Skip to Main Content.

Data Security & Privacy

Helping clients comply as they innovate.

Our team of business, intellectual property and litigation attorneys advises on all aspects of privacy compliance, information handling, data security, breach preparation and response, enforcement and other related litigation. We guide clients in taking practical steps to meet their legal obligations, mitigate operational and reputational risks, and institutionalize resilience through effective digitization and data management solutions.

We recognize that an effective compliance program or incident response plan must be tailored to each client’s operations, data practices, and risk profile. We draw upon our collective experience and deep regulatory knowledge to help clients enhance their organization’s cybersecurity architecture, respond strategically to breaches, and navigate their legal and regulatory requirements in the U.S., Europe and globally.

Key Contact

Michael E. Nitardy Profile Image
Michael E. Nitardy

Member

Florence, KY

How We Help Clients

Cybersecurity & Incident Response

Our data security team not only understands the cyber-threat landscape, but we know where to prioritize. We help clients identify system vulnerabilities, incorporate security-by-design principles where necessary, and develop proactive incident response plans to minimize the legal and reputational impact of cybersecurity threats. In the event of a data breach or ransomware attack, we work with clients to contain the threat, recoup losses, draft and issue disclosure statements, and take appropriate steps to limit their legal and regulatory exposure. We also advise clients on the scope and application of cyber risk insurance policies and protections, including the negotiation of favorable terms and conditions.

As the frequency and sophistication of cybercrimes have increased, we’ve built a robust practice around assisting companies in the immediate aftermath of actual ransomware attacks—both for clients who have incident response plans and those who do not. We frequently act as “Breach Coach,” coordinating with our clients’ leadership and IT teams to mount a calculated response. We oversee and direct various breach response activities, including forensic investigations, coordination with law enforcement agencies, compliance with all applicable state breach notification laws, compliance with contractual notice obligations, and responding to inquiries from the Federal Trade Commission and state attorneys general.

Experience Highlights
  • Served as breach coach in a ransomware attack upon a foreign-owned mid-tier automobile manufacturing business located in the Midwest that was attacked by the Sodinokibi aka REvil ransomware malware variant. Responsibilities included organizing the company’s response, vendor retention (forensics, evidence analysis, translation and intermediary services), overseeing the stakeholder communication matrix, law enforcement, employee relations, threat actor negotiations and pursued the subrogation action to recover for the client’s benefit the principal part of its out-of-pocket losses.
  • Served as breach in a ransomware attack for a financial institution located in the Midwest that was attacked by the Avvadon ransomware malware variant. Responsibilities included working as a team with the insurer, organizing an incident response strategy, vendor retention (public relations, forensic, post-attack security, intermediary and call center services), drafting external and internal communications, interaction with financial regulators, overseeing the stakeholder communication matrix, employee meetings, threat actor negotiations, data breach notification guidance (consumers and state AGs) and Call Center/Credit monitoring matters.
  • Served as breach coach in a ransomware attack on a Texas-based manufacturer of renewable energy products attacked by the SunCrypt ransomware malware variant. Responsibilities included organizing the company’s response strategy, vendor retention (forensics, intermediary and post-attack security services), overseeing the stakeholder communication matrix, law enforcement, employee relations, threat actor negotiations and data breach response work.
  • Assisted a national restaurant chain with a credit card data breach in dozens of states with over one million card exposures. Responsibilities included emergency response coaching, breach evaluation, breach notification, breach vendor management, liability assessments, negotiations with processors, acquiring banks, issuing banks and card brands, and litigation support.
  • Assisted a large multinational corporation with its evaluation of and response to a ransomware attack that crippled all corporate servers, including human resources and payroll.
  • Assisted a company with response and notification arising from infiltration of the company’s system that altered payroll files processed by a third-party payroll processor. Responsibilities included working with a forensics investigation firm, coordination of notification to employees, and negotiation with the cyber liability insurance provider.
  • Consulted with an international manufacturing business regarding a “phishing” incident directed at employees’ personal data. Responsibilities included identification of the scope of attempted intrusion, analysis of potentially applicable law of multiple jurisdictions, and assessment of technological safeguards in place to prevent an actual security breach of the information systems in question.
  • Advised a midsized consumer retail services business on response to employee theft of personal information from company systems. Worked with the client’s IT department to identify access and attempted misappropriation of information and coordinated with law enforcement for potential prosecution and assessment of any breach notification.
  • Assisted a large multinational corporation with its evaluation of and response to a ransomware attack that debilitated all corporate servers, including human resources and payroll.

Key Contact

  • Gene F. Price Profile Image
    Gene F. Price

    Member

    Louisville, KY

Privacy & Compliance

Our team emphasizes a coordinated approach to risk assessments and the development of compliance solutions for our clients, drawing upon the broad experience of our group and the firm’s industry-specific knowledge. We believe that being proactive with respect to data privacy and security compliance obligations, while incorporating privacy-by-design principles where possible, ensures that our clients remain responsive to the expectations of government regulators and ahead of their competition in this escalated privacy environment.

Our team includes IAPP-certified privacy professionals in both U.S. and EU law, as well as former technologists, engineers, and software developers. While each attorney on our team brings a distinct skill set, the one common denominator is that we are all fluent in the underlying technology and sophisticated data management systems used by businesses competing in today’s data-driven economy. We stay on top of legal developments in this complex and rapidly changing environment, making us well-positioned to help our clients navigate their regulatory requirements in the United States, Europe, and globally.

Experience Highlights
  • Advising private and publicly traded companies regarding the collection, use, protection, and disclosure of confidential and personal information.
  • Advising companies regarding compliance with the European Union’s General Data Protection Regulation (GDPR) and related laws, as well as the California Consumer Privacy Act and other state privacy laws.
  • Advising companies on domestic and international laws affecting cross-border transfers of confidential information, as well as the necessary content of privacy notices.

Key Contact

  • Michael E. Nitardy Profile Image
    Michael E. Nitardy

    Member

    Florence, KY

Data Governance & Strategy

Increasingly, a company’s data and information assets are as valuable as their material assets, with the potential to create efficiency gains and significant growth opportunities. Our team helps clients assess the strengths and weaknesses of their data governance and record retention practices, while harnessing the power of data to make strategic decisions and improve organizational performance.

We offer experienced counsel on the development and implementation of comprehensive information governance and data security programs and policies, along with training to boards of directors, executives, and employees on managing cybersecurity risks. We also conduct due diligence in connection with company mergers and acquisitions, including privileged and proprietary issues review and analysis.

Experience Highlights
  • Advised a midsized consumer retail services business on response to employee theft of personal information from company systems. Worked with the client’s IT department to identify access and attempted misappropriation of information and coordinated with law enforcement for potential prosecution and assessment of any breach notification.
  • Etc.
  • Etc.
  • Etc.
  • Robert W. Dibert Profile Image
    Robert W. Dibert

    Counsel

    Louisville, KY

Related Insights

Project Highlight: Bridge Street District, Dublin, OH | Government Services Team

September 23, 2022 | Experience

Frost Brown Todd’s government services team assisted the City of Dublin, OH, with a multi-phase ec...

Experience Highlights – Ohio | Government Services Practice Group

September 21, 2022 | Experience

Our government services team provides comprehensive support to a wide variety of clients, ranging fr...

business man Hand change wood cube block with percentage to UP and Down arrow symbol icon. Interest rate, stocks, financial, ranking, mortgage rates and Cut loss concept
Determining the Applicable Section 1202 Exclusion Percentage When Selling Qualified Small Business S...

May 13, 2022 | Blogs

When Section 1202 was enacted in 1993, a 50% gain exclusion applicable to the sale of qualified smal...

Time lapse vehicle light road
U.S. Supreme Court Gives Local Government Rare Win in Regulation of Billboards

April 29, 2022 | Publications

Background The U.S. Supreme Court delivered a long-overdue victory for local governments and their a...

Businessman man people woman
Enterprise Resource Planning in the Healthcare Realm: Overview and Vetting Insights

April 28, 2022 | Blogs

While many software trends come and go, systems integration continues to grow in scope and importanc...

Podcast Logo: "Data Privacy Detective"
Data Privacy Detective Podcast – Episode 86: Blockchain and Privacy – The First Imposition o...

April 26, 2022 | Blogs

Blockchain. Does it protect personal privacy? Is it a tool that can evade the law? How should we thi...