Privacy & Data Protection

At Baird Holm, our Privacy and Data Protection attorneys assist our clients throughout the life cycles of their information. We help clients identify applicable laws to ensure statutory and regulatory compliance, evaluate the status of their data security, draft policies for the management and retention of sensitive information, assess privacy and security business partners, prepare for and respond to security incidents, defend against government investigations and private litigation, and enforce data protection obligations among internal personnel and external service providers.

Evaluate
Our attorneys understand and regularly counsel clients through risk assessment exercises. We enable clients to safely evaluate their security strengths and pressure points under the protection of attorney-client privilege. We discuss our clients’ data management practices and provide tailored legal insight to meet strenuous industry rules and regulations, from PCI DSS compliance advice to HIPAA coverage profiles. We are also at the forefront of crafting and reconfiguring increasingly common cloud service agreements that create complicated privacy issues requiring vigilant data protection schemes.

Prepare
Our attorneys help clients with their proactive steps to avoid data breaches. We guide clients through preparing and updating data breach response plans ready for compliance with changing laws and regulations across state and federal jurisdictions. We update and create policies and procedures for our clients that want to manage their data risks and prepare for security incidents of all scales.

Respond
Rapid response is crucial when there is a breach in privacy, data security, or the loss of sensitive information. Our rapid response team is available to assist clients in responding to such security or data breaches. Members of the team have experience in investigating potential breaches and engaging forensic experts under attorney-client privilege, when necessary. The rapid response team will assess the scope of the breach, determine controlling laws and regulations, advise regarding notification requirements and recommend strategies to reduce potential liability. We also assist clients in establishing in-house rapid response teams.

Defend
Government Investigations
Our attorneys work to handle any government inquiry that may arise from a security incident. We work through investigations to limit disruptions to our clients’ business operations and to eliminate or mitigate the chance of regulatory penalties. We have attorneys with experience responding to inquiries from the Federal Trade Commission, Department of Health and Human Services, financial services regulators, and state attorneys general.

Litigation
Security incidents can result in private litigation from affected individuals. Our attorneys have experience and knowledge in defending against private causes of action and class action litigation. We have handled litigation across the spectrum of data breach and privacy subject matters, from claims rooted in consumer protection laws to claims based on compliance with privacy policy statements.

Enforce
Data protection is not always about defense. Clients also need to enforce their chosen data security strategies and privacy rights. We are experienced in preparing and delivering cease-and-desist letters, as well as referrals to proper regulatory agencies. We understand and counsel our clients on the value of monitoring systems that warn them when suspicious or unusual activity is occurring. We also help clients document their privacy and security schemes meant to ward off and prevent phishers, spammers, scammers and other cybercriminals.

Our Privacy and Data Protection attorneys have been trusted with managing a diverse array of data privacy and security experiences. We have attorneys with deep expertise in privacy issues and breach of data security requirements for payment networks, consumer data breach notification obligations across all 50 states, and obligations under HIPAA for covered entities and business associates.

Our attorneys have handled data breaches ranging from very simple cases involving lost mobile devices to sophisticated data breaches caused by viruses, such as the Coreflood virus. We have represented insurance companies, financial institutions, health care providers, educational institutions, and businesses. We have represented clients from the moment breaches have been discovered through incident response, analyzing the extent of breaches, advising regarding responsibilities under applicable laws and regulations, and drafting notification letters to victims of the breach.

We have successfully defended our clients in complex litigation, class action lawsuits under FRCP Rule 23, and collective actions under FLSA Section 216(b).

We receive referrals and have access to invaluable legal resources as a member firm in Lex Mundi and the USLAW networks. Baird Holm has led the effort for USLAW to expand its network of law firms ready to respond to data breaches on a national and international basis.

• Banking and Financial Services
• E-Commerce
• Educational Institutions
• Employers and Human Resources
  • Employer-Sponsored Group Health Plans
  • Employee Benefits
• Exempt Organizations
• Franchise and Distribution
• Health Care
  • Hospitals
  • Physicians
  • Long-Term Care Facilities
  • Pharmacies
  • On-Site Medical Clinics
  • Community Health Records
  • HIEs
  • RHIOs
  • Hospital Associations
  • Accountable Care Organizations and Alliances
  • Business Associates
  • Wellness Providers
• Insurance
• Manufacturing
• Non-Bank Financial Service Providers
• Payment Card Providers
• Pharmaceuticals
• Public and Private Foundations
• Retail
• Software Developers and Service Providers
• State and Local Governmental Entities
• Technology
  • Mobile Devices
  • Security Consultants

• ADA Employee Health Care Information Confidentiality
• Breach Notification
• Breach of Confidentiality
• Breach of Contract
• Cloud Computing
• Class Action Lawsuits
• Compliance
• Computer Fraud and Abuse Litigation
• Computer Security
• Confidential Information Agreements
• Constitutional Privacy Issues
• COPPA
• Cybersecurity
• Data Breach Notification Laws (State and Federal)
• Data Breaches and Incident Response
• Data Brokers
• Data Protection
• Data Security
• Directors and Officers Liability
• E-Government Act
• Fair Credit Reporting Act
• Federal Privacy and Security Legislation
• FERPA
• Financial Privacy
• Hacking
• HIPAA/HITECH Compliance
• HIPAA and Related Common Law Claim Litigation
• Identity Theft
• Information Governance
• Information Security
• International/Cross-Boarders Privacy Law
• Invasion of Privacy
• Litigation
• Marketing
• Medical Privacy
• Mobile Privacy
• Online Data Tracking
• Online Privacy
• Payment Card Industry
• PCI/DSS
• Polygraph Protection Act
• Privacy
• Privacy Litigation
• Privacy Policy Development
• Regulatory Enforcement Actions
• Risk Assessments
• Securities Litigation
• Security Policy Development
• Social Media
• State Reference Check Laws
• Student Data Privacy
• Trade Secret Misappropriation Litigation
• Workforce Training
• Workplace Privacy

• IOT Cybersecurity is Now Law
• How Community Banks Could be Punished for Participating in the PPP
• A Closer Look AT THE CPRA – PART II: Establishment of a New Agency
• What a Biden Presidency Means for Fintech and Banking in the Short Term: Enforcement, Enforcement, Enforcement
• Data in the Cloud: Cyber-Security, Legal, and Financial Considerations
• A Closer Look at the CPRA’s Expansion of Individual Privacy Rights
• OFAC Warning – Beware of Helping Ransomware Victims Pay their Attackers
• CCPA Updates: Exemptions Signed into Law
• Privacy Law Update: What’s Happening at the Federal Level?
• After Months of Uncertainty Brazil’s Data Protection Law Takes Effect
• California Legislature Extends CCPA Exemptions
• OCC Fines Capital One and the Implications for Banks and Boards
• What’s the knock on TikTok? And why the spat with WeChat?
• California Bill Proposes to Strengthen Consumer Protections; Create CFPB Like State Agency
• Supreme Court Rules on Willfulness and the Lanham Act
• The CRPA: California’s Second Take on Privacy Rights
• Scotus Finds CFPB Unconstitutional; Director Removable by President at Will
• BEC Losses: Who’s Cheatin’ Who, Who’s Being True, and Who Will End Up Paying In End?
• Client Alert: Scotus Finds CFPB Unconstitutional; Director Removable by President at Will
• Recent Privacy Updates
• Privacy Issues in the Creation of Facial Recognition Technology
• Taking the branches out of branch banking – tips for banks looking to increase their digital footprint