Data Privacy and Cybersecurity

This website uses cookies. For more information please contact us or consult our privacy policy.

Your binder contains too many pages, the maximum is 40.

We are unable to add this page to your binder, please try again later.

This page has been added to your binder.

PDF Binder
- Create PDF
- Add to Binder
Word Document Binder

Covington has an industry-leading data privacy and cybersecurity practice. Described by Chambers and Partners as an “accomplished group of privacy and data security practitioners” that “provides dynamic, practical, real-world advice,” we specialize in helping clients address complex, cutting-edge challenges to managing data privacy and cybersecurity risk. We regularly draw upon our cross-disciplinary expertise to provide efficient and effective counseling and representation. Our work ranges from assisting large, multinational clients in conducting privacy and security audits—to assess the ways in which they collect, handle, and protect their customers’ and employees’ personal information—to providing regulatory compliance advice in connection with specific business practices.

Our practice provides exceptional coverage of all of the substantive areas of privacy and data security, including IT/technology, data security, financial privacy, health privacy, employment privacy, litigation and transactions. Our client list contains a broad range of leading companies across numerous sectors, including consumer products, banking and financial services, health care, Internet services, pharmaceuticals, and telecommunications.

With global data privacy and cybersecurity attorneys based in Washington, New York, San Francisco, London, Brussels, and Beijing, our multi-lingual team has represented clients worldwide on a full range of legal, regulatory, and legislative matters involving privacy and cybersecurity issues.

View More View Less

Global privacy assessment

On behalf of one of the world’s leading consumer electronics and technology companies, we completed a comprehensive global privacy audit under the laws of the United States, the European Union, and China, including an assessment of the data collection, use, and sharing practices of numerous business units (including HR data), cross-border data transfers, and adopting a going-forward privacy governance and risk-management approach and corresponding policies and procedures.

Binding Corporate Rules for global pharmaceutical company

Assisting GSK plc in its adoption of Binding Corporate Rules (BCRs) in order to permit the company to transfer personal data globally. We helped develop GSK’s privacy compliance program, obtain the UK data protection authority’s approval and continue assisting GSK during the subsequent implementation.

Advice on the monitoring of employee communications

Conducted a pan-European and selective U.S. survey of laws and regulations affecting an employer’s right to monitor employee’s Internet use and review electronic communications. We have also advised numerous clients on the law governing call recording and access to (and disclosure of) employee e-mail, including in connection with several personal crises and actions.

Fair Credit Reporting Act (FCRA)

Advising several of the largest bank holding companies in the U.S. on compliance with the FCRA. Advising major consumer reporting agencies and trade associations on the requirement of the FCRA. Successfully representing numerous consumer reporting agencies and financial services providers in CFPB and FTC supervisory and enforcement actions relating to FCRA. Representing numerous firms in connection with the acquisition of FCRA-regulated businesses, including due diligence and preparation of merger and acquisition documents.

FTC Investigation Involving Microsoft's Passport Internet Authentication Service

Microsoft in the FTC’s groundbreaking investigation and agreement related to Microsoft’s Passport Internet authentication service, which was the FTC’s first consent agreement under Section 5 of the FTC Act to impose information security commitments related to the protection of personal information.

BBVA in Acquisition of Simple

Representation of Banco Bilbao Vizcaya Argentaria, an international financial group based in Spain, in its acquisition of financial technology company Simple. The $117 million acquisition is part of BBVA's strategy to lead the technology-driven change that is transforming the financial services industry. According to Francisco González, Chairman and CEO of BBVA, Simple will reinforce BBVA’s “global digital transformation while BBVA will provide the means to help Simple maximize its outstanding growth potential.”

HR operations audit for multinational pharmaceutical client

Conducted a detailed review of the human resources operations of a large pharmaceutical company to assess compliance with data protection and privacy laws and regulations in both the US and EU, in anticipation of possible certification under the US-EU Safe Harbor regime. Our extensive written report described potential compliance issues and recommended specific remedial actions.

Global Privacy Audit for Leading Consumer Electronics and Technology Companies

Privacy “health checks”

Conducted privacy “health checks” for clients to assess their compliance with privacy and data security laws, particularly those in the 28 Member States of the European Community; where appropriate, we have designed remediation programs that include, for example, filing notifications to local privacy regulators, fulfilling obligations to furnish notice, and ensuring compliance with local data security regulations.

Gramm-Leach-Bliley Act (GLBA) and State Financial Privacy Laws

We have advised the largest and most sophisticated banks, consumer reporting agencies, and financial services companies on the collection, use and disclosure of nonpublic personal information under GLBA, that California Financial Information Privacy Act, and similar laws, including the development and implementation of privacy notices.

Review of the right to monitor Internet and electronic communications

Conducted a pan-European and selective US survey of laws and regulations affecting an employer’s right to monitor employee’s Internet use and review electronic communications. We have also advised numerous clients on the law governing call recording and access to (and disclosure of) employee e-mail, including in connection with several personal crises and actions.

Confidential data leak

Provided guidance to a major technology and manufacturing company in connection with the unauthorized posting of employee personal information on a third-party webpage. Our efforts on behalf of the client included working with Internet service providers to remove the posted information and providing notice to potentially affected individuals and applicable state regulators.

CBS Corp. v. FCC.

Covington successfully represented CBS against a threat by the FCC to make hundreds of thousands of pages of highly confidential programming contracts and negotiation materials available to hundreds of third parties. The D.C. Circuit ruled in favor of CBS, stating the FCC’s decision was “both substantively and procedurally flawed.”

Cross-border trade, anti-corruption, and data compliance

Advising a major petrochemical company regarding its establishment of an integrated compliance program, with particular focus on the areas of U.S. and European trade controls, anti-corruption, and data privacy. Our representation includes assistance with establishing a corporate compliance office, assessing risks in these areas, drafting the necessary policies and procedures tailored to company risks and operations, and implementing the program through training and assessment.

Employee data breach support

Emerging policy issues

Worked directly with, and appeared before national and regional privacy authorities, such as the European Commission, the EU Article 29 Working Party, and the Council of Europe, both to address emerging policy issues in the data privacy field, such as data retention, radio frequency identification (RFID), Big Data, facial recognition, security breach legislation and biometrics, and to defend individual clients.

Pre-Incident Advice and Assessments

We regularly advise clients on compliance with information security requirements and best practices, including, among others, governance best practices, vendor contract terms and due diligence, the implementation of information security controls to satisfy regulatory requirements, and the conduct of vulnerability assessments.

Global compliance

Conducted a detailed review of the human resources operations of a large pharmaceutical company to assess compliance with data protection and privacy laws and regulations in both the U.S. and EU, in anticipation of possible certification under the U.S.-EU Safe Harbor regime. Our extensive written report described potential compliance issues and recommended specific remedial actions.

Huawei privacy class action

Defending Huawei, a Chinese mobile handset maker, in a putative class action alleging violations of the Wiretap Act, Stored Communications Act, and various state laws. The suit stems from the allegation that third-party mobile analytics software transmitted data about mobile device users’ activities to other parties without authorization.

Cybersecurity FCA Victory for a Services Contractor

Foreign government cyber hacking of a federal agency produced front page news and a U.S. Department of Justice (DOJ) False Claims Act (FCA) investigation of the service contractor that built and maintained the agency’s cyber security system. We rebutted allegations that critical cyber infrastructure was missing, out of date, and technically deficient. The DOJ dropped its investigation and the company made a small, five figure settlement with the agency.

Addressing Regulatory Enforcement Actions

We have addressed regulatory investigations and enforcement actions from regulators in the United States, Europe, and Asia following data breaches. These have included investigations or formal enforcement proceedings brought by the Federal Trade Commission, State Attorneys General, and the Securities and Exchange Commission in the United States, and by data protection authorities and sector-specific regulators across Europe and Asia.

Multi-defendant privacy class action

Achieved dismissal of a putative class action against Microsoft, CBS, Microsoft, McDonald’s, and Mazda alleging violations of the Wiretap Act, Computer Fraud and Abuse Act, and state laws. The complaint alleged that an online ad network used Flash cookies and other tracking mechanisms to build user profiles for the purpose of serving targeted advertising.

Microsoft privacy class action

Achieved summary judgment for Microsoft in a putative class action alleging unauthorized collection of geolocation information from the plaintiffs’ mobile devices. After a claim under the Wiretap Act was dismissed at the pleadings stage, we successfully obtained summary judgment on a remaining claim under the Stored Communications Act.

LinkedIn privacy class action

Achieved dismissal of a putative class action against LinkedIn alleging violations of the Stored Communications Act and state law. The complaint asserted that LinkedIn disclosed LinkedIn user identification numbers and LinkedIn URL addresses to third party advertising companies, which allowed those companies to correlate the identity of a user with his or her previously anonymous Web browsing history.

Privacy audit for oil and gas multinational in preparation for BCR approval

Managing a privacy audit of a U.S.-based multinational in the oil and gas industry in preparation for its BCR approval with the Dutch data protection authority as the lead authority, including reviewing and providing advice on the BCRs and the implementation strategy and assisting this client in the preparation and roll-out of various compliance tools in the framework of the BCRs.

Protection of employee personal information

Responding to Sophisticated Advanced Persistent Theat ("APT") Attacks

We have directed the investigations and response into APT attacks from state-sponsored actors and sophisticated criminal groups targeting intellectual property and other proprietary information. These attacks, and the responses, have spanned multiple industries and global companies, with investigations covering four continents.

Representing global pharmaceutical company in “test” case involving BCR and CBPR interoperability

Representing Merck in one of the first “test” cases involving interoperability between BCRs and APEC’s Cross-border Privacy Rules (CBPR). The case will establish a precedent for cross-border transfers of personal data for both the EU and Asia-Pacific Region.

Cable One privacy class action

Achieved dismissals of three putative class actions against Cable One, a cable and Internet service provider, in litigation involving claims under the Wiretap Act, the Computer Fraud and Abuse Act, and related state laws. The litigation arose out of a third party’s test of a system using “deep packet inspection” for the purpose of serving targeted advertisements.

AOL privacy class action

Achieved dismissal of a putative class action against AOL alleging violations of the Wiretap Act, Video Privacy Protection Act, and numerous state laws. The suit alleged unauthorized collection of personal information from the plaintiffs’ computers using “Flash cookies” and unlawful disclosure of video viewing information to third parties.

View More View Less

FTC Announces “Stick With Security” Initiative

The FTC announced today a new “Stick With Security” Initiative, building on its prior “Start With Security” guide as “part of its ongoing efforts to help businesses ensure that they are taking reasonable steps to protect and secure consumer data.” Stick With Security constitutes a series of blog posts published each Friday using “hypothetical examples...… ...

China Seeks Public Comments on Draft Regulation on the Protection of Critical Information Infrastructure

On July 11, 2017, the Cyberspace Administration of China (CAC) released the draft Regulation on the Protection of the Critical Information Infrastructure (“Draft Regulation”) for public comment (official Chinese version available here). The comment period ends on August 10, 2017. Aiming to add greater clarification to the Cybersecurity Law, which took effect on ...

New York DFS Publishes FAQs on New Cybersecurity Regulations

As our readers know, New York’s Department of Financial Services (“NY DFS”) released a draft of its new Cybersecurity Regulations on September 13, 2016, and the final version of the regulations went into effect on March 1, 2017 (23 NYCRR 500). Among other things, the regulations require regulated entities to conduct cyber risk assessments and...… Continue ...

China Seeks Public Comments on Draft Regulation on the Protection of Critical Information Infrastructure

On July 11, 2017, the Cyberspace Administration of China (CAC) released the draft Regulation for the Protection of the Critical Information Infrastructure (“Draft Regulation”) for public comment (official Chinese version available here). The comment period ends on August 10, 2017.

Reno at 20: The Packingham Decision and the Supreme Court on Online Speech

Twenty years ago, the Supreme Court was faced with the question of whether a federal statute that imposed a content-based restriction on online speech violated the First Amendment. That case, Reno v. American Civil Liberties Union, marked the first instance in which the Supreme Court weighed in on the role of the Internet in the...… Continue Reading

ICO Rules UK Hospital-DeepMind Trial Failed to Comply with UK Data Protection Law

The UK Information Commissioner’s Office (“ICO”), which enforces data protection legislation in the UK, has ruled that the NHS Royal Free Foundation Trust (“Royal Free”), which manages a London hospital, failed to comply with the UK Data Protection Act 1998 in providing 1.6 million patient records to Google DeepMind (“DeepMind”), requiring the Royal Free to...… ...

EU Article 29 Working Party Releases Extensive GDPR Guidance on Data Processing at Work

By Dan Cooper and Rosie Klement The EU’s Article 29 Working Party (“WP29”) has issued new guidance on data processing in the employment context (available here). Adopted on June 8, 2017, the guidance primarily takes account of the existing data protection framework under the EU Data Protection Directive (Directive 95/46/EC), but also considers the developments ...

Pentagon demands contractors up cybersecurity

Susan Cassidy is quoted in a San Antonio Express-News article regarding new cybersecurity requirements for contractors. According to Cassidy, "Essentially, the DOD wants its contractors to protect its information, because the DOD is a huge target, and its contractors are also a target." Commenting on the fact that over the years, contractors have been working ...

South Korea Joins the APEC Cross-Border Privacy Rules Framework

South Korea has became the fifth member economy to join the Asia-Pacific Economic Cooperation’s (“APEC”) Cross-Border Privacy Rules (“CBPR”) system, a voluntary but legally enforceable code of conduct that aims to facilitate secure data transfers and e-commerce between parties to the agreement. Established in 2011, the CBPR system aims to provide a minimum level ...

FTC and NHSTA Hold Workshop to Drive Discussion on Connected Cars

On June 28, 2017, The Federal Trade Commission and the National Highway Traffic Safety Administration (NHTSA) hosted a workshop to examine the consumer privacy and security issues that automated and connected motor vehicles pose. The workshop’s Public Notice, which solicited comments from stakeholders in advance of the event, highlighted the benefits that ...

FTC Adds Online Parental Consent Method to Privacy Guidance

Lindsey Tonsager is quoted in a Bloomberg Law article regarding the FTC's updated guidance that includes adding online-based questions as a method of obtaining parental consent under the Children's Online Privacy Protection Act. According to Tonsager, the new methods are a quick way for parents to give consent without having to mail in forms, and will largely ...

FTC Launches Review of Its Email Marketing Rule

Today the FTC announced that it is undertaking a review of its CAN-SPAM Rule, which sets out the requirements for sending commercial e-mail messages. Among other things, the CAN-SPAM Rule requires that senders of commercial e-mails provide recipients a mechanism to opt out of receiving commercial e-mails, honor opt-out requests within 10 business days, and ...

FTC Staff Publish COPPA Guidance for Businesses

The FTC staff published today a “Six-Step Compliance Plan” for businesses to comply with the Children’s Online Privacy Protection Act (COPPA). The guidance, which provides a useful framework for businesses, states explicitly that COPPA applies to connected toys and other devices that collect personal information from children over the Internet. The FTC’s 2013 ...

What To Watch As LabMD, FTC Square Off Over Data Security

Kurt Wimmer is quoted in a Law360 article regarding LabMD Inc. v. FTC , where the FTC will attempt to justify its data security enforcement authority. “The LabMD argument will provide an important window into how the new FTC will deal with the all-important question of 'harm' in the context of data security enforcement actions,” says Wimmer. “The argument ...

Oral Argument in LabMD Case to Test FTC’s Enforcement Authority

Kurt Wimmer is quoted in a Bloomberg BNA article regarding LabMD Inc. v. FTC , where the FTC will attempt to justify its data security enforcement authority. According to Wimmer, "[o]ral argument “presents an opportunity for the FTC to explain its current view of ‘harm,’ and how it should be applied in the LabMD case."

SEC steps up enforcement against escalating cybercrime

Jennifer Martin is quoted in a Global Investigations Review article discussing the SEC's response to the rising rates of cybercrime. “The cyber criminals go where the money is,” says Martin. “They’re constantly figuring out new ways to monetize information.” She adds that whether it’s extorting hospitals through ransomware or going after valuable healthcare ...

New cyber law in China stirs alarm

Yan Luo is quoted by The Hill in an article regarding some of the uncertainties surrounding China's new Cybersecurity Law. Under the new law, cross-border data transfers for operators of "critical information infrastructure" are subject to security reviews and restrictions. According to Luo, "We don’t really have a definition of critical information ...

Senators push for enhanced powers to battle botnets

Jennifer Martin is quoted by The Hill in an article regarding the increased focus by law enforcement on botnets and the threats they pose to national security. "One of the reasons botnets are growing in prevalence is the growth of the Internet of Things,” says Martin. “As more and more things are connected, you can expect more and more things to be compromised ...

Are You Ready for the European General Data Protection Regulation? A Practical Checklist for Employers

One year from today, on May 25, 2018, employers will have to comply with a new data protection law, commonly referred to as the General Data Protection Regulation (the “GDPR”). This alert provides a practical checklist of key considerations for employers and human resources professionals preparing for the new regime, ahead of its implementation next year.

China Releases Near-final Draft of Regulation on Cross-border Data Transfers

On May 19, 2017, the Cyberspace Administration of China (“CAC”) invited international stakeholders to attend a seminar to discuss an updated version of the Measures on Security Assessment of Cross-border Data Transfer of Personal Information and Important Data (“the Measures”). Given that the Measures have an intended effective date of June 1, 2017, it is likely that they are in final form and the framework established by the Measures will govern China’s cross border data transfers going forward. This alert summarizes the key changes from the previous version.

Manage Ransomware Risks Now

Last Friday may mark the start of a new era in cyber crime. The first worldwide ransomware attack, commonly dubbed “WannaCry,” emerged on May 12. The malware is believed to have infected more than 300,000 computers in 150 countries to date. A cyber criminal or ring of criminals, taking advantage of an exploit made available by the ShadowBrokers hacker group that reportedly uses tools stolen from the U.S. National Security Agency, propagated an attack that installs malware to encrypt users’ data unless a ransom in Bitcoin is paid within a few days. While the actual ransom payment losses have reportedly been minimal, the more serious result of these attacks has been the disruption to victims’ business activities.

Covington & Burling’s Emily Johnson Henn | Women of Influence 2017

Emily Henn was profiled by Silicon Valley Business Journal as a part of the publication's "Women of Influence" feature, honoring 100 of the most influential business women in Silicon Valley.

China Releases Draft Encryption Law for Public Comment

On April 13, 2017, China’s State Cryptography Administration (“SCA”) published a draft Encryption Law (“the draft Law”) for public comment.

After several years of drafting, the draft Law, if enacted as drafted, would be the first Chinese statute to systematically address encryption, covering “the research, production, management, import and export, testing, authentication, use, and regulation of encryption.” China has long regulated the import, export, sale, use, and scientific research of “commercial” encryption. The draft Law, however, provides rules for three categories of encryption—“ordinary” encryption, “core” encryption, and “commercial” encryption—with a view to establishing a uniform regulatory framework that would govern all types of encryption and providing SCA with greater enforcement authority.

China Releases Final Regulation on Cybersecurity Review of Network Products and Services

On May 2, 2017, the Cyberspace Administration of China (“CAC”) released the final version of the Measures on the Security Review of Network Products and Services (Trial) (“the Measures”), with an effective date of June 1, 2017 (official Chinese version available here). The issuance of the Measures marks a critical first step toward implementing China’s Cybersecurity Law (“the Law”), which was promulgated on November 7, 2016 and will take effect on June 1, 2017 (the same date as the Measures).

FCC Chairman Releases Draft of New Net Neutrality Plan; Vote Scheduled for May 18

In a widely anticipated step, FCC Chairman Ajit Pai has released the text of a draft Notice of Proposed Rulemaking (“NPRM”) proposing to change the legal framework that governs broadband providers, eliminate the “Internet conduct standard” for evaluating broadband provider practices on a case-by-case basis, and seek comment on whether to keep, modify, or eliminate other open Internet (also known as net neutrality) rules previously adopted by the FCC. Chairman Pai has circulated the draft NPRM to his fellow Commissioners for a vote at the Commission’s next monthly meeting, scheduled for May 18.

CNN Video Data Win Leaves Spokeo Door Open For App Users

Kurt Wimmer is quoted in a Law360 article regarding the Eleventh Circuit's decision to reject a proposed class action brought by a CNN app user claiming that CNN violated the Video Privacy Protection Act. According to Wimmer, "Unlike the Yershov court, the CNN panel seems to understand how apps actually work, which will be helpful going forward."

Emily Henn Named One of Silicon Valley’s Most Influential Women

SILICON VALLEY—Silicon Valley Business Journal has named Covington partner Emily Henn to its annual “Women of Influence” list, honoring “100 of the most influential business women in Silicon Valley.” Ms. Henn serves as co-chair of the firm’s Class Action Litigation Practice, specializing in defending antitrust, consumer, and other types of class actions. Ms. ...

9th Circ. Ruling Generates Copyright Preemption Confusion

Earlier this month, in Maloney v. T3Media Inc.,[1] the Ninth Circuit held that former college athletes could not assert a right of publicity to prevent the NCAA and its licensee, T3Media, from distributing images of the players. The court ruled that the players’ right of publicity was preempted by Section 301 of the Copyright Act because photographs of the college athletes were within the “subject matter” of copyright. While the outcome of the case may be justifiable on the facts, the decision raises more questions than it answers, further muddying the already difficult terrain of copyright preemption under Section 301.

China Seeks Public Comments on Draft Regulation of Cross-Border Data Transfer

On April 11, 2017, the Cyberspace Administration of China (“CAC”) released a draft of the Measures on Security Assessment of Cross-border Data Transfer of Personal Information and Important Data (“the Draft Measures”) for public comment (official Chinese version available here; Covington’s translation of the Draft Measures is appended at the end of this alert).

A look at China’s sweeping new cyber-security law

Compliance Week references a Covington client alert on China’s draft regulation on cybersecurity review of network products and services. According to the alert, “As the draft measures come into force in the coming months, such companies will need to carefully assess the implications of the draft measures, including whether to voluntarily seek security reviews ...

Too much information on chat can leave employers in legal lurch

Lindsay Burke is quoted in a Business Insurance article regarding the risks associated with internal office chat applications. “People think of it as a casual form of communication,” Burke says, “and they forget that it’s business and usually the company is keeping a record of the communication. And if the company finds itself in litigation, then the discovery ...

Forensic Firms: Understanding and Leveraging Their Expertise From the Start (Part One of Three)

Steve Surdu was interviewed by The Cybersecurity Law Report for a three-part series on the role of forensic firms during a cyber breach. Part one discusses how to understand and leverage the expertise of forensic firms from the start. According to Surdu, forensic consultants have specialized skills and knowledge “that are very difficult for most organizations to ...

China Seeks Public Comments on Draft Regulation on Cybersecurity Review of Network Products and Services

On February 4, 2017, the Cyberspace Administration of China (“CAC”) released the draft Measures on the Security Review of Network Products and Services (“the draft Measures”) for public comment (official Chinese version available here; Covington’s translation of the draft Measures is here). The comment period ends on March 4, 2017.

KWM London's former head of fraud and investigations joins Covington

Ian Hargreaves and David Lorello are quoted in a Global Investigations Review article regarding Hargreaves’ recent arrival to Covington. According to Hargreaves, the firm’s “pre-eminence in dispute resolution, and its immense strength and global recognition as a market-leader in white-collar crime matters and investigations” fueled his decision. Lorello says, ...

Senior FCC Official Rejoins Covington

WASHINGTON—Matthew S. DelNero has rejoined Covington as a partner in its Communications and Media Practice Group in Washington. Mr. DelNero most recently served as Chief of the Federal Communications Commission’s Wireline Competition Bureau. Mr. DelNero was a Covington partner from 2011 until January 2014, when he became Deputy Chief of the Wireline Competition ...

DelNero Returns to Covington

Matt DelNero is quoted in a Broadcasting & Cable article regarding his return to Covington’s Communications and Media practice. According to DelNero, “I look forward to handling a diverse array of issues for clients in the content, telecommunications, and technology sectors and to helping develop the firm’s Media & Communications practice into the future.”

Former Senior Official At FCC Rejoins Covington

Matt DelNero and Yaron Dori are quoted in a Law360 article regarding DelNero’s return to Covington as a partner in its Communications and Media Practice Group where he will oversee a diverse portfolio of telecom issues, including broadband expansion, privacy, data security and merger activity, bringing to the practice a new appreciation for the policy process ...

White Collar and Fraud Specialist Joins Covington’s European Practice

LONDON—Ian Hargreaves has joined Covington as a partner in the firm’s European Dispute Resolution practice resident in London. Mr. Hargreaves’ arrival follows that of litigation partners Craig Pollack, Greg Lascelles, Elaine Whiteford, and Louise Freeman over the past six months. Mr. Hargreaves advises on major European white collar and related civil and ...

Banks Face Cybercrime Wave As Tougher Regulations Loom

Mark Young, Jennifer Martin, and Ian Hargreaves are quoted in a Law360 article regarding the high level of cyberattacks on the financial services industry and the resulting regulatory pressures. According to Young, “The GDPR [General Data Protection Regulation] is a massive text with groundbreaking change in the data privacy area, in terms of compliance ...

Fate of DOD Cybersecurity Improvements Unclear, Lawyers Say

Susan Cassidy is quoted in a Federal Contracts Report article regarding the fate of cybersecurity improvements made by the DoD under President Trump. According to Cassidy, “I would expect those to continue forward because I don't see a political will to say, ‘No you shouldn't protect this.’” The nomination of former Sen. Dan Coats (R-Ind.) to serve as director ...

New York Overhauls Cybersecurity Proposals After Backlash

Jennifer Martin is quoted in a PaymentsCompliance article regarding revisions to “first-in-nation” cybersecurity rules made by New York financial regulators following industry backlash. According to Martin, third-party service due diligence requirements had been clarified to “narrow and more clearly describe the regulation’s applicability to vendors.”

U.S. Expands Sanctions, Takes Other Steps in Response to Russia’s Election-Related Cyber Operations

President Obama announced several actions on December 29 to respond to Russian cyber operations that the U.S. intelligence community previously had concluded were intended to influence the U.S. presidential election. Specifically, the President revised and expanded an earlier executive order that blocks the property and interests in property of persons that engage in significant malicious cyber-enabled activities, and designated 5 Russian entities and 6 Russian individuals for sanctions pursuant to the revised and expanded order. The President also released a report by the U.S. Department of Homeland Security (“DHS”) and Federal Bureau of Investigation (“FBI”) containing declassified information attributing cyber attacks to Russia, expelled 35 Russian diplomats, and barred Russian access to two compounds in the United States. Additionally, today, the U.S. Commerce Department added the five designated Russian entities involved in Russia’s election-related cyber operations to the Entity List, which prohibits the export, reexport, or transfer of any item subject to the U.S. Export Administration Regulations (“EAR”) to the listed entities, absent Commerce Department licensing. Although these actions are politically significant, they do not expand the U.S. sectoral sanctions against Russia and should have a limited near-term economic effect.

The Rocky Road Ahead for the CFPB in 2017

Ethan Levisohn is quoted in American Banker regarding the potential restructuring of the Consumer Financial Protection Bureau under President-elect Trump and the new Congress. Ethan comments on the PHH Corp. v. CFPB case, which in October found that the CFPB’s single-director structure is unconstitutional. According to Levisohn, PHH may have clipped the bureau's ...

Workplace Health Schemes Endorses The Use Of Wearable Technology

Daniel Cooper is quoted by CCT News in an article regarding the use of wearable technology in the workplace. According to Cooper, the use of wearable devices is a good way, especially for insurers. However, the wearers’ privacy must be taken care of as well as their legitimate treatment concerns.

Cyber-Physical Risks: Are You Covered?

Recent reports from both government and private groups have highlighted the risk that cyber hacking may now cause serious physical injury or damage. This new risk stems from connected industrial controls or electronic devices comprising the Internet of Things (IoT)—the network of over 50 billion objects ranging from children’s toys to home appliances to medical devices to critical infrastructure components. With such physical risk comes potential liability for those who make or use these networked products.

But does insurance cover this novel liability risk? This alert discusses potential coverage issues for claims alleging physical harm from cybersecurity failures. It also offers practical tips to address these emerging risks and the insurance issues surrounding them.

New NIST and DHS IoT Guidance Signal Regulatory Growth

Jennifer Martin is quoted in a Cybersecurity Law Report article regarding Internet of Things guidance from regulatory agencies such as the National Institute of Standards and Technology and the Department of Homeland Security. To best implement the advice from these sources, Martin says companies need to (1) understand the basic building blocks and principles of ...

Wearable technology: gathering data from tooth to toe

Daniel Cooper is quoted in a Financial Times article regarding wearable technology in the workplace. According to Cooper, not everyone will welcome sharing intimate personal information with the boss, however. “Wearable devices could be a good way for insurers to get the data . . . but it’s essential to address wearers’ privacy and fair treatment concerns and ...

China Passes New Cybersecurity Law

On November 7, the Standing Committee of China’s National People’s Congress (“NPC”) passed China’s first Cybersecurity Law (the “Law”), which will take effect starting June 1, 2017.

Described as China’s “fundamental law” in the area of cybersecurity, the new Law articulates the government’s priorities with respect to “cyberspace sovereignty,” consolidates existing network security-related requirements (covering both cyber and physical aspects of networks), and grants government agencies greater power to regulate cyber activities. It is the first Chinese law that systematically lays out the regulatory requirements on cybersecurity, subjecting many previously under-regulated or unregulated activities in cyberspace to government scrutiny. At the same time, it seeks to balance the dual goals of enhancing cybersecurity and developing China’s digital economy, which relies heavily on the free flow of data.

With its broad application, the new Law will have significant and long-lasting implications for companies operating in China or seeking to access the Chinese market. This alert highlights key features of the Law and explains these implications.

Jennifer Martin Named a "Cybersecurity & Data Privacy Trailblazer"

NEW YORK—The National Law Journal has named Covington’s Jennifer Martin as one of its “Cybersecurity & Data Privacy Trailblazers.” The list profiles 50 lawyers “who have helped make a difference in the fight against criminal cyberactivity and towards adding much needed layers of data security in an increasingly digital world of commerce.” Ms. Martin has worked ...

Federal Banking Agencies Request Comment on Enhanced Cybersecurity Standards

On October 19, 2016, the Board of Governors of the Federal Reserve System (Federal Reserve), Office of the Comptroller of the Currency (OCC), and Federal Deposit Insurance Corporation (FDIC) (collectively the “Agencies”) released a joint Advance Notice of Proposed Rulemaking (ANPR) requesting public comment on enhanced cybersecurity standards that would apply to certain large, interconnected financial entities (“covered entities”) as well as the third parties that provide services (“covered services”) to such entities.

DOD Updates Cyber Reporting Rule for Contractors

Susan Cassidy is quoted in a Federal Contracts Report article regarding the Defense Department’s updated cyber incident reporting rule. According to Cassidy, the rule succeeded in clarifying some industry concerns, but did not address them all. “They didn't take an opportunity to clarify everything you might have hoped they would.” For example, when asked ...

Managing Data Privacy Challenges in Performing Due Diligence and Internal Investigations in China (Part Two of Two)

Eric Carlson is quoted in an FCPA Report article regarding China’s data privacy and cybersecurity laws and how they apply to companies doing business in China. Commenting on performing due diligence while avoiding data privacy issues, Carlson says, “For due diligence purposes, it is still safe and appropriate to gather corporate information such as whether a ...

Covington Second Circuit Victory Named Most Important Case of the Year by GIR

WASHINGTON—Global Investigations Review has named the Microsoft warrant access case as the winner of the “Most Important Court Case of the Year.” Covington served as co-counsel to Microsoft and helped secure a landmark win in the U.S. Court of Appeals for the Second Circuit. GIR also ranked Covington among the top 15 investigations practices in the world in its ...

Aaron Lewis Among LA’s “Most Influential Minority Lawyers”

LOS ANGELES—The Los Angeles Business Journal has recognized Aaron Lewis as one of the “Most Influential Minority Lawyers” in Los Angeles. The inaugural list names 40 “stellar minority lawyers in the LA region,” highlighting recent success in their respective areas of practice. The Los Angeles Business Journal highlighted Mr. Lewis’s recent significant ...

Microsoft and the DOJ: A Conversation with Covington’s James Garland

James Garland participated in a Q&A with The American Lawyer regarding the firm’s relationship with Microsoft and its recent work on an important internet search case in the Second Circuit. According to Garland, “Microsoft has a very strategic approach toward its legal functions and litigation in particular. In cases like this that are of strategic policy ...

21st Century Cybersecurity: People are the first step

Jennifer Martin participated in the American Bar Association’s Annual Meeting and is quoted in an ABA Journal article regarding effective cybersecurity in today’s current threat environment. Martin discussed the importance of concentrating on developing an incident response program. “More and more companies have plans, but the devil is really in the details. She ...

Covington hires cyber expert

Stephen Surdu and James Garland are quoted in a GIR article regarding Surdu’s arrival to Covington as a Senior Cybersecurity Advisor. “In the fog of war, companies do not think clearly,” Surdu says. “They want to do the right thing, but they do not quite know what that is. As someone who has handled many cybersecurity investigations, I can help calm the ship.” ...

Second Circuit Limits Use of U.S. Warrants Seeking Data Stored Overseas

Search warrants served on U.S. Internet companies and cloud service providers cannot obtain customer data stored overseas, the U.S. Court of Appeals for the Second Circuit ruled on July 14. The federal appellate decision focuses on warrants issued under the federal Electronic Communications Privacy Act (“ECPA”) and formally applies only in the Second Circuit, but will be important precedent nationwide as courts, law enforcement, and industry grapple with the extraterritorial reach of U.S. legal process. The decision affects not only providers of cloud-based services that are subject to compulsory process under ECPA, but also individuals and companies that store data with U.S. technology companies. The decision, which the government may seek to appeal, could also spur congressional action addressing the extraterritorial reach of U.S. legal process and law enforcement’s access to data in cross-border investigations.

Covington Launches Cyber Response Team With Mandiant Pro

David Fagan and Stephen Surdu are quoted in a Law360 article regarding the launch of Covington’s new Cybersecurity Incident Response Team in conjunction with the arrival of Surdu and Jenny Martin. According to Fagan, “We’re a big firm with clients that span the globe. They can’t control when they have incidents, and you can get calls on a Friday afternoon from ...

Covington Forms Cybersecurity Incident Response Team

WASHINGTON—Covington has formed an enhanced team of lawyers and advisors to provide cybersecurity incident response services to clients, highlighted by Stephen Surdu, who formerly led the professional services group of Mandiant, joining the team as a Senior Cybersecurity Advisor. Through the formation of the Cybersecurity Incident Response Team with members on ...

Covington Bulks Up Cybersecurity Practice With Ex-Mandiant Consultant

James Garland and Steve Surdu are quoted in an American Lawyer article regarding the launch of Covington’s Cybersecurity Incident Response Team, highlighted by Surdu’s recent arrival as a Senior Cybersecurity Advisor. According to Garland, "The lawyers that do the interviews and oversee the forensic investigation, we're experienced but we're not engineers." He ...

Data-centric Security: Risks and Emerging Threats in Government

Michael Chertoff appeared on Federal News Radio for a panel discussion on the current cybersecurity environment and the evolution of data-centric security. “What’s different now is because of modern data analytics, the ability to take huge volumes of data at enormous scale and then to be able to analyze and make use of that data is something that’s brand new.”

Second Circuit Rules for Covington Client Microsoft in Important Internet Search Case

WASHINGTON—The U.S. Court of Appeals for the Second Circuit has ruled in favor of Covington’s client Microsoft Corporation in its challenge to a U.S. warrant seeking customer emails stored in Ireland. Microsoft argued that the warrant—issued under the Electronic Communications Privacy Act (ECPA)—could not be used to obtain emails stored abroad because it would ...

The EU-U.S. Privacy Shield: What’s New and What’s Next?

At a joint press conference on July 12, 2016 in Brussels, EU Commissioner for Justice, Consumers and Gender Equality, Věra Jourová and the U.S. Secretary of Commerce, Penny Pritzker, presented the Privacy Shield (see Press Release here, Adequacy Decision text here, Annexes here, Communication here, and Q&A factsheet here). The press conference followed the approval of the underlying adequacy decision by the College of EU Commissioners. This was the last step in the adoption of the Privacy Shield in the EU.

China Release Second Draft Of Cybersecurity Law

On July 5, 2016, China’s National People’s Congress (“NPC”) released a new draft of the Cybersecurity Law for public comment (official Chinese version available here; unofficial translation from AmCham China available here). The revised draft contains a number of significant changes from the first draft, which was released in July 2015, but retains many of the provisions from the first draft that raised concerns among multinational companies, especially those in the tech sector, about the potential to serve as a tool for discriminating against foreign technologies in favor of domestic industry.

Cyber Crime in Brazil: Preparing for the Rio Olympics

The Brazilian financial industry has long been a target of cyber criminals, and with the continued growth of sophisticated online banking services in Brazil, such systems are a prime target for organized crime. In addition, among the emerging BRICS countries (Brazil, Russia, India, China, and South Africa), Brazil is on a par with China and Russia in terms of internet usage by the population; of particular note is the widespread use of social media and mobile devices. Given this ubiquitous connectedness, users and companies are regularly targeted by online attackers, primarily for financial gain, but also increasingly to commit cyber espionage and hacktivist disruptions.

Federal Aviation Administration Finalizes Small Unmanned Aircraft Rule

On Tuesday, June 21, 2016, the Federal Aviation Administration (“FAA”) finalized its long-awaited rule on the commercial use of small unmanned aircraft systems (“UAS” or “drones”). The rule is significant because it provides a comprehensive and generally applicable set of rules for anyone wishing to operate a small drone for commercial purposes.

Covington Represents Tencent in $8.6 Billion Acquisition

SILICON VALLEY—Covington advised Tencent Holdings Limited, a leading provider of internet service in China, in connection with its acquisition of a majority stake in Supercell from SoftBank. A consortium established by Tencent will acquire up to 84% of Supercell for $8.6 billion in a transaction valuing Supercell at approximately $10.2 billion. Supercell is a ...

Alexander Berengaut Named One of Washington's Top Lawyers Under 40

WASHINGTON—Legal Bisnow has named Covington partner Alexander Berengaut to its 2016 “Top 40 Lawyers Under 40” list. Mr. Berengaut focuses on international arbitration, civil litigation, and government enforcement proceedings. He has experience handling a range of arbitral proceedings and U.S. court litigation matters, including at trial, and has significant ...

Lawyers highlight limited scope of liability protections under cyber info-sharing law

Susan Cassidy participated in a panel discussion at the annual cybersecurity conference at Georgetown University Law Center and is quoted in this Inside Cybersecurity article regarding the limited scope of liability protections under the new cyber info-sharing law. According to Cassidy, "Anything you create could be used in litigation against you," in referring ...

International: PCI DSS 3.2 'indicative of data security priorities'

Michael Nonaka is quoted in this Data Guidance article regarding the Payment Card Industry Security Standards Council’s latest version of its data security standard. According to Nonaka, "PCI DSS version 3.2 does not reflect sweeping changes to the requirements in prior versions, but it is indicative of the data security priorities being expressed by card ...

Jennifer Martin Joins Covington's Cybersecurity Practice

NEW YORK — Jennifer Martin has joined Covington’s Data Privacy and Cybersecurity practice. She most recently served as the Director of Cyber Incident Response & Investigations at Symantec. “Jennifer has worked at the intersection of law and cybersecurity from almost every vantage point over the past 15 years,” said David Fagan, who leads Covington’s cyber and ...

Covington Snags Cyber Investigations Pro From Symantec

Jennifer Martin and David Fagan are quoted in this Law360 article about her arrival to Covington. According to Martin, "Covington is one of a small handful of firms that has an established practice in deep cybersecurity and incident response, supplemented by well-established national security and privacy practices." She continues, "Covington provided me with the ...

Once again, the government finds a way to crack an iPhone without Apple’s help

James Garland is quoted in this Washington Post article discussing whether the discovery of alternative ways to unlock iPhones without the help of Apple during investigations undermines the Justice Department’s case in seeking similar, future court orders. According to Garland, “[T]he fact that they subsequently figured out how to do it — without Apple’s help — ...

Commerce Department Seeks Comments on Internet of Things Policy Issues

On April 6, the National Telecommunications and Information Administration (NTIA), part of the U.S. Department of Commerce, issued a Request for Comment (RFC) seeking public feedback on the benefits, challenges, and potential roles for the government in fostering the advancement of the Internet of Things (IoT).

NTIA issued the RFC as part of the Commerce Department’s Digital Economy Agenda, which, among other things, is meant to identify and address leading public policy and operational challenges in the Internet ecosystem. Noting that thus far no U.S. government agency has taken a holistic, ecosystem-wide view that identifies opportunities and addresses the risks of IoT across the digital economy, NTIA explained that it is seeking broad input from all interested stakeholders and will use that input to draft a “green paper” on key IoT issues. Comments are due on or before 5 p.m. Eastern Time May 23, 2016.

WHO makes legal and policy recommendations for eHealth

Philippe Bradley-Schmieg is quoted in this eHealth & Policy Law article regarding WHO’s report on key eHealth trends and progress across Europe. According to Bradley-Schmieg, “The call for ‘detailed’ EHR [electronic health record] laws is questionable. German and French EHR laws have simply added to already tough and complicated legal environments, with ...

Data Transfer Hurdles Have Companies Hedging Bets

Daniel Cooper is quoted in The Wall Street Journal’s “Morning Risk Report” discussing how companies should best comply with global data protection regulations. Commenting on the binding corporate rule process, Cooper said,“The one thing we know about binding corporate rules is [they tend] to have more appeal to European regulators.” He continues, “For a lot of ...

5 Ways To Keep Cybersecurity Risk From Derailing A Deal

Mark Young and Libbie Canter are quoted in this Law360 article offering tips on how deal makers can mitigate cybersecurity risks. According to Young, any discovered incidents can give buyers pause on how — and if — they want to move forward. “We’ve dealt with at least a couple examples where deals were at least delayed if not reconsidered because of ...

EU and US in race to rewrite data sharing agreement as deadline passes

Henriette Tielemans is quoted by The Guardian in an article discussing the missed Safe Harbor deadline. According to Tielemans, companies faced “enormous uncertainty” about what European regulators would deem adequate privacy protection.

Cyber security: uncertain companies lack defence plans

David Fagan is quoted by The Lawyer in an article discussing the continued vulnerability of companies to data breaches and targeted cyber attacks. Fagan, commenting on cyber-related litigation, states, “Up until now, in the US, there has been little cyber-related litigation because it is very difficult to quantify the level of damage done – I can imagine the ...

This is the first business to (legally) fly drones around Americans’ heads

Kurt Wimmer is quoted in this MarketWatch article regarding the FAA’s decision to allow Cape Productions, a drone video startup, to fly drones hundreds of feet closer to people than previously permitted. According to Wimmer, the FAA’s approval for Cape Productions sets a “much more realistic precedent” for future commercial drone usage.

EU Court Draws Fine Line for Employee Monitoring Programs

Henriette Tielemans is quoted in a Law360 article discussing the recent European Court of Human Rights’ decision allowing employers in the EU to monitor their employees’ online activities for business purposes. “This decision is important,” according to Tielemans. “It will bring much needed legal certainty in an area that many companies are struggling with.”

FTC Warns Against Cyber Discrimination In 'Big Data' Report

Andrew Smith is quoted in this Law360 article discussing the FTC’s report that signals the commission’s intention to enforce discrimination laws related to “big data” usage. According to Smith, “Companies that are doing the right thing and have been cognizant of the FCRA and ECOA shouldn’t have any additional liability, but companies that are unaware of their ...

Leading Financial Services Lawyer Joins Covington

WASHINGTON, DC, January 5, 2016 - Covington announced that Eric Mogilnicki has joined the firm as a partner in its Washington office and will co-chair the firm’s new Consumer Financial Services practice. Andrew Smith, who served as a senior financial services lawyer at the Federal Trade Commission prior to joining the firm, will also lead the newly formed ...

Leading Practitioner Joins Covington’s Insurance Recovery Practice

WASHINGTON, DC, January 5, 2016 - Covington announced that Matthew Schlesinger has joined the firm as a partner in its insurance recovery practice. “Matt has a strong track record of success in the insurance recovery field, in particular on behalf of policyholders in the financial services sector,” said Mitchell Dolin, co-chair of the firm’s global coverage ...

David Fagan Named a “Cybersecurity & Data Privacy Trailblazer”

WASHINGTON, DC, December 14, 2015 - The National Law Journal has named Covington partner David Fagan as one of its “Cybersecurity & Data Privacy Trailblazers.” The list profiles 50 lawyers “who have helped make a difference in the fight against criminal cyber activity and towards adding much needed layers of data security in an increasingly digital world of ...

EU Cybersecurity Rules Increase Liability For Multinationals

Mark Young is quoted in a Law360 article discussing the EU Network and Information Security Directive, which sets a cybersecurity and breach reporting baseline for both critical infrastructure operators, as well as digital service providers. This directive, which is the first of its kind, comes after two years of negotiations. According to Young, “There’s going ...

'Hypocritical' Europe is just as bad as the USA for data protection

Dan Cooper is quoted by The Register in an article discussing the uncertainty and complications continuing to surround the Schrems decision that derailed Safe Harbour. Cooper stated that his business clients were both “surprise[d] and shock[ed]” by the European Court’s decision. “Businesses felt like the rug had been pulled out from under them,” said Cooper. ...

Federal Courts Offer a Modern Interpretation of the VHS-Era Video Privacy Protection Act

Simon Frankel is quoted by the Cybersecurity Law Report discussing the modern interpretation of the Video Privacy Protection Act, which was first applicable to video cassette rentals in 1988. Even though it was updated in 2012, Frankel points out, “That’s sort of the broader trend – courts are really struggling with how the statute, not written for this [online] ...

Covington Tackles Vendor Cybersecurity Risks in New Book for Corporate Directors and Officers

WASHINGTON, DC, October 13, 2015 - Covington addresses the critical issue of how to manage risks associated with third-party outsourcing in Navigating the Digital Age: The Definitive Cybersecurity Guide for Directors and Officers. Published in collaboration with Palo Alto Networks and the New York Stock Exchange, the book provides boards, executives and ...

E.U. Court Declares Data-Transfer Pact With U.S. Invalid

Henriette Tielemans is quoted in this BNA article that explores the idea of finding alternative means for the transfer of data with the elimination of Safe Harbor. Countries that require national data protection authority approval may find even more issues arise when trying to formulate new ways to navigate data transfer laws. Tielemans notes that the process ...

Europe’s Top Court Just Gave U.S. Tech Firms a Huge Headache

Brussels-based partner Henriette Tielemans is quoted in this Fortune article that discusses the effects of the highest E.U. court eliminating the U.S.-E.U. data transfer agreement known as the Safe Harbor Act. “Hindsight is a beautiful thing,” said Tielemans. “We must all remember that in 2015 things are different than they were in 2000.”

Covington Advises Tencent on Investment in Kik

SAN FRANCISCO, August 20, 2015 — Covington advised Tencent Holdings Ltd. on its US$50 million investment in Ontario-based Kik Interactive, Inc., a messenger application with more than 200 million registered users. Tencent is a Chinese company that provides value-added Internet, mobile and telecom services and online advertising. Its messaging app WeChat has ...

Daniel Shallman Named to LA Business Journal’s Most Influential List

WASHINGTON, DC, August 11, 2015 —The Los Angeles Business Journal has named Covington partner and former federal prosecutor Daniel Shallman to its list of the city’s “Most Influential Lawyers” in the white collar and cyber practice areas. In selecting Mr. Shallman, the publication noted that he has handled “a string of impressive matters” since joining the firm ...

Mark Plotkin Named a Regulatory & Compliance Trailblazer

WASHINGTON, DC, June 24, 2015 — Covington partner Mark E. Plotkin has been named to The National Law Journal’s list of 45 Regulatory and Compliance Trailblazers. The list recognizes lawyers who have “made a difference navigating the ever-changing mandates of regulatory and compliance.” Mr. Plotkin, co-chair of Covington’s national security and defense industry ...

Wearables at work: the new frontier of employee surveillance

Covington's Daniel Cooper is quoted regarding the legal implications of wearables in the workplace: “Historically European regulators in the data protection area have been very sceptical you can ever get a valid employee consent — they feel that for existing employees, [the relationship] is almost inherently coercive.”

Designing and Implementing a Three-Step Cybersecurity Framework for Assessing and Vetting Third Parties

Covington's David Fagan is quoted regarding cybersecurity: "Companies 'should have a process in place to categorize vendors in terms of levels of risk and then they should apply assessment from that basis,' Fagan said. The first step should be to 'assign a risk classification to them. And that should track to what kind of assessment you provide.'"

Insider threats to cybersecurity — An HR legal perspective

Richard Shea, Lindsay Burke and Ashden Fein have authored this article on cybersecurity threats: "Cybersecurity threats can emanate not just from outside sources but from company insiders as well — including employees, executives, directors and contractors. According to NetDiligence’s 2014 Cyber Insurance Claims Study, roughly one-third of the reported events ...

Covington’s Jeff Kosseff Co-Authors “Law for Media Startups”

WASHINGTON, DC, March 11, 2015 — Covington’s Jeff Kosseff has co-authored “Law for Media Startups,” a 12-chapter web guide for entrepreneurs launching media ventures and educators teaching students how to do it. The guide, co-authored by J-Lab Executive Director Jan Schaffer, was published by City University of New York’s Tow-Knight Center for Entrepreneurial ...

K Street jockeys for cyber supremacy

David Fagan is quoted in this article regarding cybersecurity: David Fagan, a partner with Covington & Burling, said clients’ needs have evolved over the past five years when it comes to cybersecurity. “[The] Target and Sony [hacks] captured the minds and also the fears of a lot of boards of directors and executives,” Fagan said. “As a result, in-house ...

5 cybersecurity questions in-house counsel should consider in light of the Sony breach

Covington's David Fagan, James Garland and Kurt Wimmer have authored this article on questions that in-house counsel should be able to answer about his or her organization’s legal and business cybersecurity risk profile: "In the wake of the much publicized North Korean cyber-attacks against Sony — as well as recent favorable rulings for the plaintiffs in class ...

Yelp CDA 230, Reviewer Anonymity Cases Were Top Social Media Rulings in 2014

Covington partner Simon Frankel is quoted in this article regarding the top social media rulings of 2014: "Section 230 of the CDA generally immunizes social media websites from liability for defamatory comments made by its users. This section provides that ‘‘[n]o provider or user of an interactive computer service shall be treated as the publisher or speaker of ...

Data From Our Wearables Is Now Courtroom Fodder

Covington partner Simon Frankel is quoted in this article regarding the use of emerging technologies, such as wearables, in the courtroom: The point being: If the data is there, it can be used to fight or bolster a case—and it can pop up unexpectedly. “When it comes to data, you should assume anything tracked is being kept forever unless you know that it’s ...

Government contractors increasingly eye insurance to transfer cyber risks

Covington's David Fagan and Marialuisa Gallozzi are quoted in this article regarding a symposium co-hosted by Covington & Burling and George Washington University's Cybersecurity Initiative titled "Cybersecurity for Government Contractors." "That is the bubble that we're sitting on at this moment," said Covington and Burling insurance attorney Marialuisa ...

Morning Cybersecurity

Michael Chertoff is quoted regarding a symposium co-hosted by Covington & Burling and George Washington University's Cybersecurity Initiative titled "Cybersecurity for Government Contractors." "Information sharing between the government and private sector shouldn’t just be about swapping threat signatures or intelligence, former DHS Secretary Michael Chertoff ...

Covington Wins TMT: Data Protection at Legal 500 UK Awards

London, October 9, 2014 - Covington & Burling has been selected as the winner in the Technology, Media and Telecoms category of Legal 500 UK Awards 2014, with a focus on Data Protection. Covington’s European technology, media and telecoms lawyers draw on the firm’s deep roots in the software, Internet, telecommunications and media industries and act as strategic ...

Defining privacy in the age of wearable cameras

Covington partner Kurt Wimmer is quoted in this article regarding the legal implications of wearable cameras: "The current laws on privacy take hidden cameras and other Glass-type devices into account,” says Wimmer, whose clients include Facebook, Microsoft, Samsung, CBS, Viacom, and the National Football League. “There have been tiny cameras for a long time, ...

FTC Ratches Privacy Enforcement, With No Slowdown In Sight

Covington partner Kurt Wimmer is quoted in this article regarding the Federal Trade Commission pursuing companies such as Snapchat Inc. and Fandango LLC over allegedly misleading privacy promises and lax data security. "To me, the FTC's work in the first half of 2014 has been more about security than privacy — both in advocating for its ability under Section 5 ...

Lead Report: Cybersecurity Plan Confusing, Should be Revamped, Attorneys Say

Covington partner Susan Cassidy was interviewed for Bloomberg BNA regarding the General Services Administration's draft plan to manage cybersecurity risks in the federal acquisition process. The article states: “When you read the actual proposal from GSA, it's hard to figure out what they are going to do,” Covington & Burling LLP Partner Susan Cassidy said. ...

Covington Advises BBVA in Acquisition of Simple

NEW YORK, February 20, 2014 — Covington & Burling represented Banco Bilbao Vizcaya Argentaria, an international financial group based in Spain, in its acquisition of financial technology company Simple. The acquisition is part of BBVA's strategy to lead the technology-driven change that is transforming the financial services industry. According to Francisco ...

Covington Helps Secure Approval for GlaxoSmithKline's BCRs

LONDON, 26 June, 2013 — The UK Information Commissioner's Office has authorised GlaxoSmithKline’s 'Binding Corporate Rules' (BCRs) – a set of internal policies and procedures used to protect personal data across GSK’s operations globally. The privacy and data security team at Covington & Burling was instrumental in the development, implementation and ...

House Intel Chair Joins Former Sec. Chertoff at Cybersecurity Law Program

WASHINGTON, DC, March 28, 2013 — Rep. Mike Rogers, chairman of the House Permanent Select Committee on Intelligence, and former Homeland Security Secretary Michael Chertoff addressed the complexity of cybersecurity threats at a program sponsored by Covington & Burling and The Chertoff Group. Mr. Chertoff is senior of counsel at Covington and chairman and founder ...

BTI Names Martin and Tielemans ‘Client Service All-Stars’

WASHINGTON, DC, February 26, 2013 — The BTI Consulting Group has named Covington & Burling partners David Martin and Henriette Tielemans to its 2013 “Client Service All-Stars” list. The BTI “Client Service All-Stars” were singled out by general counsel and direct reports at large and Fortune 1000 organizations in one-on-one interviews. Mr. Martin, based in ...

Covington Named ‘Privacy & Consumer Protection Practice Group of the Year’

WASHINGTON, DC, January 22, 2013 — For the second straight year, Law360 named Covington & Burling’s global privacy and data security practice as one of the top five “Privacy & Consumer Protection Practice Groups of the Year.” In a profile highlighting the firm’s privacy-related work, Law360 noted the group’s recent litigation win for LinkedIn Corp. In that case, ...

Covington Receives Top Tier Nods in Legal 500 US

WASHINGTON, DC, August 14, 2012 — Covington & Burling LLP has received a top tier ranking in six practice areas and 18 individual attorneys are named “Leading Lawyers” in the recently released Legal 500 US 2012 edition. Additionally, Legal 500 US also “recommended” 36 Covington practice areas and 123 Covington lawyers. The six Covington practices given the top ...

Chambers USA Recognizes 106 Lawyers and 46 Practices at Covington

WASHINGTON, DC, June 11, 2012 — Chambers USA recognized 106 individual Covington & Burling lawyers and 46 Covington practice areas in the 2012 Chambers USA: America’s Leading Lawyers for Business guidebook released on June 7, 2012. Many of the 106 Covington lawyers ranked by Chambers USA were recognized in multiple categories, resulting in a total of 131 ...

Covington Names Nash and Walter to Lead London Office

LONDON, 29 May, 2012 — Covington & Burling LLP is pleased to announce Louise Nash as the new London office managing partner. She succeeds Roger Enock, who steps down after five years in the role. The firm also announced that Christopher Walter will succeed Ms. Nash as the office deputy managing partner. Mr. Enock will continue as head of the firm’s London ...

Covington Receives 46 Lawyer, 20 Practice Accolades in Chambers Global

LONDON, 19 March, 2012 — Covington & Burling LLP received 46 individual mentions and 20 practice mentions in the Chambers Global 2012 edition. The guidebook, which ranks lawyers globally by pan-regional and country practice area, is designed to identify the most skilled legal practitioners based on the qualities most valued by clients. The Covington lawyers ...

Law360 Names Covington ‘Privacy & Consumer Protection Practice Group of the Year’

WASHINGTON, DC, January 9, 2012 — Law360 named Covington & Burling’s global privacy & data security practice as one of the top five “Privacy & Consumer Protection Practice Groups of the Year.” In a profile about the firm published on Jan. 5th, Law360 pointed to Covington’s broad practice in assisting clients in transactions, on advisory matters, in social ...

Chambers USA Recognizes Covington with 123 Individual, 45 Practice Nods

WASHINGTON, DC, June 10, 2011 — Covington & Burling LLP received 123 individual mentions and 45 practice mentions in Chambers USA 2011. The guidebook, which ranks lawyers by state and national practice area, is designed to identify the most skilled legal practitioners based on the qualities most valued by clients. Here are the Covington lawyers and practices ...

Covington Receives 92 Individual, 32 Practice Mentions in Legal 500

WASHINGTON, DC, June 10, 2011 — Covington & Burling LLP received 92 individual mentions and 32 practice mentions in the Legal 500 US 2011 edition. Legal 500 reviews the strengths and strategies of law firms in more than 90 countries in Europe, the Middle East, Asia, North and South America, and the Caribbean. Here are the Covington lawyers and practices ...

Covington Launches Strategic Risk and Crisis Management Group

WASHINGTON, DC, January 6, 2011 — Covington & Burling LLP announced today that it plans to establish a strategic risk and crisis management practice to assist national and international businesses and their managements and boards. Senior members of the group include former Homeland Security Secretary Michael Chertoff; Ambassador Stuart Eizenstat; former DC ...

Covington Receives 85 Individual, 23 Practice Mentions in Legal 500 US

WASHINGTON, DC, June 23, 2010 — Covington & Burling LLP received 85 individual mentions and 23 practice mentions in the Legal 500 US 2010 edition. Legal 500 reviews the strengths and strategies of law firms in more than 90 countries in Europe, the Middle East, Asia, North and South America, and the Caribbean. Here are the Covington lawyers and practices ...

Chambers USA Recognizes Covington with 112 Individual, 44 Practice Nods

WASHINGTON, DC, June 16, 2010 — Covington & Burling LLP received 112 individual mentions and 44 practice mentions in Chambers USA 2010. The guidebook, which ranks lawyers by state and national practice area, is designed to identify the most skilled legal practitioners based on the qualities most valued by clients. Here are the Covington lawyers and practices ...

Covington Promotes 10 Lawyers to Partnership

WASHINGTON, DC, October 1, 2009 — Covington & Burling LLP today announced that ten of its lawyers have been elected to the firm’s partnership effective today. The new partners practice in the corporate, litigation, and regulatory fields. The ten new partners and their practices are as follows: Marney Cheek (International) represents companies and trade ...

Four Covington Partners On Ethisphere’s List of ‘Attorneys Who Matter’

WASHINGTON, DC, August 3, 2009 — Four Covington & Burling LLP partners have been named to The Ethisphere Institute’s 2009 “Attorneys Who Matter” list, which recognizes leading legal professionals in private practice and at government agencies and major companies who have excelled in and made a significant contribution in the corporate compliance field. In ...

Covington Partners Egan and Schmidt Among National Law Journal’s ‘40 Under 40’

WASHINGTON, DC, July 13 2009 — The National Law Journal has named Covington & Burling LLP partners Erin Egan and Paul Schmidt to its survey of “40 Under 40.” The list, which is featured in the July 13 issue, recognizes 40 Washington-area lawyers under the age of 40 who have already made their marks in private practice, government service, or the public interest ...

Covington Leads on the First Global Data Protection Standard

LONDON, June 9, 2009 — An enhanced version of the world’s first data protection standard for athletes took effect on June 1, 2009. The International Standard for the Protection of Privacy and Personal Information took effect on January 1, 2009, and an enhanced version was unanimously approved in early May 2009 by the Executive Committee of the World Anti-Doping ...

Covington Shortlisted For Three Chambers USA Awards

WASHINGTON, DC, May 15, 2009 — Three practices at Covington & Burling LLP have been nominated for 2009 Chambers USA Awards for Excellence. The firm received team nominations in the Insurance, International Trade and Privacy & Data Security categories. The awards recognize significant achievements over the past 12 months, including notable work, strategic growth, ...

Covington’s Tielemans Appointed to European Commission’s Data Protection Expert Group

BRUSSELS, November 12, 2008 — Covington & Burling LLP partner Henriette Tielemans has been appointed to the Data Protection expert group (GEX PD) by the European Commission. The Data Protection expert group will assist the Commission in identifying challenges for the protection of personal data in the EU, and putting forward proposals for addressing those ...

Covington Promotes 12 Lawyers to the Partnership

WASHINGTON, DC, October 1, 2008 — Covington & Burling LLP today announced that 12 of its lawyers have been elected to the firm’s partnership. These new partners are resident in four of the firm’s offices and practice in the litigation, corporate/tax, and regulatory fields. Timothy Hester, chair of the firm’s management committee, commented: “These young and ...

Chambers USA Gives Covington 81 Individual, 45 Practice Nods

WASHINGTON, DC, June 16, 2008 — Covington & Burling LLP received 81 individual mentions and 45 practice mentions in the newly released 2008 Chambers USA. The guidebook, which ranks lawyers by state and national practice area, is designed to identify the most skilled legal practitioners based on the qualities most valued by clients. Here are the Covington ...

Covington Expands Technology Transactions Practice With Addition of Nigel Howard

NEW YORK, NY, May 12, 2008 — Covington & Burling LLP is pleased to announce that Nigel Howard has joined the firm’s technology transactions practice as a partner. Mr. Howard will be resident in Covington’s New York office. Mr. Howard’s practice focuses on information technology, outsourcing, and intellectual property issues. He represents clients in complex ...

Chambers Global Recommends Covington in a Dozen Categories

LONDON, December 28, 2007 - The latest edition of Chambers Global has ranked Covington & Burling LLP’s expertise in 12 categories globally. “Sound knowledge of the industry” and “sheer breadth of experience“ are just some of the comments gathered by the research team from the firm’s clients. The firm has also achieved 10 individual rankings and a further 16 ...

Covington Receives 44 Practice, 74 Individual Mentions in 2007 Chambers USA Guide

WASHINGTON, DC, June 18, 2007 — Covington & Burling LLP received 44 practice mentions and 74 individual mentions in the newly released 2007 Chambers USA guidebook. The 2007 edition of Chambers USA attempts to identify the most skilled legal practitioners throughout the country based on the qualities most valued by clients. Covington attorneys have been ...

Covington Announces Ten New Counsel

WASHINGTON, DC, April 3, 2007 — Covington & Burling LLP has announced the promotion of four new Of Counsel and six new Special Counsel.The four new Of Counsel are Daniel P. Cooper, Christian Neira, Matthew J. O’Connor, and Kevin J. Shortill.Daniel P. Cooper advises on European privacy and data protection matters, as well as on contentious and non-contentious ...

View More View Less

Ranked by Chambers Global as a leading Data Protection practice (2013-2016)
Ranked by Chambers Europe as a leading Data Protection practice (2014-2016)
Ranked by Chambers UK as a leading Data Protection practice (2013-2017)
Ranked by Legal 500 EMEA as a leading EU Regulatory, Privacy and Data Protection practice (2013-2016)
Ranked by Chambers USA as a leading Privacy & Data Security practice (2013-2016)
Ranked by Legal 500 US as a leading Data Protection and Privacy practice (2013-2016)
Ranked by Legal 500 US as a leading Cyber Law practice (2015-2016)
Ranked by Legal 500 UK as a leading Data Protection practice (2013-2016)
Legal 500 UK Awards, winner of the TMT: Data Protection category (2014)
The Lawyer shortlisted our London technology and media group for its TMT Team of the Year Award (2013)
Law360's Practice Groups of the Year, Privacy & Consumer Protection (2011-2012)

Visit our blog, Inside Privacy

Named to the ABA Journal's "10th Annual Blawg 100"

"Ten Cybersecurity Incident Investigation Best Practices"

Cyber Security Law & Practice

"Safe Harbor Out, Privacy Shield In"

Lexis®PSL