Overview
Carlton Fields brings together certified privacy professionals, former cybercrime prosecutors, litigators, and transactional lawyers to help clients protect information, respond to incidents, and put data to work responsibly. We translate complex requirements into actionable advice, with a focus on what matters most to each client's business.
Our attorneys advise at three phases: planning, preparation, and hardening against a cybersecurity event; serving as breach coaches during an event, including coordinating forensic services and working with law enforcement and regulators through consumer notification; and in the litigation, including class actions, that may follow. We provide rapid response support for malware, phishing campaigns, spoofing attempts, and misdirected wires, and we help victims of computer-based fraud trace and recover diverted assets. We also defend data breach and privacy class actions in federal and state courts, including matters under wiretapping statutes, the Video Privacy Protection Act, and the Illinois Biometric Information Privacy Act.
Privacy Programs
We help clients turn complex domestic and international privacy requirements into workable programs. Our advice spans data mapping, risk assessments, privacy policies and notices, data subject requests, artificial intelligence governance, biometrics, website tracking technologies, and agreements with third-party partners and data brokers. We focus on practical implementation: aligning legal obligations with how information is collected, used, shared, and protected.
Regulated Industries
We have particular depth of experience in highly regulated industries, such as insurance and health care, including advising on compliance with the Gramm-Leach-Bliley Act, state insurance laws, comprehensive state privacy laws such as the California Consumer Privacy Act, HIPAA, the GDPR, the Fair Credit Reporting Act, and the Telephone Consumer Protection Act.
One of only 25 firms in the nation named to Above the Law's Top Law Firm Privacy Practice Index, which identifies "the most active and relevant law firms in this complex and rapidly evolving practice area."
Experience
Privacy Compliance
Developed privacy policies, associated notices, and privacy request processing procedures for organizations across industries and regimes.
Drafted privacy notices and consents for businesses of all sizes and industries, including privacy policies, cookie banner language, and website and mobile application terms.
Advised multiple Fortune 500 companies on adapting their privacy programs to new state privacy laws.
Drafted and negotiated data processing agreements and vendor privacy and cybersecurity provisions.
Served as outside privacy counsel to businesses scaling their compliance programs from startup through IPO.
Data Breach Response
Managed data breach response for companies of all sizes, including forensic investigation, data mining, and required reporting to regulators, law enforcement, media, and consumers for breaches of personal information. Representative entities include insurers, producers, health care providers, retailers, telecommunications carriers, and businesses large and small.
Represented health care providers and insurance entities throughout post-breach regulatory inquiries and examinations.
Privacy and Cybersecurity Class Action Litigation
Represented various entities in responding to consumer allegations of privacy violations, including in relation to website technologies, such as cookies.
Advised a large, publicly traded financial institution regarding multiple data breach class actions.
Settled multiple data breach class action demands for no payment and without a single court filing.
Defended multiple health care providers in data breach class actions stemming from cybersecurity attacks.
Industry Spotlights
Insurance
Advised large life insurers and affiliated producers regarding privacy compliance throughout development of a fully electronic automated underwriting application, including negotiating contractual agreements with third-party service providers, developing procedures for operationalizing and demonstrating privacy compliance, and drafting privacy policies, procedures, notices, and authorizations.
Advised insurers on privacy and cybersecurity issues across the customer life cycle, including:
- Notices and consents for obtaining applicant and insured information from third parties and sharing information for transactional or marketing purposes.
- Privacy requirements for communications with applicants and insureds throughout the application process.
- Handling of consumer privacy requests, such as rights to know, correct, delete, or limit sharing.
- Cybersecurity obligations.
- Responding to, and preparing for, examinations regarding cybersecurity and privacy practices.
Health Care
Developed a comprehensive HIPAA compliance program, including supporting policies and procedures, for a covered entity.
Managed breach response for HIPAA covered entities and business associates, from investigation and required reporting and notifications through related litigation.
Counseled health care organizations on privacy practices, mobile application and website terms, and internal policies and procedures.
