Our Website Uses Cookies

We and the third parties that provide content, functionality, or business services on our website may use cookies to collect information about your browsing activities in order to provide you with more relevant content and promotional materials, on and off the website, and help us understand your interests and improve the website.

For more information, please contact us or consult our Privacy Notice.

Your binder contains too many pages, the maximum is 40.

We are unable to add this page to your binder, please try again later.

This page has been added to your binder.

PDF Binder
- Create PDF
- Add to Binder
Word Document Binder

Daniel P. Cooper

Partner

Brussels +32 2 545 7527 dcooper@cov.com London +44 20 7067 2020 Download V-card

View Less

Daniel Cooper advises clients on information technology regulatory issues, particularly data protection, e-commerce and data security matters.

According to Chambers UK, his "level of expertise is second to none, but it's also equally paired with a keen understanding of our business and direction." It was noted that "he is very good at calibrating and helping to gauge risk."

Mr. Cooper also regularly assists leading technology companies, including social networking sites, online content and entertainment providers, and e-shopping sites, on their European and global compliance strategies. He also has deep experience with the regulation of mobile and e-health technologies. Mr. Cooper is also known for his ability to guide clients through the issues arising from data breach incidents, and has advised a number of high-profile clients in this area. Mr. Cooper co-authored the data protection standard that governs organized sport.

Mr. Cooper is qualified to practice law in the United States, the United Kingdom, and Ireland. He has also been appointed to the advisory and expert boards of privacy NGOs and agencies, such as Privacy International and the European security agency, ENISA.

View More View Less

Represented Bristol-Myers Squibb transitioning its Binding Corporate Rules from France to Ireland.
Advised the European Federation of pharmaceutical Industries and Associations on submissions to European institutions regarding proposals on upcoming regulations.
Advised Arcelik on GDPR compliance across its 13 international subsidiaries and numerous jurisdictions in Europe, including Germany, UK, Finland, Sweden and Romania amongst others.
Advised Arcelik on privacy considerations and regulatory issues related to connected devices and applications, including Smart TVs; and online behavioral advertising and electronic direct marketing rules in various EU jurisdictions.
Represented AstraZeneca as it developed its GDPR-compliant Binding Corporate Rules, negotiating the terms with the UK Information Commissioner, as well as orchestrating the company’s transition of those BCRs to the Swedish regulators in anticipation of Brexit.
Advised 100+ companies on substantive matters and compliance projects including: gap analyses for companies, remediation planning and implementation tailored to each company.

Advised a wide range of clients in the life sciences sector on the proper application of the GDPR’s rules on scientific research.
Advised numerous tech-focused companies on the regulation of AI, machine-learning and related technologies under the GDPR.
Advised Facebook, the online social network, on its compliance with European data protection laws.
Advised Expedia, and its sister company, TripAdvisor, on compliance with data protection and security rules in Europe and Asia.
Advised Wikimedia Foundation, responsible for the Wikipedia publication, with respect to European laws regulating charitable organizations and cross-border transfers of data.
Advised Deutsche Bank on various data protection issues in the UK and Germany.
Advised Microsoft on its various online services and data protection compliance.
Advised Pfizer, GlaxoSmithKline (GSK), Novartis, Abbott, Gilead, Alcon, Genzyme, Johnson & Johnson, MSD and UCB on their compliance with European data protection rules relating to clinical trials, e-health platforms, genetic testing and in other contexts.
Advised the World Anti-Doping Agency (WADA) with respect to its compliance with European data privacy laws in connection with its global administration and management of athlete doping procedures.
Advised UK Anti-Doping (UKAD) on UK privacy regulations as applied to athlete drug testing.
Advised on the national laws relating to employee monitoring and surveillance in several EU Member States.
Advised Procter & Gamble on its online behavioral advertising practices and related collaborations with ad networks.
Advised CBS Interactive on its online privacy policies and data processing practices in Europe and Asia.
Advised Viacom, the global mass media company, in connection with UK data protection law matters.
Advised American Express in connection with its fraud detection program and initiatives involving “Big Data”.
Assisted UnitedHealth Group (UHG) with cross-border transfers of personal data and compliance with European registration rules.
Advised Privacy International, the privacy-rights NGO, with respect to emerging EU and other privacy and data retention laws
Assisted several manufacturing companies with devising privacy audit tools and practical compliance tools and template documents.
Assisted a multi-national client on compliance with pan-European notification requirements.
Provided large US-based pharmaceutical company with information on privacy laws in 10 key markets, including countries in Europe, Central, North and South America, and Asia.
Assisted large pharmaceutical company in dealing with privacy issues resulting from the migration of patient data from a clinical study to a web-based platform.
Advised on the processing of sensitive health data (under clinical trials and pharmacompliance), exports to third countries such as the US, communication to third parties such as regulatory authorities and identification of the “controller” of data.
Assisted several clients on the latest privacy developments in the areas of RFID and biometrics.
Assisted several worldwide privacy audits of US-based multinationals, including a detailed safety assessment, and recommendations to address certain issues, drafting of SOPS, notices, checking notifications to data protection authorities, and preparing appropriate privacy policies.

View More View Less

Advising consortium of privacy-rights organizations in connection with the human rights implications of EU laws on data retention and amassing information from electronic communications services providers.

European Privacy Association (EPA) Scientific Committee, Member (2015-2017)
DataGuidance Pharma Panel of Experts, Member
European Privacy Association, Member
Computer Law and Security Review, Member of the Professional Board
U.K. Law Society's ad hoc group on data protection, Member
Privacy International, Board of Trustees
CASRO, General Counsel and Privacy Officer's Forum
British Institute of International and Comparative Law, Data Protection Research and Policy Committee, Member
European Privacy Officers Network (EPON), Member
MI5, Advisor on data privacy issues

European Commission Publishes 2-Year Report on the Implementation of the GDPR

On June 24, 2020, the European Commission (“Commission”) published its much-anticipated assessment of the EU’s General Data Protection Regulation (“GDPR”) two years after it went into effect. The assessment takes into account contributions from the European Council, the European Parliament, the European Data Protection Board (“EDPB”), individual supervisory ...

French Council of State Decides that the French Supervisory Authority Cannot Prohibit Cookie Walls

On June 19, 2020, the French Council of State (Conseil d’État) decided that the French Supervisory Authority (“CNIL”) had gone too far in its guidance on cookies and similar technologies when it stated that conditioning a user’s access to a website upon his or her acceptance of certain cookies (commonly known as “cookie walls”) is...… Continue Reading

EasyJet Latest Firm to Face UK Data Breach “Class Action”

On 19 May 2020, easyJet announced that personal data of approximately 9 million customers worldwide had been unlawfully accessed by third parties in a “highly sophisticated cyber-attack”. Data stolen by the cyber-attackers includes credit card details of 2,000 of the affected customers and, for most other customers, travel details such as departure and arrival ...

Return to Workplace in Europe: Resource Guide

As businesses across Europe prepare to reopen following the COVID-19 lockdown, Covington is providing practical resources and guidance on the broad array of issues companies face as employees return to the workplace, including employment, privacy, competition, policy, environmental and regulatory considerations at the EU level, with a focus on Germany and the ...

Updated EDPB Guidelines on Consent and Implications for Cookies

On May 4, 2020, the European Data Protection Board (“EDPB”) updated its guidelines on consent under the GDPR. An initial version of these guidelines was adopted by the Article 29 Working Party prior to the GDPR coming into effect, and was endorsed by the EDPB on May 25, 2018. The revisions do not amount to...… Continue Reading

Creepy Technologies Invade European Post-Pandemic Workplaces

Daniel Cooper spoke with Bloomberg about new wearable technology devices that alert users when they are within close proximity of someone with COVID-19. Mr. Cooper notes that businesses are walking a fine line between keeping people safe and protecting their privacy. The absence of clear guidance from European regulators is forcing companies -- who could also be ...

ICO Issues COVID-19 Guidance for Employers

On May 11, 2020, the UK Information Commissioner’s Office (“ICO”) published guidance on how employers should handle data in the event they choose to test their employees for COVID-19. The guidance provides a clear reminder that employers must comply with both the General Data Protection Regulation (“GDPR”) and the Data Protection Act 2018 (“DPA”), and...… ...

Italian Supervisory Authority Publishes FAQs on Data Protection and COVID-19

On May 6, 2020, the Italian Supervisory Authority (“Garante”) published a list of frequently asked questions (“FAQs”) and answers on data protection and COVID-19 (see here, in English). The FAQs build on and expand guidance previously issued by the Garante (see our blog post here), and take into account recent measures adopted by Italian authorities, such as...… ...

Hungarian Government Suspends GDPR Data Subjects Rights

On May 4, 2020, the Hungarian Government issued a Decree that suspends, during the COVID-19 created state of emergency, the one-month deadline that controllers have under the GDPR to reply to data subject rights requests. The Decree also allows public entities to refuse or suspend freedom of information (“FOIA”) requests in certain situations. The Decree...… ...

EDPB Issues New Guidance on the Use of Location Data and Contact Tracing in the Context of the COVID-19 Outbreak

As we anticipated in a previous blog post, on April 22, 2020, the European Data Protection Board (“EDPB”) issued new guidelines on the use of location data and contact tracing apps in the context of the present COVID-19 pandemic. The EDPB’s new guidelines complement and build on similar guidance previously issued by the Board itself...… Continue Reading

UK ICO Issues Opinion on Apple-Google Initiative for a Contact Tracing Framework

On April 17, 2020, the UK’s Information Commissioner’s Office (“ICO”) issued an opinion on the recently announced Apple-Google initiative to develop a Bluetooth-based Contact Tracing Framework (“CTF”) to help prevent the spread of COVID-19. The ICO opinion is generally supportive of the Apple-Google proposal and perceives it to be, at this early phase, aligned ...

EU Commission Releases Guidance on COVID-19 Apps

On 8 April 2020, the European Commission adopted a recommendation on a common European Union toolbox for the use of technology and data to address the COVID-19 crisis (“Recommendation”). The Recommendation responds to calls for a common EU approach to the use of mobile apps in combatting COVID-19—one that improves the efficacy of the technology...… Continue ...

EDPB will issue data protection guidance on several topics relating to COVID-19

On April 7, 2020, the European Data Protection Board (“EDPB”) announced that it assigned specific mandates to two expert subgroups to prepare guidance on a number of Covid-19 related topics. The list of topics chosen by the EDPB reflects those that have received the closest scrutiny by the national authorities. These topics are the following:...… Continue Reading

Morrisons not liable for rogue employee data breach

Daniel Cooper spoke with Global Data Review about a UK high court case involving the deliberate breach of personal information by a supermarket employee from Morrisons. The court ruled that the supermarket was not liable for the actions of the employee. Mr. Cooper described the decision as “dual-edged” and said that “when coupled with the Lloyd Court of Appeal ...

Telcos share location data for coronavirus efforts

Dan Cooper spoke with Global Data Review about how telecommunications companies are providing data regulators location data to track the effects of social distancing in the wake of coronavirus. Mr. Cooper told GDR that the measures in Europe are “not too much of a concern” from a privacy perspective as the data being used by authorities is anonymized and ...

COVID-19: Legal and Business Toolkit

As the legal, regulatory, and commercial implications of coronavirus COVID-19 continue to evolve, our lawyers and advisors are helping clients navigate the complex considerations that companies around the world are facing and develop plans and strategies in response. Reach out to our COVID-19 task force at COVID19@cov.com. Below is a compendium of resources ...

Centre for Data Ethics and Innovation publishes final report on “online targeting”

On February 4, 2020, the United Kingdom’s Centre for Data Ethics and Innovation (“DEI”) published its final report on “online targeting” (the “Report”), examining practices used to monitor a person’s online behaviour and subsequently customize their experience. In October 2018, the UK government appointed the DEI, an expert committee that advises the UK ...

Brexit Day Marks a Beginning, Not an End

This evening, at 11:00 p.m. GMT, the UK will leave the European Union. Brexit day marks a beginning, not an end. The UK today embarks on a complex process of negotiating new arrangements for trade and cooperation with the EU and partners around the world. Regulatory divergence seems inevitable, given that the UK will want to make its own decisions on existing ...

Brexit and Data Protection - What Now for the UK?

At 11 p.m. tonight, the UK will officially leave the EU. Although this is a significant milestone in the development of the UK’s data protection framework, the UK will remain very closely linked to the EU in the short term at least, and for many the change may be imperceptible.

ICO hits electronics retailer with maximum pre-GDPR fine

Daniel Cooper is quoted in Global Data Review regarding the UK ICO’s decision to fine DSG Retail £500,000 under pre-GDPR data protection law. The fine stems from the company being compromised by a cyberattack affecting at least 14 million people. Mr. Cooper says, “the ICO's imposition of a maximum fine appears due, in part, to the fact that it felt DSG should ...

European Commission takes cautious approach on AI liability

Daniel Cooper spoke with Global Data Review about the European Commission’s recommended changes to artificial intelligence liability rules. Mr. Cooper says the commission is keen to stress that the conclusions drawn from the report remain those of the expert group only. “One has to assume that the commission wants to be careful to test the waters first and gauge ...

Landmark Case Opens the Door to UK Data Protection Consumer Class Actions

On October 2, 2019, the English Court of Appeal handed down a landmark judgment in Lloyd v Google LLC [2019] EWCA Civ 1599 (“Lloyd”) concerning Google’s alleged misuse of the personal data of over 4 million iPhone users via cookies placed on the Safari browser.

European Parliament Publishes Study on Blockchain and the GDPR

On July 24, 2019, the European Parliament published a study entitled “Blockchain and the General Data Protection Regulation: Can distributed ledgers be squared with European data protection law?” The study explores the tension between blockchain technology and compliance with the General Data Protection Regulation (the “GDPR”), the EU’s data protection law. ...

CJEU rules that Facebook and website operators are joint controllers if the website embeds Facebook’s “Like” button

On July 29, 2019, the Court of Justice of the European Union (“CJEU”) handed down its judgment in the Fashion ID case (Case C-40/17). The CJEU found that when a website operator embeds Facebook’s “Like” button on its website, Facebook and the website operator become joint controllers. The case clarifies the relationship between website operators...… Continue ...

ICO Launches Public Consultation on New Data Sharing Code of Practice

On July 16, 2019, the UK’s Information Commissioner’s Office (“ICO”) released a new draft Data sharing code of practice (“draft Code”), which provides practical guidance for organizations on how to share personal data in a manner that complies with data protection laws. The draft Code focuses on the sharing of personal data between controllers, with a section ...

Covington Represents Merck in $1.05B Acquisition of Peloton Therapeutics

WASHINGTON—Covington advised Merck & Co., Inc., in its definitive agreement under which Merck, through a subsidiary, will acquire privately held Peloton Therapeutics, Inc. in exchange for an upfront payment of $1.05 billion in cash. In addition, Peloton shareholders will be eligible to receive a further $1.15 billion contingent upon successful achievement of ...

Court of Appeal upholds 'surprising' Morrisons data leak ruling

Daniel Cooper spoke with The Law Society Gazette regarding a UK Court of Appeal decision that could make employers vicariously liable for employees’ actions even if they had taken preventative steps and bore no criminal responsibility. Mr. Cooper said the employer should bear the enterprise risk and assume liability for the actions of its employees, as long as ...

The five-minute management idea: wearable tech

Daniel Cooper is quoted in a Chartered Management Institute article regarding wearable technology. Providing the legal perspective, Cooper says, "Any employer processing personal information is subject to a range of obligations–this includes making sure they’re very transparent about what they collect, ensuring they have a legal basis for processing that data. ...

The EU Gets Serious About Cyber: The EU Cybersecurity Act and Other Elements of the "Cyber Package"

Last week, in his annual State of the European Union Address, the President of the European Commission Jean-Claude Juncker called out cybersecurity as a key priority for the European Union in the year ahead. In terms of ranking those priorities, President Juncker placed tackling cyber threats just one place below the EU leading the fight against climate change, ...

China Seeks Comments on Updated Draft of Cross-Border Data Transfer Security Assessment Standard

On August 31, 2017, China’s National Information Security Standardization Technical Committee (“NISSTC”), a standard-setting committee jointly supervised by the Standardization Administration of China (“SAC”) and the Cyberspace Administration of China (“CAC”), released an updated draft of the Information Security Technology - Guidelines for Data Cross-Border ...

Are You Ready for the GDPR? A Practical Checklist for Employers

On May 25, 2018, employers located or with staff in the European Union (“EU”) will have to comply with a new data protection law—Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data—commonly referred to as the General Data Protection Regulation (“GDPR”). This will ...

China Releases Near-final Draft of Regulation on Cross-border Data Transfers

On May 19, 2017, the Cyberspace Administration of China (“CAC”) invited international stakeholders to attend a seminar to discuss an updated version of the Measures on Security Assessment of Cross-border Data Transfer of Personal Information and Important Data (“the Measures”). Given that the Measures have an intended effective date of June 1, 2017, it is likely ...

China Seeks Public Comments on Draft Regulation of Cross-Border Data Transfer

On April 11, 2017, the Cyberspace Administration of China (“CAC”) released a draft of the Measures on Security Assessment of Cross-border Data Transfer of Personal Information and Important Data (“the Draft Measures”) for public comment (official Chinese version available here; Covington’s translation of the Draft Measures is appended at the end of this alert).

Workplace Health Schemes Endorses The Use Of Wearable Technology

Daniel Cooper is quoted by CCT News in an article regarding the use of wearable technology in the workplace. According to Cooper, the use of wearable devices is a good way, especially for insurers. However, the wearers’ privacy must be taken care of as well as their legitimate treatment concerns.

Wearable technology: gathering data from tooth to toe

Daniel Cooper is quoted in a Financial Times article regarding wearable technology in the workplace. According to Cooper, not everyone will welcome sharing intimate personal information with the boss, however. “Wearable devices could be a good way for insurers to get the data . . . but it’s essential to address wearers’ privacy and fair treatment concerns and ...

The EU-U.S. Privacy Shield: What’s New and What’s Next?

At a joint press conference on July 12, 2016 in Brussels, EU Commissioner for Justice, Consumers and Gender Equality, Věra Jourová and the U.S. Secretary of Commerce, Penny Pritzker, presented the Privacy Shield (see Press Release here, Adequacy Decision text here, Annexes here, Communication here, and Q&A factsheet here). The press conference followed the ...

Data Transfer Hurdles Have Companies Hedging Bets

Daniel Cooper is quoted in The Wall Street Journal’s “Morning Risk Report” discussing how companies should best comply with global data protection regulations. Commenting on the binding corporate rule process, Cooper said,“The one thing we know about binding corporate rules is [they tend] to have more appeal to European regulators.” He continues, “For a lot of ...

GDPR: Key Elements for Businesses in All Sectors

On December 15, the EU institutions finally agreed the text of the new EU data protection law, the General Data Protection Regulation (“GDPR”), completing a process that began in January 2012. The LIBE committee has published the consolidated version of the GDPR text. The GDPR heralds a new era of data protection. It replaces the existing data protection ...

'Hypocritical' Europe is just as bad as the USA for data protection

Dan Cooper is quoted by The Register in an article discussing the uncertainty and complications continuing to surround the Schrems decision that derailed Safe Harbour. Cooper stated that his business clients were both “surprise[d] and shock[ed]” by the European Court’s decision. “Businesses felt like the rug had been pulled out from under them,” said Cooper. ...

Wearables at work: the new frontier of employee surveillance

Covington's Daniel Cooper is quoted regarding the legal implications of wearables in the workplace: “Historically European regulators in the data protection area have been very sceptical you can ever get a valid employee consent — they feel that for existing employees, [the relationship] is almost inherently coercive.”

Covington Advises Illumina on Partnership with Genomics England

LONDON, 5 August, 2014 — Covington & Burling advised Illumina on its partnership with Genomics England to provide infrastructure and expertise for a four-year project that aims to make the UK the world leader in genetic research into cancer and rare diseases, through funding research to decode 100,000 human genomes - a patient's personal DNA code. The deal is ...

European Regulators Set Out Data Anonymization Standards

This post was originally published on our sister blog Inside Privacy On April 10, 2014, the Article 29 Working Party adopted an Opinion on anonymization techniques. The Working Party accepts that anonymization techniques can help individuals and society reap the benefits of “open data” initiatives – initiatives intended to make various types of data more freely ...

Italian Court Finds that Wikimedia is Not Liable for Defamatory Comments

By Dan Cooper and Oliver Grazebrook On 20 June 2103, the Court of Rome in Italy ruled that the Wikimedia Foundation (the charitable organisation that operates Wikipedia) could not be liable for defamatory content posted by users on its site. The court deemed that Wikimedia fell within the exemptions in the Italian transposition of Articles...… Continue Reading

Covington Helps Secure Approval for GlaxoSmithKline's BCRs

LONDON, 26 June, 2013 — The UK Information Commissioner's Office has authorised GlaxoSmithKline’s 'Binding Corporate Rules' (BCRs) – a set of internal policies and procedures used to protect personal data across GSK’s operations globally. The privacy and data security team at Covington & Burling was instrumental in the development, implementation and ...

Covington Advises Microsoft in $8.5 Billion Skype Deal

WASHINGTON, SAN FRANCISCO, BRUSSELS, AND LONDON, May 10, 2011 —Covington & Burling LLP is advising Microsoft Corp. in its acquisition of Skype Global S.à.r.l., the leading Internet communications company, for $8.5 billion in cash. Microsoft’s purchase of Skype from the investor group led by Silver Lake is expected to increase the accessibility of real-time ...

Covington Leads on the First Global Data Protection Standard

LONDON, June 9, 2009 — An enhanced version of the world’s first data protection standard for athletes took effect on June 1, 2009. The International Standard for the Protection of Privacy and Personal Information took effect on January 1, 2009, and an enhanced version was unanimously approved in early May 2009 by the Executive Committee of the World Anti-Doping ...

Chambers UK and Legal 500 UK Recommend Covington in 22 Categories

LONDON, 15 November, 2008 — The latest editions of Chambers UK and Legal 500 UK have recognised the London office of Covington & Burling LLP in a combined 22 categories, praising the firm’s lawyers for “best-in-class business acumen” and “excellent industry knowledge” as well as “consistent, absolutely top-tier service.” The firm’s London office has also ...

Covington Promotes 12 Lawyers to the Partnership

WASHINGTON, DC, October 1, 2008 — Covington & Burling LLP today announced that 12 of its lawyers have been elected to the firm’s partnership. These new partners are resident in four of the firm’s offices and practice in the litigation, corporate/tax, and regulatory fields. Timothy Hester, chair of the firm’s management committee, commented: “These young and ...

Covington Advises Bank of China, London Branch on the Transfer of its Non-Wholesale Banking Business

LONDON, November 15, 2007 - Covington & Burling LLP is pleased to announce its role in advising Bank of China’s London Branch on the transfer of its UK retail and part of its UK corporate banking business (based in London, Birmingham, Manchester and Glasgow) to Bank of China (UK) Ltd. Bank of China (UK) Ltd is a newly established UK bank and a wholly-owned ...

Covington Announces Ten New Counsel

WASHINGTON, DC, April 3, 2007 — Covington & Burling LLP has announced the promotion of four new Of Counsel and six new Special Counsel.The four new Of Counsel are Daniel P. Cooper, Christian Neira, Matthew J. O’Connor, and Kevin J. Shortill.Daniel P. Cooper advises on European privacy and data protection matters, as well as on contentious and non-contentious ...

View More View Less

Chambers UK, Data Protection and Information Law (2009-2020)
Chambers Europe, Data Protection (2015-2018)
Chambers Global, Data Protection (2008-2018)
Legal 500 UK, Data Protection (2012-2016)
Legal 500 UK, Sport (2013-2016)
Legal 500 UK, Media & Entertainment (2013)
Best Lawyers in the United Kingdom, Privacy & Data Protection Law (2014)
Super Lawyers - London, Computer and IT Law (2013)
Who's Who Legal, Data (2018) and Information Technology (2013)
Legal 500 EMEA, EU Regulatory, Privacy and Data Protection - Belgium (2011)

Our Website Uses Cookies

Daniel P. Cooper

Representative Matters

Pro Bono

Memberships and Affiliations

News and Insights (Showing 5 of 171) (Showing 171 of 171)