Lisa J. Sotto

• Testified before U.S. House of Representatives, "Data Protection and the Consumer: Who Loses When Your Data Takes a Hike?"
• Testified before U.S. Department of Health & Human Services' Subcommittee on Privacy and Confidentiality of the National Committee on Vital and Health Statistics regarding RFID use in health care.
• Testified before CSIS Commission on Cyber Security for the 44th Presidency.
• Briefed Congressional staffers in preparation for data breach hearings held by the House of Representatives Committee on Homeland Security, Subcommittee on Emerging Threats, Cybersecurity and Science and Technology, and in connection with drafting of comprehensive privacy bill.
• Requested by U.S. Government Accountability Office to participate in GAO study on data security breaches.
• Requested by U.S. Office of Management and Budget to participate in OMB analysis of DHS Privacy Office.
• Advising multiple clients on FTC, OCR and state Attorney General investigations and enforcement actions for alleged data security violations.
• Advised multiple clients on managing FTC Consent Order and FTC access letters in connection with data security incidents.
• Advising numerous major health care providers and other health plans on all aspects of HITECH security breaches, including OCR and state enforcement.
• Led HITECH Act breach notification effort for one of the largest PHI data breaches (1.2 million individuals).
• Advising two major retailers on security breaches resulting from criminal tampering of POS terminals, including U.S. Secret Service involvement, forensic investigations, all aspects of breach notification and PR efforts.
• Advised Texas State Comptroller in connection with well-known data security incident involving 3.5 million state workers.
• Advised major retailers on well-known data breaches, including managing FTC and Canadian DPA response and investigation, and consumer notification issues.
• Represented global leader in premium lifestyle products in FTC investigation regarding significant data security breach, including U.S. Secret Service involvement.
• Advised over 800 companies (including health care companies, retailers, consumer goods companies, insurers, utilities and industrial manufacturers) on all aspects of information security breaches and developed media and consumer communications programs following breaches.
• Advising numerous multinational clients on Safe Harbor certification and annual recertification.
• Counseled several Web 2.0 companies on data collection and sharing issues, and Safe Harbor certification.
• Counseled major consumer goods companies on privacy issues associated with the use of radio frequency identification (RFID).
• Advising numerous publishers and advertisers on online behavioral advertising issues.
• Advising multiple clients on employee and visitor monitoring and surveillance issues under federal and state laws, and preparing related policies (including personal computing device issues).
• Advising numerous clients on complex cloud computing solutions.
• Advising numerous clients on compliance with Payment Card Industry Data Security Standard and preparation of related policies and procedures.
• Advised multiple clients with FCRA and FACTA compliance.
• Conducted comprehensive privacy and information security policy assessment of major U.S. electric utility.
• Advised client on compliance with the Privacy Act, including preparation of a System of Records Notice and Privacy Impact Assessment, in connection with significant new government mortgage program.
• Conducted full-scale consumer information privacy assessments for one of the world's largest food companies and a Fortune 15 consumer goods company, including extensive data flow mapping, remediation, and development and implementation of multiple privacy, information security and records management policies and procedures.
• Represented leading information provider in developing new, company-wide privacy, credentialing and compliance program.
• Advising numerous clients on privacy requirements under GLB, HIPAA, HITECH and state law, and preparing related documentation.
• Served as HIPAA privacy counsel to large health care system, including over 40 hospitals and long-term care and assisted living facilities, and major academic medical center.
• Prepared HIPAA and HITECH policies and procedures (including training) for numerous employer-sponsored group health plans.
• Developed and implemented comprehensive global records management program in over 100 countries for one of world's largest software companies, including preparation and implementation of policies and procedures, numerous records retention schedules, in-person and web-based training and audit program.
• Outside counsel to leading U.S. mutual fund company, financial services provider and commercial and consumer finance company to develop omnibus records management program.
• Outside counsel to major U.S. government agency on new initiative to develop agency-wide, comprehensive records management program.
• Drafted numerous website Terms of Use. 

Books

• Editor and Lead Author, Privacy and Data Security Law Deskbook (1,400-page treatise), Aspen Publishers, Wolters Kluwer Law & Business, 2010
• Co-author, Chapter 11 European Union Data Protection, Data Security and Privacy Law: Combating Cyberthreats, West, Thomson Reuters, 2008
• Co-author, Data Security Handbook, ABA Section of Antitrust Law, 2008
• Co-author, Privacy Primer: An Overview of Global Data Protection Laws, 2006

Media Appearances

• Law360, Q&A with Hunton & Williams' Lisa Sotto (Sotto interviewed), November 4, 2011
• KUCI 88.9 FM, Protect Your Privacy in the Information Age (Sotto featured in 30-minute interview), September 19, 2011
• FoxLive.com, Is There Need for a Data Privacy Law? (Sotto interviewed), September 6, 2011
• Bank Information Security Podcasts, Epsilon Breach: Risks and Lessons; Incident is a Wake-Up Call about Database Security Gaps (Sotto interviewed), April 5, 2011
• End to End Trust, Microsoft Corporation, regarding cross industry collaboration and a safer Internet (Sotto interviewed), September 2009
• CNN's American Morning, Privacy in the Obama Administration (Sotto interviewed), December 8, 2008
• ClearChannel Radio, "Tech Talk with Craig Peterson," regarding the use of RFID in health care (Sotto interviewed), March 4, 2006