Privacy and Data Protection: Safeguarding Digital Sovereignty

The GDPR applies to any organization that processes personal data of individuals located in the European Union regardless of where the organization is based, requires a lawful basis for each processing activity, grants EU data subjects the right to erasure, restriction, data portability, and the right to object, and imposes maximum administrative fines of up to four percent of global annual turnover. The CCPA and CPRA grant California consumers the right to know, delete, and opt out of the sale or sharing of personal information.

Data privacy and regulatory compliance counsel can advise on the GDPR and CCPA compliance obligations applicable to the specific business and develop the unified global privacy compliance strategy.

Privacy by Design requires privacy protections to be embedded into the design and architecture of IT systems and business practices proactively and by default rather than added as an afterthought, and it has been codified as a legal requirement under Article 25 of the GDPR. Companies implementing Privacy by Design must limit the personal data they collect to the minimum necessary for the specified purpose and document their data protection measures.

Consumer data protection and data governance accountability counsel can advise on the regulatory framework most applicable to the specific business and develop the multi-framework privacy compliance strategy.

Data privacy and cybersecurity governance counsel can advise on the Privacy by Design requirements and develop the Privacy by Design implementation strategy.

The GDPR requires controllers to notify the applicable supervisory authority of a personal data breach within seventy-two hours of becoming aware of the breach if the breach is likely to result in a risk to the rights and freedoms of natural persons, and to notify affected data subjects without undue delay if the breach is likely to result in a high risk. The CCPA and CPRA require businesses to notify California residents of a breach of their unencrypted personal information within a reasonable time.

Data breach and data breach litigation counsel can advise on the data breach notification obligations applicable to the specific incident and develop the breach response and notification strategy.

Companies defending against data breach class actions must demonstrate that they implemented reasonable security measures appropriate to the nature and sensitivity of the personal data they processed, that they had an incident response plan in place and followed it when the breach occurred, and that they took prompt steps to contain the breach. The evidentiary record includes contemporaneous logs of security events, documentation of the security assessments conducted before the breach, and records of the employee security training program.

Data privacy class action and cybersecurity class action counsel can advise on the evidentiary record required to defend against data breach class actions and develop the data breach litigation defense strategy.

The GDPR prohibits the transfer of personal data from the EU to a third country unless the European Commission has issued an adequacy decision or the transferring organization has implemented appropriate safeguards, including standard contractual clauses, binding corporate rules, or other recognized transfer mechanisms. Companies that transfer personal data from the EU to the United States can rely on the EU-US Data Privacy Framework if the US receiving organization has self-certified.

Cross-border data protection and cross-border data breach counsel can advise on the legal mechanisms available for the specific cross-border data transfer and develop the cross-border data transfer compliance strategy.

When personal data is stored in cloud infrastructure operated by US companies, the data may be subject to government access requests under the Foreign Intelligence Surveillance Act and the CLOUD Act, creating a conflict between the company's obligation to comply with government data access requests and its obligation under the GDPR to protect the personal data of EU residents. Companies managing this conflict should implement encryption and other technical measures that limit the government's ability to access personal data.

Cloud computing and data security counsel can advise on the data sovereignty and government access issues and develop the cloud data governance and sovereignty strategy.