The following is an excerpt from Practice Perspectives: Vault's Guide to Legal Practice Areas.
Lauren Tsuji represents clients facing consumer class actions with a focus on privacy and data security litigation. She routinely litigates disputes involving the Illinois Biometric Information Privacy Act, the California Invasion of Privacy Act, the Stored Communications Act, the Video Privacy Protection Act, and other state and federal privacy and consumer protection statutes.
Lauren has managed all stages of civil litigation, including discovery, briefing and arguing dispositive motions, and trial preparation, and has represented clients in jury trials for patent infringement, resulting in findings of non-infringement and invalidity. In addition to her litigation practice, Lauren counsels clients on compliance with privacy and data protection laws, including laws addressing the collection and use of biometric data, and issues related to government surveillance and demands for user information.
In her pro bono practice, Lauren represents survivors of domestic violence in restraining order proceedings and litigates to defend the privacy rights of victims and witnesses in felony domestic violence and sexual assault cases.
Lauren is dedicated to building an inclusive and intersectional community and supporting women lawyers of color and serves as Co-chair of the Women of Color Resource Group at Perkins Coie.
Describe your practice area and what it entails.
I defend clients in privacy-related consumer class actions, including cases seeking novel applications of laws such as the Illinois Biometric Information Privacy Act, the California Invasion of Privacy Act, and the Video Privacy Protection Act. I also represent online service providers in opposing civil and criminal requests for records stored on behalf of users, such as subpoenas, court orders, and search warrants, that would violate the Stored Communications Act or Fourth Amendment. Pro bono work is also an important part of my practice, and I regularly litigate cases involving the privacy rights of survivors and witnesses of sexual assault and domestic violence.
What types of clients do you represent?
My clients are mostly industry-leading global technology companies, including Google, Microsoft, and Amazon. I also represent smaller technology firms and companies offering consumer-facing products and services online.
What types of cases/deals do you work on?
The cases I handle are diverse, but most are class action lawsuits challenging some aspect of a company’s use of consumer data. For instance, I am currently defending cases involving claims about what constitutes unlawful collection or possession of biometric data, a case challenging a company’s alleged use of a dataset to improve facial recognition technology, and a case challenging a company’s alleged use of cookies and other tracking technologies on its website. Beyond litigation, I also advise clients on designing products, services, and websites to comply with data privacy laws and minimize litigation risk.
How did you choose this practice area?
After graduating from law school, I started my legal career practicing patent litigation at another firm. I loved learning about complex technologies and working with innovative clients to understand their products and services, but I craved greater variety in the types of cases I was working on. When I joined Perkins Coie as a lateral associate, I quickly found privacy litigation to be a natural fit, as it allowed me to combine my interest in technology with a desire to address issues relevant to our digital society. The cases I get to work on are high-stakes, impactful, and intellectually stimulating, and I am fortunate to have some of the brightest minds in the industry as my colleagues.
What is a “typical” day like and/or what are some common tasks you perform?
One of the aspects I love most about my practice is that there is no “typical” day. Each case presents unique challenges and opportunities to learn about different facts, laws, and jurisdictions, and no case is the same. As a partner, my work involves strategizing about the best way to position my clients for successful litigation outcomes by, for example, figuring out what defenses to raise to eliminate or narrow the claims at the outset, how to maximize efficiencies in discovery, how to defeat class certification and position the claims for summary judgment, and whether and when to consider settlement. A typical day might involve meeting with my case teams to discuss strategy; supervising associates on legal research; reviewing and revising legal briefs; meeting with expert witnesses, product managers, and engineers to understand the technologies at issue; and negotiating with opposing counsel. Depending on the status of the cases I’m working on and where they are procedurally, I might also be preparing corporate witnesses for depositions, arguing motions in court, or working on an appeal.
What training, classes, experience, or skills development would you recommend to someone who wishes to enter your practice area?
For aspiring privacy litigators, critical thinking, organization, and strong legal research and writing skills are essential. While substantive knowledge of privacy law is beneficial, it’s more important to be curious, willing to learn, and capable of producing high-quality written work. I recommend seeking opportunities to practice legal research and writing through classes, extracurriculars, and internships. For me, participating in a law school clinic was invaluable. In addition to those skills, it taught me case and client management and helped me find my voice as a lawyer.
What is the most challenging aspect of practicing in this area?
The most challenging aspect of privacy litigation is also what makes it the most exciting: That is, the landscape is constantly changing. Governments and regulators are increasingly focused on privacy and are enacting new laws in this space every day. Private litigants are always exploring ways to expand existing laws to cover new technologies they were never intended to reach. This requires staying current on legal developments and tracking evolving trends in class actions, which can be challenging to balance with day-to-day work. However, it also provides opportunities to think creatively and litigate issues of first impression, which makes it deeply rewarding.
What is unique about your practice area at your firm?
Perkins Coie has one of the country’s largest, most longstanding, and most experienced privacy and data security groups. What makes our group unique is that we cover a broad range of subspecialties. For example, in my litigation practice, I often collaborate with colleagues who are leading experts in security breach response, cybercrime, and regulatory investigations. We also have the nation’s preeminent Electronic Communications Privacy Act practice representing online communications companies in responding to requests for user data. So, in addition to defending my clients in litigation, I can connect them with other lawyers who can help design their privacy programs to avoid litigation in the first place.
What are some typical tasks that a junior lawyer would perform in this practice area?
The junior associates I work with are given a lot of responsibility. It’s not uncommon for first- or second-year associates to draft dispositive briefings or argue motions in court. For example, this week, I’m working with junior associates on drafting an answer and affirmative defenses to a class action complaint, revising a mediation brief, identifying documents for an upcoming deposition, and drafting an opposition to a motion to compel in a pro bono case.
How do you see this practice area evolving in the future?
Generative AI and related technologies are set to revolutionize the practice of law, and privacy litigation is no exception. Among other things, these technologies will help us stay updated on the latest legislation, summarize and predict trends in case law, and assist clients in making informed, data-driven decisions using fewer resources. At the same time, the collection and use of data to train these systems— especially personal data—will give rise to new types of privacy-related legal claims and regulatory risks.