McDermott Will & Schulte, a global law firm

Michael (Mike) Morgan is recognized as one of the nation’s leading lawyers in cybersecurity and data privacy. He has guided clients through some of the largest and most complex data breaches, breaches involving more than 50 million records, incidents affecting persons in over 100 countries around the world, and incidents involving sensitive defense-related information. He counsels clients on compliance with US and international regulations relating to cybersecurity and data privacy, including compliance with the California Consumer Privacy Act (CCPA), the EU’s General Data Protection Regulation (GDPR) and China’s Network Security Law. Mike leads the firm's Data, Privacy & Cybersecurity Group.

Mike has particular experience on complex legal issues arising from advanced technologies. He represents companies on privacy and cybersecurity issues arising from vehicle autonomy and connectivity and is an expert on the fast-changing regulatory environment relating to autonomous vehicles and in the US and around the world. He also advises clients on matters relating to international data transfers (e.g., EU model clauses and Privacy Shield), cryptocurrency, e-commerce security and blockchain applications. He represents clients in a range of industries, including financial services, big data, automotive, telecommunications, healthcare, insurance and automotive, as well as defense contractors and subcontractors subject to requirements under DFARS and the CMMC Framework.

Mike has handled scores of privacy and cybersecurity-related cases, including more than one hundred lawsuits involving claims under the Fair Credit Reporting Act (FCRA); unfair, deceptive or abusive acts and practice (UDAAP) statutes; and consumer protection statutes. He has particular expertise in the defense of cases involving claims for statutory damages and advises clients on mitigation of legal risks arising from the CCPA’s statutory damages provisions applicable to data breaches. He has defended against government investigations by the Federal Trade Commission, Consumer Financial Protection Bureau, Federal Communications Commission and state attorneys general. Mike is a Certified Information Privacy Professional (CIPP/US) by the International Association of Privacy Professionals (IAPP).

Mark E. Schreiber focuses his practice on cybersecurity, data breach response, Payment Card Industry (PCI), global privacy coordination, and AI governance. He advises entities facing cross-border data protection, the General Data Protection Regulation (GDPR), privacy frameworks, strategic decisions, cyber assessments and investigations. Mark has led numerous multinational and cross-border matters and internal investigations, including those involving data breaches, data transfer and credit card/PCI matters. He has advised senior management, boards, and special board committees on a variety of investigations, including data breach prevention and response.

Mark has spoken around the world on topics related to data breaches and related defense litigation strategy, overlapping international data protection compliance, and other privacy topics. He has also given cyber, privacy, and AI presentations to delegations from some 80 countries during numerous State Department sponsored international visits. He helped found and was chair for over a decade of the Privacy and Data Protection Group of the World Law Group, an international affiliation of large law firms in some 65 countries, and received the “2012 World Law Group Practice/Industry Group Leader of the Year Award” in recognition of his privacy and data protection work, including managing two global data protection publications. In addition, Mark helped found and was co-chair of the Boston Bar Association’s Privacy Law Committee. He is also a Certified Information Privacy Professional (CIPP/US) and has given a variety of presentations for the International Association of Privacy Professionals (IAPP).

Mark has also practiced, written and lectured widely on topics related to employment law, including presentations to the Flaschner Judicial Institute for judges. Prior to entering private practice, he was the chief trial lawyer for the Massachusetts Commission Against Discrimination (MCAD).

Daniel F. Gottlieb counsels a wide range of healthcare industry clients, including healthcare providers, health plans, health information technology vendors, life sciences companies and data aggregators. He is sought out for his legal knowledge and practical approach on data protection, interoperability, and complex data and software licensing transactions, collaborations and strategic initiatives.

Daniel counsels healthcare clients regarding compliance with US federal and state and international privacy, security, breach notification and information blocking laws, including the Health Insurance Portability and Accountability Act (HIPAA), 21st Century Cures Act, California Consumer Privacy Act (CCPA), Telephone Consumer Protection Act, CAN-SPAM and EU General Data Protection Regulation (GDPR). He offers guidance on the intersection of privacy and security requirements with information blocking prohibitions under the 21st Century Cures Act and Medicare rules impacting the deployment of health information technology.

Daniel has deep experience regarding requirements for de-identification, anonymization and other secondary uses of health information under HIPAA, CCPA and GDPR. Daniel regularly advises clients regarding their response to cyberattacks and other security breaches, and defends against subsequent investigations by state regulators and the US Department of Health and Human Services Office for Civil Rights.

He advises healthcare clients on all aspects of data and software licenses and other agreements for the acquisition of electronic health record (EHR) systems and other mission-critical health IT and health content. He drafts and negotiates hosting, cloud computing and IT service agreements, as well as license agreements for health data and other health content.

Daniel assists with compliance program implementations, compliance audits, and government program overpayment and refund matters, including drafting billing compliance policies and procedures. He also counsels clients on compliance with Medicare and Medicaid reimbursement, fraud and abuse laws; the PhRMA Code on Interactions with Health Care Professionals; and the AdvaMed Code of Ethics on Interactions with Health Care Professionals.

Dr. Claus Färber represents clients on all legal matters related to the telecommunications, media and information technology (IT) industries and has extensive experience advising international clients across industries on European data protection matters.

Claus drafts and negotiates software license agreements, other IT contracts, business process outsourcing agreements and significant procurement agreements in the telecommunications, ecommerce and IT industry, and assists with significant litigation in these industries. These projects often break new ground from a technological, commercial and legal perspective and regularly touch multiple sectors of the law, including telecommunications, IT, intellectual property and data protection law, and also require an understanding of the economic and technological background. His transactional experience includes major cooperation and framework agreements, such as internet access in aircraft, Wi-Fi hotspots, roaming, cloud platforms and machine-to-machine communications (M2M).

Claus also regularly advises life sciences companies, colleges and universities, academic medical centers and other organizations collecting and processing personal health data regarding compliance with the European Union’s General Data Protection Regulation (GDPR) and German data protection law, including applicability to companies established outside the European Union and requirements for the international transfer of personal data to the U.S.