Cyber Incidents Call for Privacy Counsel and Litigation Counsel

Many companies, especially large ones, now have experienced and certified in-house privacy counsel devoted to cybersecurity and privacy.

However, if a cyber incident or breach occurs or is suspected, these in-house experts often rely on outside counsel to help them navigate the scenario.

Companies frequently hire the same firm to handle both the privacy and the litigation aspects of the matter. Hiring a lawyer or firm to do both, while sometimes appropriate in certain circumstances, can in other instances result in a dilution of the important skills needed in both areas.

Hiring separate counsel for litigation and privacy can create a formidable team that can serve your company well. Privacy counsel can focus on the many non-litigation legal issues that arise from a cyber incident while litigation counsel can rely on the subject-matter expert where necessary and focus more on the moving pieces and multi-front war that exists in the litigation realm.

When deciding on whether to hire the same or separate counsel for these two aspects, companies should consider:

1. Who is best qualified to handle the cybersecurity/privacy aspects of an incident or breach, and
2. Who is best qualified to represent the company with respect to mitigating, defending against, and perhaps even pursuing affirmative litigation claims on behalf of the company?

Choosing Litigation Counsel

Companies need outside counsel with extensive experience and expertise in litigation and ideally litigation counsel who is well versed in the language and understanding of cybersecurity and privacy principles.

Litigation counsel—working closely with privacy counsel—can focus on ensuring appropriate litigation holds are in place, preserving privilege (until such time where it may be prudent to waive it), and viewing steps taken by the company and privacy counsel through the lens of what those steps will look like if placed before a jury or other factfinder down the road.

In addition, litigation counsel responds to investigatory demands from and negotiates with regulators, handles inquiries and threats from potential plaintiffs, crafts the strategy on how to best defend the company, and evaluates whether there are other parties who the client should consider affirmatively pursuing for its role in causing the client’s damages.

Being able to effectively litigate a case, prepare it for trial, and if necessary, try it, are unique skills that take years to develop. While most companies would prefer to avoid trial, having trial counsel who is ready and willing to try the case is the best way to obtain the most favorable pre-trial resolution for the client.

With fewer cases being tried than in years past, finding high-quality litigation and trial counsel—who can be prepared to try a case if necessary—is becoming more challenging.

Choosing Privacy Counsel

Similarly, having both the deep and broad knowledge in ever-changing and increasing number of cybersecurity and privacy laws, both in the U.S. and worldwide, is an incredible undertaking. Companies can and should choose their privacy counsel carefully, paying close attention to their experience and certifications.

Outside counsel often retains forensic cybersecurity experts to investigate the technological issues and analyze what kind of reporting and notice requirements the company must consider and comply with.

Separate privacy counsel can focus on containing the threat, analyzing the affirmative obligations the company may have to notify regulatory authorities and others affected by the incident, and guiding the company through any changes to its policies and practices that are necessary in light of the incident.

Another reason for hiring separate litigation and privacy counsel is that privacy counsel can—if necessary—be an important witness to show that the company took adequate precautions and measures to prevent, contain, and redress any cyber incident. But being a witness can often disqualify that person from also representing the client in the matter where that witness’s testimony is needed.

But companies should choose their litigation counsel in a similar fashion: who is best positioned to strategically and effectively represent the company in litigation? Who can cut through the complex and nuanced issues and tell the client’s story to the judge or jury in a persuasive and compelling way?

Having separate litigation counsel from the beginning ensures that your company will not have to choose between having a helpful fact witness and having to replace trial counsel at an inopportune time.

This column does not necessarily reflect the opinion of The Bureau of National Affairs, Inc. or its owners.

Author Information

Anne M. Lockner, a partner at Robins Kaplan LLP, is a member of the firm’s executive board and a Certified Information Privacy Professional (CIPP/US and CIPP/E). She has extensive experience in handling and solving a broad array of problems for her clients in a variety of commercial litigation matters including healthcare litigation, internal and government investigations, privacy and data breach matters, financial fraud, breach of contract matters, antitrust matters, corporate structure matters, intellectual property matters, and insurance matters.