Cybersecurity and Data Privacy

Drawing on the combined experience of our Cybersecurity and Data Privacy group as well as our Global Insurance Services group—a renowned insurance and reinsurance team ranked by market leaders and top global publications as one of the world’s largest and best practices serving this market—we have helped leading insurers and reinsurers anticipate and adapt to emerging risks and meet the growing need for new products. We also assist with reevaluating existing products and pricing models.

Our Cyber Risk Coverage group is prepared to assist insurers and reinsurers with:

• Policy wordings and negotiations
• Underwriting guidelines and coverage counsel
• Coverage dispute defense

Representative matters include:

Coverage Opinions and Litigation

• Represented a domestic insurer in high-profile insurance coverage litigation stemming from the Sony PlayStation data breach; we obtained a dismissal of the insurer, who issued a cyber insurance policy to the insured
• Represented insurers in coverage disputes involving silent cyber coverage under products that were not intended to insure cyber events, including CGL Coverage A and B, Professional E&O, Management Liability, and Crime Policies
• Advised insurers in coverage matters arising out of claims alleging violations of Illinois’ Biometric Information Protection Act
• Represented insurers in coverage disputes involving first-party claims seeking forensic expenses, costs for responding to regulatory investigations, business-interruption loss, and extra expenses

New Policy Development and Revision

• Drafted cyber policies and related endorsements
• Advised on the development of cyber products insuring cryptocurrencies and initial coin offerings
• Advised on the regulatory issues associated with InsurTech products
• Advised an energy industry mutual in the development of property and accidental outage coverage triggered by a cyber event

Because businesses collect and employ data at every level, technological vulnerabilities, outdated practices and policies, and human errors create risks at every level, too. Some of these risks include:

• Loss of personally identifiable information—from customers and employees
• Theft of business and trade secrets and other intellectual property
• Attacks on networks and operating systems and resulting business disruption
• Challenges to business practices involving collection and usage of information about customers and the disclosure of those practices
• Exposures stemming from service providers, business partners, and employees

Goldberg Segalla’s Cybersecurity and Data Privacy practice—home to attorneys who are credentialed as Certified Information Privacy Professionals, United States (CIPP/US) by the International Association of Privacy Professionals (IAPP)—is exceptionally positioned to advise clients in virtually any industry on evaluating enterprise-wide risks and updating policies and practices to limit exposure to data breaches, attacks, and other cyber incidents.

Assessing Risks, Maximizing Coverage, and Limiting Liability

We help businesses of all sizes and structures develop policies and procedures to maximize their security and minimize the potential for a data breach; choose the right insurance policies to match their needs and potential risks; and take steps to limit potential liability related to a hacking attack or virus, data security breach, cybercrime, or other data-related incident.

Drawing on the experience and resources of our Global Insurance Services practice group—comprising attorneys who have worked at the cutting-edge of cyber risk policy development and coverage litigation, and regularly offer cyber coverage opinions to the world’s leading insurers—we also review and recommend cyber risk coverage policies to our clients in finance, entertainment and media, life sciences, high-tech manufacturing, and other industries. Comfortable working in this ever-evolving area of insurance coverage, we regularly negotiate or rewrite policies to include our commitment to represent the client in the event of a data breach or other claim.

Data Collection and Privacy Practices and Regulatory Compliance

Our attorneys are deeply versed in the latest regulatory compliance requirements covering data security, breach preparedness and response, and privacy, and we closely watch the judicial decisions and communications from administrative bodies at every level that indicate how the regulatory landscape is shifting.

We frequently conduct regulatory compliance audits, covering state, federal, and international requirements. We advise companies on requirements pertaining to the collection, storage, and destruction of personally identifiable information, and help realign noncompliant policies or practices.

Our regulatory experience includes:

• California Consumer Privacy Act (CCPA)
• California’s Shine the Light Law, Online Privacy Protection Act, and Confidentiality of Medical Information Law, and state-specific data security and breach response laws
• Children’s Online Privacy Protection Act (COPPA)
• Controlling the Assault of Non-Solicited Pornography And Marketing Act (CAN-SPAM)
• Fair and Accurate Credit Transaction Act (FACTA)
• Federal agency cybersecurity guidelines, including those issued by the FTC, FDA, FCC, and the NIST cybersecurity framework
• Federal Information Security Management Act (FISMA)
• Health Insurance Portability and Accountability Act (HIPAA) and Health Information Technology for Economic and Clinical Health Act (HITECH)
• Support Anti-Terrorism by Fostering Effective Technologies Act (SAFETY Act)
• Telephone Consumer Protection Act (TCPA)
• International data protection laws, including the General Data Protection Regulation (GDPR) and other EU and Latin American requirements

In addition, we assist clients with more complex and industry-specific regulatory requirements, including:

• Advising large multinational retailers on privacy policies, terms of use, and terms of sales to comply with FTC and FCC regulations, and advising on compliance for sweepstakes, advertising promotions, and product-placement agreements
• Auditing multitiered contractual privacy obligations pertaining to third-party online ad-serving companies and instituting policies and procedures for data collection, use, and disclosure
• Compliance with Payment Card Industry Data Security Standards (PCI-DSS) pre-incident and post-data breach obligations
• Conducting due diligence and advising on compliance with privacy and data security laws in the sale and acquisition of company assets, including customer lists and databases containing personally identifiable information

Security Policies and Contracts

We help businesses develop internal, client-facing, and third-party privacy and security policies.

We counsel management on workplace privacy issues, including employee monitoring, whistleblower laws, safeguarding of employees’ personal data, Fair Credit Reporting Act requirements in employee screening and investigations, and faithless servant data-theft litigation.

We also draft consumer-facing disclosures, including privacy policies, terms of use and service, and social media policies.

In addition, our team can assist with contracts, agreements, indemnification clauses, and other vehicles to protect against liability. We develop and negotiate security agreements to ensure vendors defend and indemnify our clients on privacy and security issues, and we have experience with agreements involving cloud service providers, co-location facilities, outsourced services, and other entities.

Data Breach Protocols and Crisis Coaching

We work with management, IT professionals, and in-house counsel to help our clients develop and train computer security incident response teams (CSIRTs). This includes conducting tabletop exercises and war games and teaching CSIRTs how to administer broader incident response training programs for other employees.

With our cutting-edge crisis coaching, our clients are prepared to act quickly and decisively, preserving digital evidence, meeting changing and immensely complex notification requirements, and managing public relations to minimize reputational harm and help restore confidence in the company.

Along with securing digital transactions, blockchain technology integration within existing security protocols reduces numerous cybersecurity risks—including significantly reducing the effectiveness of DDOS attacks. Blockchain-based solutions can help maintain uniformity, consistency, and accuracy of data; minimize manual intervention into systems and human errors; and simply compliance.

Attorneys collaborating across our Cybersecurity and Complex Transactions groups draw on cutting-edge technical knowledge and deep business backgrounds to advise clients across all industries adopting and adapting to blockchain. We have helped numerous clients make the best strategic use of this new technology while appraising and avoiding its unique risks.

Committed to providing clients with dynamic, adaptable, and cost-efficient legal service, we are equally capable of working as an auxiliary to a client’s CSIRT and in-house counsel or taking the lead and managing every aspect of a cyber-incident response. This is why clients of all sizes and across industries make Goldberg Segalla their first call after discovering a breach or other cybersecurity incident.

Breach Response and Crisis Management

As trial lawyers, we understand that every decision made before an incident and during a data breach response—from the first call through closing the incident—can dramatically impact potential liability and the course of future litigation.  Our comprehensive cyber crisis-management services include:

• Coordination of the forensic investigation
• Evidence preservation
• Working with law enforcement
• Advising on multi-state notification requirements
• Advising on HIPAA notification requirements
• Responding to Office for Civil Rights (OCR) investigations and other regulatory and administrative inquiries

 Post-Breach Regulatory Compliance

In addition to compliance with regulations pertaining to general data collection and privacy, we also guide clients through the intensely complicated regulatory demands triggered when a breach occurs. These include:

• Federal Trade Commission’s Children’s Online Privacy Protection Act (COPPA)
• Gramm-Leach-Bliley and Dodd-Frank Acts
• Health Insurance Portability and Accountability Act (HIPAA) and Health Information Technology for Economic and Clinical Health (HITECH) Act
• New European Union data protection laws including the General Data Protection Regulation (GDPR)
• Disclosure guidelines imposed and enforced by the Securities and Exchange Commission (SEC) as well as multiple state and international insurance industry regulatory authorities

Policy Reassessment and Public Relations

It is impossible to predict and prevent every breach. However, businesses and institutions that respond well to breaches can emerge even stronger after the recovery.

Our post-breach services include working with management, public relations teams, and outside consultants to develop and execute a media and public relations plan that minimizes reputational harm and restores confidence in the company while maintaining compliance with applicable regulatory requirements.

We also help clients seize on the post-breach opportunity to strengthen data protections, running comprehensive post-breach cybersecurity audits and recommending changes to policies, procedures, and response plans as needed.

Even the strongest and most effective response to a cybersecurity incident leaves open the possibility of costly lawsuits. While companies can take significant steps to limit liability and cut off avenues of plaintiffs’ attacks, they may still need the representation of a proven trial team with deep experience in the evolving legal issues unique to cybersecurity and data protection.

Cyber-Related Litigation

As a firm founded by trial lawyers, we bring to each matter the savvy and successful track record of our Commercial Litigation, Product Liability, Professional Liability, Global Insurance Services, and other litigation teams. We also bring extensive experience litigating other matters involving technology, including both prosecuting and defending business-to-business litigation involving website use, data transfer, and data storage issues.

Representative matters include: 

• Defended insureds against third-party claims alleging negligence giving rise to a data breach or other network security issue
• Represented insurers and defended insureds in matters arising out of modular cyber, tech, and media policies
• Advised insurers and defended insureds in claims arising out of alleged website ADA non-compliance
• Advised insureds with regard to ADA compliance for interactive technology such as kiosks pertaining both to structure (e.g. height, accessibility) and visual/audible impairments

Class Action Defense

Our Class Action Litigation practice group has successfully defended Fortune 500 companies as lead counsel in national and state-wide class actions, including high-risk, multimillion-dollar litigation. Representative matters include:

• Represented a telephone company in actions challenging the company’s use of fax communications as violative of the Junk Fax Prevention Act
• Represented a health care company against a class action lawsuit alleging a data breach of personal health information
• Represented numerous retailers, hospitality and other clients in putative class action lawsuits brought pursuant to the Telephone Consumer Protection Act
• Represented a cellular telephone company in individual and putative class actions challenging the company’s debt collection practices under the Telephone Consumer Protection Act
• Defended insureds in data breach class actions involving the loss of PII, PHI, and confidential and proprietary information

IR²:  Incident Response and Indemnity Recovery

When a cyber event strikes, your priority is guiding your insured through the crisis and ensuring they’re compensated for their loss. At Goldberg Segalla, experience tells us that swift incident response must be followed by a strategic plan for indemnity recovery.

Our cyber subrogation team moves quickly to help identify third-party responsibility – whether it’s vendors, partners, or service providers – and pursue those accountable. We build strong claims and drive recovery of cyber-related indemnity payments efficiently and economically.

Key Considerations

Our attorneys are pioneers that have navigated the complexities of cyber subrogation. We help clients address:

• Subrogation when the party at fault is also your insured
• Subrogation in the face of an ongoing relationship between the insured and the party at fault
• Partnering with insureds with large retentions or deductibles
• Contractual issues (limitation of liability/choice of law, etc.)
• Evaluating venue and forum
• The amount at issue versus cost of recovery
• Bundling claims for strategic advantage and economic viability

Supporting Your Claim

We conduct a thorough investigation grounded in the insurance policy and any relevant contracts between the insured and the party responsible for the loss. Our process includes:

• Establishing liability based on cybersecurity and data privacy obligations
• Connecting liability to the cause of loss
• Quantifying damages using incident response expense documentation and payment records
• Mining lawsuits, enforcement actions, and public filings concerning the responsible party to strengthen your claim and anticipate defenses

This comprehensive approach ensures your claim is well-substantiated and positioned for recovery through early resolution or after defeating a motion to dismiss.

Proven Resolution Options

Our team helps insurers pursue responsible parties with proven strategies that maximize subrogation outcomes, including:

• Strategically selecting the venue and forum
• Crafting pleadings that get past the motion to dismiss
• Negotiating with the party at fault and their insurance carrier
• Developing a simple, compelling narrative
• Being prepared to take the case to trial

Collaborative Financial Partnership

At Goldberg Segalla, we believe that being a trusted business partner means aligning on a financial framework that that is mutually beneficial. We commit to:

• Exploring flexible fee structures, including fee plus contingency-based arrangements
• Setting realistic budgets and hold to them
• Maintaining prompt reporting and transparency throughout the process

Experience That Counts

With the average cost of a cyberattack exceeding almost $4 million, the financial impact is significant. Insurers call upon Goldberg Segalla as the law firm with the experience and insight to protect their interests.

Goldberg Segalla’s Global Insurance Services practice group is one of the largest in the U.S., representing insurers, reinsurers, and others across the insurance landscape. Our trial attorneys are recognized for excellence in cybersecurity litigation, deep subrogation experience, and the ability to preserve critical business relationships while pursuing successful recovery.