Covington & Burling LLP

This website uses cookies. For more information please contact us or consult our privacy policy.

Your binder contains too many pages, the maximum is 40.

We are unable to add this page to your binder, please try again later.

This page has been added to your binder.

PDF Binder
- Create PDF
- Add to Binder
Word Document Binder

Mark Young

Partner

London +44 20 7067 2101 myoung@cov.com Download V-card

View Less

Mark Young advises clients on data protection, cybersecurity and intellectual property matters. He has particular expertise in regulatory compliance and legislative advocacy, cyber and data security incident preparation and management, and online IP enforcement.

According to the latest edition of Chambers UK (2017), he is "a trusted adviser - practical, results-oriented and an expert in the field." In 2016, it was noted that he "enjoys a growing reputation for his expert advice to a number of sophisticated clients on data protection and cybersecurity issues, and is particularly well thought of for his insight into the EU General Data Protection Regulation."

Mr. Young has over ten years of experience advising global companies, particularly in the online/e-commerce, technology, health and pharmaceutical sectors, on all aspects of data protection and security. This includes providing practical guidance on analyzing and using personal data, transferring personal data across borders, and potential liability exposure. He specializes in advising in relation to new products and services – particularly in the technology and health sectors – and providing strategic advice and advocacy on a range of EU law reform issues and on references to the EU Court of Justice (e.g., regarding data privacy, data retention and cybersecurity, and more broadly, including cloud computing, ecommerce, online liability, IP enforcement and software related policy).

For cybersecurity matters, he counsels clients on internal practices to protect business-critical information and comply with national and sector-specific regulation, and on preparing for and responding to cyber-based attacks and internal threats to their networks and information. He has helped a range of organizations respond to cyber and data security incidents – including external data breaches and insider theft of trade secrets – through the stages of initial detection, containment, notification, recovery and remediation.

In the IP enforcement space, Mr. Young represents right owners in the sport, media, publishing, fashion and luxury goods industries, and helps coordinate a team of internet investigators that has nearly two decades of experience conducting global notice and takedown programs to combat internet piracy.

View More View Less

Data protection - pharma sector. Counseled GlaxoSmithKline (GSK) on the development, implementation and authorization of its Binding Corporate Rules (BCRs) that allow GSK to transfer personal data from the European Economic Area (EEA) to affiliates located outside of the EEA in compliance with European data privacy rules.
Data protection - tech sector. Advises Facebook on EU data privacy compliance in relation to new features and products.
Cybersecurity. Counsel to multiple clients who have experienced a cyber / data security incident, including supervising technical investigations, advising on notification obligations and other legal risks, and representing clients before regulators around the world.
Legislative advocacy. Advises Microsoft, the Business Software Alliance, and other technology industry clients on various EU legislative initiatives, including reviews of the Data Protection Framework, Network and Information Security Directive, e-Commerce Directive, IP Enforcement Directive and the Telecommunications Framework, as well as proposals regarding cloud computing, child online safety, electronic IDs and other technology related matters.
Online IP enforcement. Advises a range of clients, including the National Football League, several major publishers, software providers, and fashion and luxury brands on strategies and enforcement programs to combat online IP infringement.

EU and international data privacy and security counsel to a leading global pharmaceutical company, advising on a range of matters including cloud computing service contracts, international transfers of data, clinical trials, eHealth services, compassionate use programs, corporate transactions, data analytics, and internal investigations.
Advises a leading global cloud computing provider on complex cross-border regulatory issues, including data privacy, data retention, security, hosting liability and law enforcement access to data, as well as on specific outsourcing and security regulations in the financial, healthcare and public sectors.
Advises a leading financial institution on biometrics and smart phone apps and applicable data privacy and security regulations.
Assists Expedia and other leading internet-based companies with compliance aspects of their online services, and developing privacy policies and other data privacy compliance materials.
Advised eBay on transferring personal data internationally in the context of e-discovery.
Counseled Telefónica O2 UK on data retention matters.

View More View Less

Advising Privacy International, the privacy-rights NGO, with respect to emerging EU and other privacy and data retention laws (2007-2012).

IAPP
IPSoc
Society for Computers and Law

Trained with and qualified into the IP department of a leading City of London law firm
First Data International, seconded to the in-house legal team
BBC, Vodafone, the Times newspaper, legal internships
PricewaterhouseCoopers, IT Management Consultant (2000-2002)

5 Ways To Keep Cybersecurity Risk From Derailing A Deal

Mark Young and Libbie Canter are quoted in this Law360 article offering tips on how deal makers can mitigate cybersecurity risks. According to Young, any discovered incidents can give buyers pause on how — and if — they want to move forward. “We’ve dealt with at least a couple examples where deals were at least delayed if not reconsidered because of ...

Covington Promotes 16 New Partners

WASHINGTON—Covington has promoted 16 lawyers to its partnership. “It’s a great tribute to the firm’s vibrancy that we’re continuing to build an exceptional pipeline of new partners from within our ranks,” said Timothy Hester, Covington’s chair. “We’re confident that all 16 will add importantly to the firm’s strengths and will drive further expansion of core ...

EU Announces Major New Cybersecurity Plans

Last week, in his annual State of the European Union Address, the President of the European Commission Jean-Claude Juncker called out cybersecurity as a key priority for the European Union in the year ahead. In terms of ranking priorities, President Juncker placed tackling cyber threats just one place below the EU leading the fight against...… Continue Reading

The EU Gets Serious About Cyber: The EU Cybersecurity Act and Other Elements of the "Cyber Package"

Last week, in his annual State of the European Union Address, the President of the European Commission Jean-Claude Juncker called out cybersecurity as a key priority for the European Union in the year ahead. In terms of ranking those priorities, President Juncker placed tackling cyber threats just one place below the EU leading the fight against climate change, ...

UK Government Proposes Cybersecurity Law with Serious Fines

Earlier this month, the UK Government published a consultation on plans to implement the EU Directive on security of network and information systems (the “NIS Directive”, otherwise known as the Cybersecurity Directive). The consultation includes a proposal to fine firms that fail to implement “appropriate and proportionate security measures” up to EUR 20 ...

The Morning Risk Report: More Data Security Compliance on EU Horizon

Mark Young is quoted in The Wall Street Journal's "Morning Risk Report" in an article regarding the Network and Information Systems directive. According to Young, “This is another data-related compliance requirement and it carries heavy penalties for failure to have in place appropriate network security measures."

Are You Ready for the European General Data Protection Regulation? A Practical Checklist for Employers

One year from today, on May 25, 2018, employers will have to comply with a new data protection law, commonly referred to as the General Data Protection Regulation (the “GDPR”). This alert provides a practical checklist of key considerations for employers and human resources professionals preparing for the new regime, ahead of its implementation next year.

Manage Ransomware Risks Now

Last Friday may mark the start of a new era in cyber crime. The first worldwide ransomware attack, commonly dubbed “WannaCry,” emerged on May 12. The malware is believed to have infected more than 300,000 computers in 150 countries to date. A cyber criminal or ring of criminals, taking advantage of an exploit made available by the ShadowBrokers hacker group that reportedly uses tools stolen from the U.S. National Security Agency, propagated an attack that installs malware to encrypt users’ data unless a ransom in Bitcoin is paid within a few days. While the actual ransom payment losses have reportedly been minimal, the more serious result of these attacks has been the disruption to victims’ business activities.

Banks Face Cybercrime Wave As Tougher Regulations Loom

Mark Young, Jennifer Martin, and Ian Hargreaves are quoted in a Law360 article regarding the high level of cyberattacks on the financial services industry and the resulting regulatory pressures. According to Young, “The GDPR [General Data Protection Regulation] is a massive text with groundbreaking change in the data privacy area, in terms of compliance ...

CJEU Confirms Dynamic IP Addresses To Be Personal Data

On Wednesday October 19, 2016 the Court of Justice of European Union (“CJEU”) issued its judgment in Case C-582/14, Patrick Breyer v Germany. The CJEU held that a “dynamic” IP address constitutes personal data (agreeing with the Opinion of the Advocate General from May this year). Dynamic IP addresses qualify as personal data, even if...… Continue Reading

Inherited Infrastructure, Outdated Software, And Other Failings That Led To TalkTalk’s Record Fine

On October 5, 2016, the UK Information Commissioner’s Office (“ICO”) fined telecoms company TalkTalk a record £400,000 for failing to put in place appropriate data security measures and allowing a cyber-attacker to access TalkTalk customer data “with ease.” The ICO highlighted several technical and organizational deficiencies as justification for issuing its ...

Covington's Brexit Task Force Provides Insights on Latest Developments

Our Brexit Task Force is staffed by senior lawyers and advisors across London, Brussels, and Washington to monitor events and to keep clients apprised of legal, regulatory, and policy developments. We are advising clients across a wide range of businesses and industries on the impact and implications of Brexit, including on strategic policy and regulatory ...

UK Votes to Leave the EU

The UK has voted to leave the European Union in an advisory referendum. 52% leave - 48% remain. Were the UK to leave the EU, this would have significant implications for the UK and for international businesses operating in the UK. The longer term impact of the decision on the regulatory framework for the UK will depend, in part, on the relationship that the UK ...

Covington Represents Tencent in $8.6 Billion Acquisition

SILICON VALLEY—Covington advised Tencent Holdings Limited, a leading provider of internet service in China, in connection with its acquisition of a majority stake in Supercell from SoftBank. A consortium established by Tencent will acquire up to 84% of Supercell for $8.6 billion in a transaction valuing Supercell at approximately $10.2 billion. Supercell is a ...

EU Cyber Security Directive To Enter Into Force In August

The EU Network and Information Security (NIS) Directive now looks likely to enter into force in August of this year. Member States will then have 21 months to implement it into national law before the new security and incident notification obligations will start to apply to the following entities: designated* “operators of essential services” within...… ...

Company Receives Record Fine from UK Regulator For Cold Calling

The UK’s data protection regulator, the Information Commissioner’s Office (“ICO”), has imposed a fine of £350,000 on Prodial Ltd (“Prodial”) for making over 46 million unsolicited automated telephone calls to generate leads in relation to payment protection insurance refunds. This is the highest fine issued by the ICO to date. The ICO investigated the ...

EU DPA Enforcement Guidance Post-Schrems

Industry eagerly awaits further guidance from data protection authorities (“DPAs”) relating to the EU-U.S. Privacy Shield as well as on the validity (or otherwise) of other mechanisms for transfers to the U.S. such as standard contractual clauses (“SCCs”) and binding corporate rules (“BCRs”). As we explained in recent posts (here and here), publication of ...

European Parliament Committee Approves EU Cybersecurity Rules and Publishes Agreed Text

By Mark Young and Vera Coughlan Formal adoption of the EU Network and Information Security (NIS) Directive is a step closer following a vote on January 14 by the European Parliament’s internal market and consumer protection (IMCO) committee. As we reported in December, the European institutions reached an informal political agreement on the NIS Directive...… ...

European Institutions Reach Agreement on EU Cybersecurity Rules

On December 7, 2015, the European institutions reached an informal agreement on the EU Network and Information Security (NIS) Directive — dubbed the Cybersecurity Directive (see press release from the Council). Among other things, the NIS Directive imposes security and incident reporting obligations on operators of essential services in critical sectors and on ...

EU Cybersecurity Rules Increase Liability For Multinationals

Mark Young is quoted in a Law360 article discussing the EU Network and Information Security Directive, which sets a cybersecurity and breach reporting baseline for both critical infrastructure operators, as well as digital service providers. This directive, which is the first of its kind, comes after two years of negotiations. According to Young, “There’s going ...

EU’s Highest Court Invalidates Safe Harbor with Immediate Effect

Today, the Court of Justice of the European Union (the “CJEU”) invalidated the European Commission’s Decision on the EU-U.S. Safe Harbor arrangement (Commission Decision 2000/520 – see here). The Court responded to pre-judicial questions put forward by the Irish High Court in the so-called Schrems case. More specifically, the High Court had enquired, in ...

Covington Advises Illumina on Partnership with Genomics England

LONDON, 5 August, 2014 — Covington & Burling advised Illumina on its partnership with Genomics England to provide infrastructure and expertise for a four-year project that aims to make the UK the world leader in genetic research into cancer and rare diseases, through funding research to decode 100,000 human genomes - a patient's personal DNA code. The deal is ...

Covington Announces Seven New Counsel

WASHINGTON, DC, April 17, 2014 — Covington & Burling is pleased to announce the promotion of four lawyers to of counsel and three lawyers to special counsel, effective April 1, 2014. The new of counsel are as follows: Lindsay Burke advises U.S., international, and multinational employers on employee management issues and international HR compliance. Her domestic ...

Covington Helps Secure Approval for GlaxoSmithKline's BCRs

LONDON, 26 June, 2013 — The UK Information Commissioner's Office has authorised GlaxoSmithKline’s 'Binding Corporate Rules' (BCRs) – a set of internal policies and procedures used to protect personal data across GSK’s operations globally. The privacy and data security team at Covington & Burling was instrumental in the development, implementation and ...

Safer “Bring Your Own Device” Policies: New Guidance from the UK Information Commission’s Office

On 7 March 2013, the UK Information Commissioner’s Office (ICO) issued new guidance for employers on the use of personal devices for business purposes. The guidance is largely informed by a survey commissioned by the ICO and carried out by the market research firm YouGov. According to the survey, 47 percent of adults in the UK...… Continue Reading

Covington Boosts European Life Sciences and TMC Groups

LONDON, 6 August, 2007 — Covington & Burling LLP is pleased to announce the appointment of two associates in the London office: Janet Kidd joins the European Life Sciences Group and Mark Young joins the European TMC Practice. Before qualifying as a solicitor, Janet spent 15 years in the pharmaceutical industry where she worked for household names such as Pfizer, ...

View More View Less

Education

Nottingham Law School, 2008

Postgraduate Diploma in Commercial Intellectual Property

College of Law, London, L.P.C., 2004

Glasgow Graduate School of Law, 2003

LL.M. in Technology Law
Distinction

University of Edinburgh, 1999

LL.B. (Joint Hons. French)

Université Paul Cézanne Aix-Marseille III, 1998

Erasmus Exchange

Representative Matters

Pro Bono

Memberships and Affiliations

Previous Experience

News and Insights (Showing 5 of 104) (Showing 104 of 104)

Accolades

Practices

Industries

Education

Nottingham Law School, 2008

College of Law, London, L.P.C., 2004

Glasgow Graduate School of Law, 2003

University of Edinburgh, 1999

Université Paul Cézanne Aix-Marseille III, 1998

Bar Admissions

Languages