Privacy, Security & Information Management

Documentation and validation that your policies are current, that employees are aware of them, and that internal enforcement occurs are important steps many companies take. We conduct security and privacy audits and assessments, including implementing incident response plans. In an effort to help further reduce your risk, we also counsel you regarding notice of security breach laws and coordinating incident responses should a breach occur.

HITECH amendments and the revised privacy and security rules have the health sector adjusting to new expectations and increased enforcement, all complicated by the rapid expansion of mobile technologies to facilitate access to patient data. The evolution of cloud computing, EHRs, and PHRs potentially enhances both patient outcomes and information risk. We counsel you on these issues, as well as the complexities of health record interoperability, genetic privacy, and compliance with state health privacy laws.

Cross-border privacy and security regulations require proactive planning for businesses, even more so as European regulators modify and tighten privacy rules and other countries increasingly adopt a European-style privacy regime. Our firsthand experience in the Americas, Europe, and Asia with Binding Corporate Rules (BCRs), Safe Harbor, and model contract structures can help you assess risks against resources to arrive at a practical mechanism for moving your data where you need it. Furthermore, our team has helped direct countries in Asia, Europe, the Middle East, and Africa to develop comprehensive privacy and security rules.

Myriad regulatory liabilities and increased governmental oversight requires effective compliance programs, particularly as companies roll out mobile payment platforms and novel means to analyze consumer financial data. We advise and represent companies like you regarding the Gramm-Leach-Bliley Act (GLB), the Fair Credit Reporting Act (FCRA), and the Fair and Accurate Credit Transactions Act of 2003 (FACT Act) and help you apply these existing rules to new technologies and strategies.

We advise and represent companies regarding privacy and data transfer issues in conjunction with domestic and international litigation as well as due diligence prior to mergers and acquisitions. This often includes advice regarding marketing and other joint venture agreements that implicate data transfer issues and security restrictions on marketing activity. Given potential litigation requirements, we also provide counsel on structuring defensible policies regarding your data destruction management and monitoring. We regularly conduct internal investigations regarding theft of trade secret and other proprietary information or data. We also advise on safeguards against and liability risks of identity theft.

We regularly help companies assess liability under the Computer Fraud and Abuse Act (CFAA) and state legislation related to misuse of networks, email issues, “scraping,” improper linking, and intellectual property and trade secret infringement. We also provide guidance regarding the Controlling the Assault of Non-Solicited Pornography and Marketing Act (CAN-SPAM), state spam laws, Do-Not-Fax and Do-Not-Call regulations, and the Children’s Online Privacy Protection Act (COPPA).

The use of social networks and mobile devices by your employees complicates what your company can control, whether it is an issue of comments about the company or other data on an employee’s mobile device. We can advise and represent you on compliance with the Electronic Communications Privacy Act (ECPA) and analogous state laws, including your monitoring and disclosure of customer, subscriber, and employee communications. We also provide counsel on pretexting liability and managing investigations to avoid liability, as well as online gaming issues, Internet-based privacy issues, and digital rights management and spyware issues.

Foley helps businesses meet the demands for a legally compliant records management and retention program. Our approach provides a reliable and defensible program designed to preserve confidentiality and avoid the expenses of physical document storage and potential penalties due to mishandling records. Our substantial experience allows us to provide practical and cost-effective tools, resources, and solutions, including records retention policies and retention and destruction schedules. The process we have developed results in high-quality, timely, and cost-effective solutions and results. We offer several different competitive fee arrangements, including a flat fee for the entire project, phased flat fees, fee collars or caps, incentive-based compensation, blended hourly rates, and traditional hourly rate billing.