Kevin L. Coy

Kevin is a partner and co-chair of the Privacy & Cybersecurity practice. He is also a member of the Background Screening, Emerging Technologies, Life Sciences, and Payments Systems & Fintech industry teams. Kevin has an established reputation for advising organizations as they consider domestic and international privacy law and policy matters. As security is critical to a successful business environment, Kevin counsels organizations about protecting personal information (including criminal history and other public record details, credit and financial data, health information, and employee data). Kevin’s legal advice also addresses online privacy issues, privacy issues related to artificial intelligence and other emerging technologies, developing privacy notices and statements, implementing privacy compliance programs, negotiating data protection agreements, and conducting privacy due diligence for corporate transactions. When data security and breach notification issues arise, he guides clients through their responses to data security incidents.

Kevin also advises on matters related to the Fair Credit Reporting Act (“FCRA”) and other consumer reporting and background screening issues, the Gramm-Leach-Bliley Act (“GLBA”), and Section 5 of the FTC Act, as well as data privacy, data security, and data breach issues. He assists clients through HIPAA’s privacy, security, and data breach regulations and helps them navigate related matters before the Department of Health and Human Services Office of Civil Rights. He advises companies on other U.S. privacy and data security laws and regulations, including but not limited to the Driver’s Privacy Protection Act, the Telephone Consumer Protection Act, and state privacy laws, such as the California Consumer Privacy Act, the Virginia Consumer Data Protection Act, and the growing list of other similar state laws, as well as state biometric and artificial intelligence laws.

Also knowledgeable in international matters, Kevin manages transborder data flow issues and matters with the European Union General Data Protection Regulation (“GDPR”) and other foreign privacy laws and regulations. Kevin also advises clients on international data transfer issues and strategies, including the use of standard contractual clauses and participation in the EU/U.S. Data Privacy Framework and related UK and Swiss programs.