Brittany M. Bacon

Brittany advises clients in identifying, evaluating and managing complex global privacy and information security risks and compliance issues.

Brittany  Bacon is a partner in the firm’s top-ranked global privacy and cybersecurity practice. She has national recognition for her work in the areas of privacy and data security. Brittany is ranked in Chambers USA, Chambers Global and Legal 500, and was named a New York Law Journal “Rising Star,” a Law360 “Rising Star” in privacy and cybersecurity, and one of Global Data Review’s 40 Under 40 data lawyers. Chambers USA quotes clients who call her “very diligent, intelligent and hard-working” and “very client-focused, attentive and responsive.” Chambers USA also quotes a client who calls her “one of the very best individuals I have worked with on privacy-related matters.” Legal 500 refers to Brittany as “the best at what she does,” recommending her for cyber law (including data privacy and data protection) and fintech.

Brittany assists clients in identifying, evaluating and managing a panoply of global privacy and information security risks and compliance issues. A significant aspect of her practice is advising large, multi-national companies on catastrophic cybersecurity incidents. Brittany served as a lead attorney on the two largest reported breaches in history (affecting over three billion user accounts) and has managed hundreds more. Her cybersecurity practice includes advising clients on data breach notification responsibilities; counseling them on responding to multi-jurisdictional regulatory investigations; and providing strategic advice in the breach context for managing ransomware attacks, as well as inquiries from Boards of Directors, consumers, media and potential acquiring companies in a deal setting. Brittany also helps companies design and build privacy and data security governance programs and conduct proactive breach preparedness activities, including developing workable incident response plans and legal breach notification procedures, ransomware playbooks and legal primers, running executive-level tabletops with data breach hypotheticals, and engaging third-party experts (such as forensic investigation firms, ransomware specialists, credit monitoring services, PR firms and call centers) in advance of an incident.

In relation to her privacy compliance practice, Brittany advises clients on the California Consumer Privacy Act of 2018, GLB, CAN-SPAM, and other U.S. state and federal privacy requirements, and global data protection laws (including those in the EU, Asia and Latin America). She routinely conducts privacy impact assessments and advises companies on managing risk in connection with extensive and innovative data collection and use, including with AI and machine learning technologies. She also regularly negotiates privacy and data security provisions of complex commercial and technology-related contracts and helps companies design robust vendor management programs.

Relevant Experience

• Advised dozens of companies (including in the gaming and hospitality, health care, retail, energy, consumer goods, and financial services industries) on data breach and cybersecurity incident response, including preparation of required notifications pursuant to state breach notification laws, the HITECH Act and Interagency Guidance, call center training and development of media strategies.
• Advised a technology company in all aspects of responding to the two largest reported data breaches affecting more than 3 billion user accounts.
• Advises a world-renowned casino and hospitality company on all aspects of its comprehensive global privacy and data security program, including managing its CCPA and GDPR compliance efforts, developing a global data inventory, conducting privacy impact assessments, negotiating complex vendor agreements, advising on initiatives involving facial recognition technology and AI/machine learning, directing cybersecurity audits, updating and enhancing information security policies and standards, developing incident response plans and conducting executive-level tabletops.
• Counsels one of the world’s largest investment companies on data breach preparedness activities, including developing legal-focused incident response plans and a ransomware playbook and conducting c-suite level cybersecurity tabletops, and advising the company on global privacy compliance matters.
• Advises an independent consultant ordered by the SEC to review global bank’s compliance with federal securities laws in connection with operating alternative trading systems.
• Advises a leading global alternative asset manager and its portfolio companies on US and EU data protection matters, including designing global marketing campaigns and HR privacy handbooks, as well as incident response.