Publishing Law

If your company has data, it’s a target. Depending upon the industry, your company likely has legal requirements to develop and implement an adequate data security program to safeguard the confidentiality, integrity and availability of information and your company’s information systems. Data security programs include written policies and procedures, documented employee training, vendor oversight, and sometimes personal certification of compliance with a cybersecurity law or regulation by a C-Suite officer.

CPM assists clients with developing and implementing comprehensive data security and privacy programs to meet their legal needs under growing state and federal data protection laws and regulations, including the Health Insurance Portability and Accountability Act (HIPAA), the Health Information Technology for Economic and Clinical Health Act (HI-TECH Act), the Gramm-Leach-Bliley Act (GLBA), and the New York Department of Financial Services cyber regulations. We also help clients comply with the EU’s General Data Protection Regulation (GDPR) as well as the California Consumer Privacy Act (CCPA). Our lawyers help clients draft policies and procedures, including incident response plans, respond to requests for certification of compliance from regulators and business partners, conduct training and tabletop exercises, and establish third-party vendor management programs. Our lawyers also review technology contracts and transactions to strengthen our client’s interests and protection during the merger and acquisition process.

When an organization sustains a suspected cybersecurity incident they are required by law (or sometimes by contract, or both) to undertake a prompt investigation and provide notification of the incident in a short period of time. Sometimes, a company’s notification window is a mere 72 hours after knowledge of the event. CPM provides clients with critical crisis management to investigate and respond to cybersecurity incidents. From ransomware to data breaches, our lawyers work with forensic investigators to determine the “who, what, why and how” of an incident. We help companies with coordinated public relations efforts, potential interactions with law enforcement, and determination of required third-party notifications to consumers, business partners, regulators, State Attorneys General, and others.

A dispute involving a cybersecurity incident can devolve into litigation, whether a business-to-business lawsuit or a data breach class action. CPM represents corporations in a wide variety of business sectors in litigation in state and federal courts across the country. The firm’s approach to complex litigation matters is to staff them with senior litigators who assemble efficient teams.