Amy is skilled at harmonizing requirements across industries and jurisdictions to build practical, risk-based and business-focused global privacy and cybersecurity programs. In the U.S., this includes advising on federal and state laws such as HIPAA, FCRA, GLBA, TCPA, CAN-SPAM, CCPA, state breach notification laws, and state data security laws, as well as existing self-regulatory frameworks, including those covering online advertising and payment card processing. She works with clients to understand their obligations under international laws such as PIPEDA, the GDPR and ePrivacy, and China’s cybersecurity and privacy laws, and helps clients implement cross-border transfer mechanisms, such as Privacy Shield and EU Model Clauses, to enable the flow of data between company entities and third parties.

Amy also manages large and complex cyber incidents by guiding clients through the phases of breach response and post-incident remediation. She has teamed with forensic vendors and other consultants to help clients investigate, remediate, mitigate and notify required parties. She has also teamed with her white collar and litigation colleagues to manage and respond to ensuing government investigations.

In addition, Amy helps clients implement pragmatic approaches to managing and leveraging big data, advises clients through comprehensive privacy and cybersecurity assessments, vets privacy and security risks in corporate transactions, and drafts and negotiates contracts concerning data-related partners and vendors.

Show Less

• Developed a global records retention policy and schedule for a multinational software company that complied with records retention requirements across seven different countries
• Vetted privacy and security risks in a private equity fund’s multimillion-dollar acquisition of four national data brokers, and advised on post-closing implementation of privacy and security controls.
• Performed and documented HIPAA breach analyses for a large regional hospital system to assess whether uses and disclosures of protected health information resulted in a reportable breach, drafting notification letters when appropriate
• Acted as an interim privacy officer for a large regional hospital system

Show Less