The following is an excerpt from Practice Perspectives: Vault's Guide to Legal Practice Areas.
Danielle Dobrusin is counsel with Hunton’s global privacy and cybersecurity practice and advises clients on compliance with U.S. federal and state and international privacy and data security laws. Danielle regularly works with clients in developing privacy compliance programs designed to satisfy applicable obligations under all U.S. federal and state privacy and information management requirements, including comprehensive state consumer privacy laws, such as the California Consumer Privacy Act of 2018, and other emerging privacy legislation. She works with clients to revise online privacy notices, implement processes to respond to consumer rights requests, and amend vendor contract templates to comply with new regulations. In addition, Danielle particularly focuses counseling on compliance with the federal Children’s Online Privacy Protection Act and state children and teen privacy and social media laws. Danielle also assists clients with privacy-related issues in the AI and ad tech spaces.
Describe your practice area and what it entails.
Hunton’s top-ranked global privacy and cybersecurity practice helps companies manage data and mitigate risks at each step of the information life cycle. We advise clients in identifying, evaluating, and managing complex global privacy and information security risks and compliance issues. We advise clients on U.S. state and federal and international privacy laws and help them practically apply the requirements of these laws. The counsel can range from one-off questions requiring analyses of legal requirements with respect to certain use cases to full-scale holistic compliance programs. It can also include responding to and managing regulatory inquiries and investigations with respect to privacy matters.
We also counsel companies on managing risk in connection with leading-edge and innovative technologies, such as AI and machine learning. We frequently work with local counsel in myriad jurisdictions to provide global services to our clients. For cybersecurity matters, we advise large, multinational companies on all aspects of catastrophic cybersecurity incidents, including providing strategic and legal advice on investigating and remediating the incident; fulfilling their data breach notification responsibilities; responding to multi-juris-dictional regulatory investigations; and managing inquiries from customers, business partners, media, and regulators.
What types of clients do you represent?
We represent a diverse group of clients of all sizes, including retailers, consumer goods companies and manufacturers, energy companies and utilities, technology companies, financial institutions and private equity firms, fintech startups, insurance providers, healthcare providers, media companies, hospitality and gaming companies, and government agencies. Data privacy and security are critical to all types of industries.
What types of cases/deals do you work on?
We advise clients on
- Compliance with all U.S. federal and state privacy and cybersecurity requirements and international data protection laws.
- Cybersecurity and data breach incident response.
- Drafting and negotiating complex privacy and data security provisions and indemnities in vendor agreements, including complex data transactions.
- Managing federal, state, and international regulatory inquiries in connection with alleged privacy and data security violations.
- Evaluating cybersecurity and privacy risks and negotiating purchase agreements in connection with potential M&A and other corporate transactions.
- AI governance and other cutting-edge technology issues.
- Cross-border data transfer strategies.
- Designing and evaluating privacy impact assessments.
- Developing and enhancing comprehensive records management programs.
- Information product life cycle issues, including marketing and analytics activities.
How did you choose this practice area?
I would say that I was very fortunate to fall into this practice area. When I started as a summer associate at Hunton, I had little sense of what type of law I wanted to practice. Brittany Bacon, who is a partner on the privacy team, quickly took me under her wing. The assignments she gave me were exciting and challenging. I think one of the first ones was analyzing use of facial recognition technologies in retail locations. Because this is such a new and rapidly evolving area of the law, I felt like the work I was doing was meaningful and I could add value and expertise even while at a junior level.
What is a “typical” day like and/or what are some common tasks you perform?
No two days look the same! One of the exciting things about this practice area is that the work is constantly changing depending on the client and project at hand. I would say most days involve some combination of getting to speak directly with clients on calls, responding to “quicker” one-off questions via email, brainstorming, problem-solving with partners on my team, and mentoring and providing feedback to more-junior associates.
What training, classes, experience, or skills development would you recommend to someone who wishes to enter your practice area?
Privacy and cybersecurity continue to be top focus areas among companies and in-house counsel. As a result, there are a number of resources available to learn about this practice area. Follow the news and various industry publications and learn as much as possible. Additionally, I encourage law students and lateral associates to subscribe to Hunton’s Privacy and Cybersecurity Law blog, which we update on a near-daily basis with news items and analysis. Our team has also published a privacy and cybersecurity law treatise, updated annually, which provides a comprehensive primer on U.S. and international privacy and data protection laws. Organizations such as the International Association of Privacy Professionals are great resources as well.
What is the most challenging aspect of practicing in this area?
I think the most challenging aspect of this practice area is that it is rapidly evolving. The U.S. privacy landscape looks entirely different now from when I started; there has been an avalanche of state consumer privacy laws and other state privacy laws related to specific topics such as minors’ and children’s privacy, health privacy, biometric data, and AI. It is not uncommon to spend a week drafting a detailed and complicated memo and then have a new law or regulatory action come out that materially changes the analysis. It is critical to constantly stay on top of recent developments.
What do you like best about your practice area?
Because privacy law is always changing, it means that there are endless opportunities to grow. This is a fantastic practice area for someone who is driven and wants to take initiative. Even as a junior associate, you can become your team’s go-to expert on a specific law or topic. You will never be bored as a privacy attorney!
How do you see this practice area evolving in the future?
It is hard to predict exactly how this practice area will evolve because so much of it depends on how technology evolves and is used. Lawmakers tend to pass laws reactively, and businesses continue to innovate, so there will constantly be new laws and regulations in this area. I certainly see the need for privacy and cybersecurity attorneys continuing to grow.
What kinds of experiences can summer associates gain in this practice area at your firm?
When we work with summer associates, we treat them as true members of our team and rely on them for substantive work. Summer associates frequently contribute to Hunton’s Privacy and Information Security Law blog, participate in client calls, assist with data breach incident response, conduct research, and compile charts comparing key requirements under various privacy and security laws.