McDermott Will & Schulte, a global law firm

Mike has particular experience on complex legal issues arising from advanced technologies. He represents companies on privacy and cybersecurity issues arising from vehicle autonomy and connectivity and is an expert on the fast-changing regulatory environment relating to autonomous vehicles and in the US and around the world. He also advises clients on matters relating to international data transfers (e.g., EU model clauses and Privacy Shield), cryptocurrency, e-commerce security and blockchain applications. He represents clients in a range of industries, including financial services, big data, automotive, telecommunications, healthcare, insurance and automotive, as well as defense contractors and subcontractors subject to requirements under DFARS and the CMMC Framework.

Mike has handled scores of privacy and cybersecurity-related cases, including more than one hundred lawsuits involving claims under the Fair Credit Reporting Act (FCRA); unfair, deceptive or abusive acts and practice (UDAAP) statutes; and consumer protection statutes. He has particular expertise in the defense of cases involving claims for statutory damages and advises clients on mitigation of legal risks arising from the CCPA’s statutory damages provisions applicable to data breaches. He has defended against government investigations by the Federal Trade Commission, Consumer Financial Protection Bureau, Federal Communications Commission and state attorneys general. Mike is a Certified Information Privacy Professional (CIPP/US) by the International Association of Privacy Professionals (IAPP).

See Less

• Advised a big data company on a 15 million-record data breach, including forensics, consumer notification, response to government investigations and defense of litigation
• Handled a series of data breaches involving personnel records of employees in the United States and more than 50 countries, including advice on compliance with notification obligations and communications with affected employees
• Handled the response to ransomware incident at a California hospital involving records for more than 250,000 patients, including overseeing the forensic investigation, defending the government investigation into the incident, advising on legal obligations (e.g., under HIPAA and state laws), managing the notification and communication program, and recommending remediation measures
• Handled responses to numerous incidents involving the compromise of patient information at hospitals and health providers, including overseeing the forensic investigation into the incidents, advising on legal obligations, advising on Bitcoin payment issues, preparing a notification and communication program, and recommending appropriate mitigation measures
• Represented an e-commerce company in a dispute with its technology provider relating to the adequacy of the security in the provider’s solution, including the encryption algorithm used to secure the transactions between the e-commerce company and its customers
• Advised numerous companies on responses to ransomware and phishing incidents, including preservation of privilege, coordination with law enforcement, retention of a forensics provider, advice on Bitcoin and cryptocurrency issues, communications with affected patients and regulators, and remediation and recovery from the incident
• Advised an international university regarding GDPR compliance, including the scope of application of the GDPR to activities in the EU, the lawful grounds for processing personal data (such as consent), appointment of a DPO, and various other GDPR compliance issues
• Advised a European telecommunications provider regarding GDPR compliance, including the scope of application of the GDPR to certain activities in the EU and the US, the lawful grounds for processing personal data and various other GDPR compliance issues
• Advised a multinational technology provider on certification of compliance with the US-EU Privacy Shield, data mapping, review and evaluation of internal and external policies and procedures, and vendor contract amendments to comply with Privacy Shield requirements

See Less

• Daily Journal, Top Cyber Lawyer, 2018, 2020 and 2022
• BTI Client Service All-Star, 2022

See Less