Data, Privacy, and Cybersecurity

Wilson Sonsini assists companies facing government investigations that are often triggered by high-profile privacy incidents, novel business practices, and data breaches. We advise clients facing inquiries from key U.S. enforcement agencies, including the FTC, FCC, FBI, DOJ, and SEC; the Secret Service and other Department of Homeland Security offices and agencies; members of the Intelligence Community; and state and local agencies, including investigations led by state attorneys general. We have represented clients at every stage of an investigation, from advising on informal regulatory inquiries to managing and resolving complex, bet-the-company investigations.

We have particular expertise in representing companies facing government investigations into children’s privacy, advertising, and data security practices. For example, we have represented companies in the most significant COPPA and GDPR enforcement actions brought by the FTC and EU data protection authorities, respectively, positioning Wilson Sonsini as a leader on children’s privacy issues. We have a track record of obtaining favorable outcomes for our clients and resolving investigations without enforcement action. We also have deep experience in crafting thoughtful and effective responses to security breaches—for both business and legal purposes.

Our global practice scope and international experience allow us to help clients manage multi-jurisdictional challenges, including privacy inquiries by EU Data Protection Authorities. Our practitioners in Brussels and London assist clients with investigative matters originating from government entities throughout Europe and the UK, including inquiries involving the European Data Protection Authorities and the European Data Protection Board.

Wilson Sonsini’s team provides practical advice on how clients at every stage can collect, use, protect, and share data while remaining in compliance with privacy laws. We counsel clients in a wide range of industries on cutting-edge technologies. We have particular expertise in advising companies on compliance with COPPA, TCPA, CCPA, state biometric privacy laws, GDPR, the e-Privacy Directive, data localization laws, and advertising laws and regulations, such as the FTC’s Endorsement Guides.

In addition, our team advises clients on measures that demonstrate responsible stewardship of data and reduce the risk of regulatory and legal exposure. Examples of preventative measures we assist clients with include helping them:

• create, enhance, and audit privacy policies and programs;
• develop and implement global compliance programs; and
• establish sound and efficient information governance programs.

Our cybersecurity team counsels clients on how to minimize cyber risks and respond to cyber threats and attacks. We help develop incident response plans, policies, and procedures required by various laws and regulations, as well as conduct incident response testing. We manage forensic and internal investigations related to security incidents, including the submission of regulatory notifications across all 50 states and three territories, as well as the submission of notifications under the General Data Protection Regulation (GDPR). This includes advising companies when their systems, products, or employees may have been targeted for cyber exploitation by foreign state actors.

We also advise our clients on the full range of issues that arise when the government seeks user data or customer information, or attempts to compel one of our clients to directly assist in the government's efforts to conduct intelligence and law enforcement operations. We have expertise in dealing with:

• requests for information under the Foreign Intelligence Surveillance Act (FISA);
• National Security Letters (NSLs);
• issues under the Wiretap and Stored Communications Acts; and
• other search warrants and subpoenas from federal, state, and local intelligence and law enforcement authorities.

In addition, we assist clients involved in cutting-edge research and development that require specialized counsel to help them navigate the national security issues associated with innovation in a global economy. 

Our data, privacy, and cybersecurity team advises clients on the privacy and data security issues that arise in transactional matters. Our experience includes:

• representing companies in high-stakes mergers, acquisitions, and asset dispositions in which data is a key asset and where data transfers raise sensitive, complex, and often novel privacy issues;
• representing financial institutions and other companies in IPOs and other financial offerings involving companies whose business models entail collecting, processing, and disclosing user data; and
• assisting companies of all sizes in negotiating licensing, outsourcing, services, and other commercial transactions, including advising on privacy and data-security-related risks and obligations relating to the use, processing, security, and monetization of consumer data.

Our transactional attorneys’ combination of experience and understanding of prevailing norms enables them to provide responsive and practical advice while keeping our clients' business objectives in mind.

Wilson Sonsini’s litigation attorneys have successfully defended our clients since the privacy litigation trend arose through their effective, creative advocacy on behalf of companies ranging from innovative start-ups to market-leading technology companies. Our litigation team has consistently achieved favorable resolutions on behalf of clients in precedent-setting victories in privacy and internet law disputes, and the firm’s attorneys have consistently been involved in the most complex and novel privacy cases—especially considering Wilson Sonsini’s longtime nexus to innovative, disruptive technology companies.

Our team has decades of experience defending litigation from the earliest stages of class actions, including cases involving allegations of the improper tracking of user behavior online and on mobile devices. We have also represented companies in litigation involving claims under COPPA, the Computer Fraud and Abuse Act (CFAA), the VPPA, TCPA, BIPA, and other state privacy laws. We work with local counsel across the UK and the European Union to assist our clients in complex privacy litigations before national courts, as well as before the Court of Justice of the European Union.