Jeff has experience representing clients in myriad privacy and information security matters, such as US privacy law advice, cross-border data flows, data security and breach notification, marketing and consumer protection.

Jeff advises clients on compliance with US federal and state privacy and information management requirements, as well as international data protection laws. He advises on issues related to financial and health privacy, data transfers and the application of US privacy regulations to new technologies, including mobile apps and cloud coverage. Prior to joining the firm, Jeff was an associate in the privacy group of a global law firm and previously served as an investigator for the Office of Civil Rights in the US Department of Health and Human Services, where he managed investigations implicating the Privacy, Security, and Breach Notification of HIPAA and HITECH, negotiated mandated corrective action with organizations, and conducted breach reviews covering such issues as theft, loss and unauthorized access to information.

Relevant Experience

• Represents clients on a wide range of privacy laws and standards, including GLB, FCRA, PCI-DSS, CAN-SPAM, state breach notification laws, and the EU GDPR
• Assists financial institutions in complying with privacy and information security requirements, including those under the Gramm-Leach-Bliley Act and various international laws
• Advises clients on complying with the HIPAA Privacy Rule and HIPAA Security Rule, including drafting comprehensive HIPAA privacy and security policies and procedures
• Prepares internal (e.g., policies and procedures, employee privacy notices) and consumer-facing (e.g., consent forms, privacy policies, cookie statements) documents
• Provides advice to numerous clients on new product development and technology initiatives
• Represents clients with transfers of consumer and employee data through data transfer agreements and cross-border mechanisms (e.g., Privacy Shield, model contracts) and reviewing broader commercial contracts (e.g., SaaS agreements, master service agreements)
• Represents clients on security incident and breach response, including providing guidance on forensic investigations, analyzing US state and federal and non-US breach laws, and preparing notifications to individuals and authorities
• Assists corporate clients in evaluating cybersecurity risks in connection with potential business acquisitions
• Advises clients on FTC, SEC and state attorney general investigations and enforcement actions for alleged data security and privacy violations

Bar Admissions

Education
JD, University of Chicago Law School, 2013BA, The Ohio State University, 2010