You build A case assessment memo for a privacy class action, with a defense strategy.

Privacy touches every deal and every workforce. You carry out privacy diligence in mergers, advise on employee monitoring and screening, and handle government requests for data.

• Privacy due diligence in mergers and acquisitions
• Transferring data in a deal and integrating afterward
• Employee monitoring, screening and automated hiring tools
• Responding to law enforcement requests and subpoenas
• Third-party discovery and personal data
• Cross-border data in transactions

You build A privacy diligence checklist and report for an acquisition.

The law keeps moving, and the practitioner has to move with it. You advise on AI systems, biometrics, children’s privacy and the newest state laws, and build a method for assessing rules that are untested.

• Advising on AI use and training data
• Automated decision rules and bias claims
• Biometric and location data
• Children’s and teen privacy laws
• Tracking new state laws and rulemaking
• Reasoning about untested law

You build An advisory note on a new technology or law, written for a client’s general counsel.

One client carries the whole course. You advise on a product, negotiate its vendor terms, respond to its breach, and defend its regulator inquiry, keeping the privilege and ethics issues straight throughout.

• Opening the file and scoping the work
• Advising on the product and contract questions
• Directing the breach response
• Handling the regulator and the lawsuit
• Closing the file and recording lessons

You build A complete client file with advice, contract, incident and regulator documents.