Countdown to CCPA: An Interactive Compliance Workshop | December

Michael (Mike) Morgan is recognized as one of the nation’s leading lawyers in cybersecurity and data privacy. He has guided clients through some of the largest and most complex data breaches, breaches involving more than 50 million records, incidents affecting persons in over 100 countries around the world, and incidents involving sensitive defense-related information. He counsels clients on compliance with US and international regulations relating to cybersecurity and data privacy, including compliance with the California Consumer Privacy Act (CCPA), the EU’s General Data Protection Regulation (GDPR) and China’s Network Security Law. Mike leads the firm's Data, Privacy & Cybersecurity Group.

Mike has particular experience on complex legal issues arising from advanced technologies. He represents companies on privacy and cybersecurity issues arising from vehicle autonomy and connectivity and is an expert on the fast-changing regulatory environment relating to autonomous vehicles and in the US and around the world. He also advises clients on matters relating to international data transfers (e.g., EU model clauses and Privacy Shield), cryptocurrency, e-commerce security and blockchain applications. He represents clients in a range of industries, including financial services, big data, automotive, telecommunications, healthcare, insurance and automotive, as well as defense contractors and subcontractors subject to requirements under DFARS and the CMMC Framework.

Mike has handled scores of privacy and cybersecurity-related cases, including more than one hundred lawsuits involving claims under the Fair Credit Reporting Act (FCRA); unfair, deceptive or abusive acts and practice (UDAAP) statutes; and consumer protection statutes. He has particular expertise in the defense of cases involving claims for statutory damages and advises clients on mitigation of legal risks arising from the CCPA’s statutory damages provisions applicable to data breaches. He has defended against government investigations by the Federal Trade Commission, Consumer Financial Protection Bureau, Federal Communications Commission and state attorneys general. Mike is a Certified Information Privacy Professional (CIPP/US) by the International Association of Privacy Professionals (IAPP).

Amy C. Pimentel (CIPM) advises clients on the legal, regulatory, and governance challenges that arise at the intersection of privacy, cybersecurity, and technology. She helps organizations navigate evolving global requirements while developing practical strategies that enable innovation, manage risk, and support business growth. Amy is particularly skilled at translating complex legal and regulatory frameworks into operational solutions that work across jurisdictions, products, and business functions.

Amy serves as a strategic advisor to companies developing, deploying, and scaling technology-driven products and services. She counsels clients on artificial intelligence (AI) governance, data strategy, privacy compliance, cybersecurity, and digital product development, helping them harness emerging technologies responsibly and effectively. Working across industries — including health care and life sciences, technology, financial services, media/social media, and consumer products — Amy partners with legal, product, engineering, and executive teams to embed privacy, security, and responsible AI principles throughout the product lifecycle. Her practical, business-focused approach helps clients bring innovative products to market while navigating an increasingly complex regulatory environment.

In addition to regulatory and product counseling, Amy advises on technology, data, and cybersecurity issues in commercial transactions, outsourcing arrangements, strategic partnerships, and corporate transactions. She drafts and negotiates complex technology and data agreements, conducts privacy and cyber due diligence, and counsels clients on third-party risk management, data commercialization, security incidents, and regulatory investigations. By combining deep regulatory knowledge with a strong understanding of emerging technologies, Amy helps clients address today's challenges while preparing for the risks and opportunities of tomorrow.

Mark E. Schreiber focuses his practice on cybersecurity, data breach response, Payment Card Industry (PCI), global privacy coordination, and AI governance. He advises entities facing cross-border data protection, the General Data Protection Regulation (GDPR), privacy frameworks, strategic decisions, cyber assessments and investigations. Mark has led numerous multinational and cross-border matters and internal investigations, including those involving data breaches, data transfer and credit card/PCI matters. He has advised senior management, boards, and special board committees on a variety of investigations, including data breach prevention and response.

Mark has spoken around the world on topics related to data breaches and related defense litigation strategy, overlapping international data protection compliance, and other privacy topics. He has also given cyber, privacy, and AI presentations to delegations from some 80 countries during numerous State Department sponsored international visits. He helped found and was chair for over a decade of the Privacy and Data Protection Group of the World Law Group, an international affiliation of large law firms in some 65 countries, and received the “2012 World Law Group Practice/Industry Group Leader of the Year Award” in recognition of his privacy and data protection work, including managing two global data protection publications. In addition, Mark helped found and was co-chair of the Boston Bar Association’s Privacy Law Committee. He is also a Certified Information Privacy Professional (CIPP/US) and has given a variety of presentations for the International Association of Privacy Professionals (IAPP).

Mark has also practiced, written and lectured widely on topics related to employment law, including presentations to the Flaschner Judicial Institute for judges. Prior to entering private practice, he was the chief trial lawyer for the Massachusetts Commission Against Discrimination (MCAD).

Jessica (Jessi) McGahie Sawyer advises companies on global data protection laws, including privacy, cybersecurity risks, policies and incident responses, as well as data security obligations. She counsels clients on compliance with the EU General Data Protection Regulation (GDPR), US state and federal data protection statutes and regulations, including the Cybersecurity Maturity Model Certification (CMMC).

Jessi also helps companies implement cybersecurity and data privacy assessments, including assessments conducted under privilege, as well as preparation for third-party audits and certification, such as ISO 27001:2022 and CMMC. She provides incident response services, including handling some of the largest and most complex data breaches involving millions of consumer records. She also represents companies in various complex litigation, class actions and government investigations, including dozens of class actions resulting from data breach incidents.

Jessi maintains an active pro bono practice, focusing on obtaining asylum for unaccompanied children. In addition, she has represented pro bono clients in mortgage fraud cases and worked with the Coalition to Abolish Slavery and Trafficking to obtain T-visas for victims of human trafficking. Prior to attending law school, Jessi was a Los Angeles corps member of Teach for America, a national program in which recent college graduates commit to teach for two years in low-income schools.

Jessi regularly speaks on data privacy and protection, and cyber-related issues, including international data privacy frameworks.