Privacy and Cybersecurity

Privacy and cybersecurity issues are particularly vital to the retail sector, as retailers face a myriad of potential problems in every customer transaction. Many established retail companies turn to Womble Bond Dickinson to guide them through this critical aspect of conducting business.

Our privacy and cybersecurity services cover a wide range of retail and consumer legal issues, including local, federal, and global privacy regulatory compliance, implementing privacy-related best practices, and privacy-related dispute resolution. We also counsel retail clients through cybersecurity issues, incident response and government investigations.

Representative Experience 

• Negotiated with card companies and regulators over fines to regional retailer for consumer data exposures.
• Advised Heartland Payment Systems in minimizing damage from the exposure of more than 100 million credit card data sets, working with state attorneys general, card companies and federal investigators.
• Updated online privacy policy and terms of use to reflect changes in US state laws for an e-commerce company.
• Advise one of the world's largest big box retailers, a national office supply retail chain, a national chain of shoe stores, and a women’s apparel boutique franchise chain, among others, in privacy and cybersecurity matters. 

Few areas of the law are as highly regulated as financial services. As part of our full-scale service to financial industry clients (ranging from community banks to some of the world’s largest financial institutions), we help guide these clients in their privacy and cybersecurity needs, including keeping personal customer data safe. Our clients include three of the top ten banks in the US.

FinTech is also an area of focus for Womble Bond Dickinson. These efforts are led by Ted Claypoole, who has more than 30 years of experience providing privacy and data security guidance to companies that operate at the intersection of financial services and technology.

Our specific privacy and data security services to banks and other financial services clients include:

• Communicating with regulators and other agency authorities on privacy compliance matters, data breach inquiries or other investigations.
• Preparing privacy and data security-related policies, practices and procedures for banks and other financial services clients.
• Helping financial services companies comply with GLBA and data reviews under the FFIEC IT Examination Handbook.
• Negotiating machine learning contracts from both the vendor and customer side, as well as providing AI development training.
• Negotiating FinTech partnerships on behalf of both financial institutions and FinTech providers. We help plan and build compliance regimes for data analytics of all types, including identified data, anonymized data and aggregated data.
• Counseling payment processors through data breach incidents (including one of the largest losses of credit card data in US history).
• Advising corporate boards and leadership teams of consumer financial services companies on cybersecurity and data privacy obligations and policies.

Representative Experience 

• Analyze and negotiate ATM network agreements for financial institutions and retailers.
• Plan strategy and negotiate vendor and customer agreements for payment units of large financial institutions.
• Represent merchant services organizations within banks.
• Negotiate electronic payment system agreements with technology companies on behalf of financial institutions.
• Perform purchaser diligence review on payments systems of acquisition target companies. 
• Work with lenders on data compliance and protection programs.

In addition to assisting with general privacy and data security, Womble Bond Dickinson’s Privacy and Cybersecurity team works closely with our Healthcare attorneys to guide hospitals, health systems, physicians and other providers through issues specific to the healthcare industry.

For example, our lawyers help our healthcare and life sciences industry clients develop best practices for HIPAA and HITECH Act compliance as well as state privacy and security law compliance. We also guide healthcare entities through related investigations and disputes regarding the alleged compromise of confidential patient, customer and employee data.

Our specific services to healthcare clients include:

• Leading privileged third-party HIPAA security assessments, risk analyses, and technical assessments (e.g., pen testing, vulnerability scanning);
• Supporting all aspects of HIPAA compliance program development and implementation, such as drafting or updating policies, procedures and forms; participating in table top exercises to test incident response plans; conducting internal gap assessments and risk assessments; and providing privacy and data security training for traditional and non-traditional healthcare entities;
• Conducting due diligence and advising on privacy and data security factors in mergers and acquisitions or the development, acquisition or deployment of new software applications, digital platforms or other health-tech innovation;
• Assisting with breach response and forensic investigation, analysis and data breach notification activities under state and federal laws;
• Communicating with the Office for Civil Rights and other federal or state authorities pertaining to governmental requests or inquiries; and
• Developing and supporting vendor management programs to address risk management and HIPAA and other data privacy and security laws.

We also assist clients with privacy and security considerations related to connected devices, artificial intelligence, and other innovative technologies throughout the healthcare sector.

Because manufacturing companies don’t typically handle customer data, some sector leaders may feel privacy and cybersecurity is not a critical concern for manufacturing. But perhaps because it is seen as a “soft target,” manufacturing actually is a leading target for cybercrime. 

In fact, IBM’s Cyber Security Index 2016 found that manufacturing ranked second only to healthcare in the number of data hacks. The ominously named Operation Ghoul is one example of a highly organized, multinational spear phishing campaign targeting industrial trade secrets and other valuable data. The rise of the Internet of Things (IoT) means the potential for future cyber incidents has increased exponentially for manufacturers.

Womble Bond Dickinson can help. We regularly work with manufacturing clients on protecting private data and defending against cyberattacks.

Representative Experience 

• Building a data security program for compliance in Europe, UK, Canada and the US for a public international manufacturer.
• Assist public manufacturing company with all aspects of a data privacy and security program including vendor management, state law rights request regime, data breach guidance, and data governance.
• Serving as breach counsel for major US manufacturer during and after ransomware attack.

We guide fast-moving tech industry clients in the rapidly evolving fields of information technology, privacy, cybersecurity and data protection. We regularly advise tech sector clients in:

• Data protection, including conducting privacy and security assessments, workplace policies and procedures and employee training.
• Procurement and licensing of IT enterprise systems and services.
• Privacy and data protection strategies in cloud-based solutions and software-as-a-service (“SaaS”) arrangements.
• eCommerce, online services and associated privacy-related regulatory compliance.
• Managing privacy risks in technology acquisition and partnering, including M&A, joint venture, and licensing transactions.
• Communications network cybersecurity compliance planning and support. This includes counseling communications providers on cybersecurity best practices and developing procedures for handling cyber incidents, breach recovery and response protocols that are designed to limit fall-out damages post-incident.
• FinTech industry privacy and data security issues (advising both tech providers and financial institutions).
• Insurtech privacy and data security concerns related to peer-to-peer networks, telematics, cyber insurance and other technology-related insurance products.
• Digital media issues.
• Artificial intelligence (AI) and biometrics-related privacy concerns.

Representative Experience 

• Examined cyber insurance options for an international manufacturer of information technology hardware and software, and helped select the best way to mitigate data security risk.