Mary J. Hildebrand CIPP/US/E

Mary J. Hildebrand CIPP/US/E, partner and Chair of Lowenstein’s Privacy & Cybersecurity group, comments in TechRepublic on the risk of ransomware to startup and midsize healthcare companies, observing that there is no “one-size-fits-all” solution. "For every organization that adamantly refuses to cooperate, there is another one that weighs the relative costs of non-compliance in terms of interrupted healthcare, costs, expenses and reputational risk, against the amount demanded, and decides to wire the funds," she says.

In a second TechRepublic article on the subject, she addresses disclosure requirements under HIPPA when ePHI (electronically protected health information) is compromised. "OCR argues that ePHI was acquired during the encryption process, unless the covered entity that was attacked can prove otherwise," she says. "As any healthcare organization that has wrestled with this issue can tell you, this is a high bar to meet." Hildebrand recommends being prepared with a disaster recovery plan that “includes data back-ups, applications, infrastructure/cloud capacity, and appropriately skilled staff,” and keeping messages to employees and patients “brief, factual, and timely.”

Lowenstein's representation of W2O, the leading independent provider of analytics-driven, digital-first marketing communications to the health care sector, in the acquisition of Arcus Medica, a recognized leader in medical and scientific communications, highlighted in the Global Legal Chronicle. The Lowenstein deal team included David L. Goret, Marita A. Makinen, Andrew P. Erdmann, Matthew Tippy, Eugene R. Cheval, Tracy F. Buffer, Michael Walutes, Sophia Mokotoff, Megan Monson, Matt Savare, Bryan Sterba, Mary J. Hildebrand, Manali Joglekar, Carly S. Penner, Amy Komoroski Wiwi, and James C. Shehan. View Lowenstein's news announcement about this transaction.

Mary J. Hildebrand is featured in an article on TVNewsCheck spotlighting her presentation at the conference Media Outlook 2020, which expanded upon an article written by Hildebrand and Carly S. Penner for the Media Financial Management Association’s magazine, The Financial Manager. Hildebrand explains how the United States differs from Europe and certain other countries in that it does not have a set of federal laws addressing privacy and cybersecurity generally and that federal laws here are industry-specific. Although the Federal Trade Commission is the de facto regulator of many online activities, including privacy and security standards, companies must now consider 50 different state data breach laws, plus Guam, Puerto Rico, and the Virgin Islands. California and Nevada have also adopted comprehensive data protection laws, and more states are considering similar legislation. Hildebrand recommends that businesses focus on five issues in the coming year:

1. New state laws, like California’s CCPA and Nevada’s new data protection law;
2. Creating a formal written incident response plan in case of a data breach, including appropriate training and cyber insurance;
3. Updating privacy policies to be clear, concise, and transparent about personal information collected, the purpose of collection, and how it is used and shared; the use of cookies and third-party analytics providers; and include statements required by state data protection laws such as California and Nevada;
4. Understanding sales and marketing departments’ collection, use, and sharing/sale of personal information; and
5. Developing an inventory of personal information collected, used, and shared across the organization.

Mary J. Hildebrand, Chair of the Privacy & Cybersecurity group, is quoted in Compliance Week in an article on how state laws are filling in the federal privacy data void and why New York State's privacy legislation is important. She says it puts “more companies at issue since it includes far more companies under its jurisdiction. State law also allows private causes of action for violating the New York Privacy Act, although New York might make the individual litigant prove damages.” Hildebrand adds that “[c]ompanies seeking to comply [with the New York Privacy Act] will be confronted by complexity and entirely new (and ill-defined) concepts such as ‘data fiduciary’ and ‘privacy risk’ … [and that] in any merger or acquisition that involves the transfer of personal data associated with a New York state resident, affirmative consent to the transfer must be obtained from each New York resident before the transfer is permitted to occur.”

The PE Hub Network, The Deal, and Law360 (December 12, 2018; January 24, 2019) note Lowenstein Sandler as lead counsel to Cerberus Capital Management, L.P. in its acquisition of Sparton Corporation (NYSE: SPA). (Lowenstein deal team: Marita A. Makinen, Robert G. Minion, Jeffrey Blumenfeld, Mary J. Hildebrand, Nicholas G. Mehler, Christine Osvald-Mruz, Matt Savare, Jeffrey M. Shapiro, James C. Shehan, Michael Walutes, Jack Sidorov, Norman W. Spindel, Stuart S. Yusem, Manali Joglekar, Sabrina Cua, Allison Gabala, Megan Monson, Alex H. Rosenthal, Bryan Sterba, Matthew Tippy, Lauren E. Killeen, and Lauren M. Troeller.) (subscription required to view certain content) View Lowenstein’s news announcement about this transaction.

Lowenstein Sandler is noted as lead counsel to Vesey Street Capital Partners, LLC (VSCP) in their recapitalization of Elite Body Sculpture as published in The PE Hub Network, Cision PR Newswire, and The Business Journals (Lowenstein deal team: Marc B. Kramer, Brooke A. Gillar, Steven E. Siesser, Lowell A. Citron, Michael Walutes, Lesley P. Adamo, Eileen Overbaugh, Elisia M. Klinka, Nicholas Gonski, Darren Goodman, Megan Monson, Eric Jesse, Alanna Sandoval, Jeffrey M. Shapiro, Jack Sidorov, Mark P. Kesslen, Paul M. Krueger, Michael A. Buxbaum, Norman W. Spindel, Mary J. Hildebrand, Bryan Sterba, Manali Joglekar, and Stuart S. Yusem.)

The Buffalo Law Journal notes Lowenstein Sandler as counsel to a company discussing its General Data Protection Regulation (GDPR) compliance efforts. The article quotes Mary J. Hildebrand, who notes many companies’ confusion as to whether and why GDPR applies to them. Hildebrand explains that GDPR has expanded the definition of personal data, that it applies depending on where data is processed (not just on where it “sits”), and that GDPR compliance obligations will involve careful judgment calls.

Mary J. Hildebrand comments in Law360 on the risks created by an expanded definition of personal data under the General Data Protection Regulation (GDPR).

In Bloomberg BNA, Mary J. Hildebrand comments on enhanced compliance obligations imposed on data processors once the General Data Protection Regulation (GDPR) takes effect on May 25, 2018.

Mary J. Hildebrand comments in Law360 regarding the FTC's stance on collecting geolocation data from cellphones without explicit consent.

Mary Hildebrand comments in POLITICO Pro on the U.S. government's political stance regarding the EU-U.S. Privacy Shield pact.

Mary Hildebrand is quoted in LegalTech News on the UK's data protection authority's enforcement of cybersecurity standards.

Mary Hildebrand comments in POLITICO Pro's Europe Brief on the first legal challenge against the EU Privacy Shield data transfer agreement.

Mary Hildebrand is quoted in The Cybersecurity Law Report on the importance of proper cyber due diligence and how companies can mitigate cyber risks.

Mary Hildebrand comments in an SC Magazine article on a decision by the U.S. Sixth Circuit Court of Appeals granting victims of the Nationwide Insurance data breach standing to sue.

Mary Hildebrand comments in The Wall Street Journal on a decision by the Ninth Circuit Court of Appeals in AT&T Mobility v. Federal Trade Commission, which held that the FTC does not have jurisdiction over common carriers, clouding privacy regulations for telecommunications, cable, and internet companies.

Mary Hildebrand comments in SC Magazine on adoption rates for the Privacy Shield among companies that transfer data from the EU to the U.S.

Mary Hildebrand gets the last word in a Law360 article on the Privacy Shield and what U.S. companies can expect over time.

Mary Hildebrand is quoted in The Wall Street Journal regarding the European Union's decision to adopt the Privacy Shield agreement.

Mary Hildebrand has been recognized as a power player and one of the top 10 women in the IT security space by SC Magazine for her thought leadership on privacy and IT security. She shares this honor with top female executives from Microsoft, Google, Uber, and other cutting-edge tech companies.

Mary Hildebrand comments in Bloomberg BNA on guidance companies need on fines imposed by the new EU privacy law.

Mary Hildebrand is quoted in The Wall Street Journal on how data localization services enabling the transfer of data stored in Europe to a U.S. server may not be a viable option.

Mary Hildebrand comments in Bloomberg BNA on the GDPR's high-risk processing requirements and the challenges they pose for U.S. companies.

Mary Hildebrand is quoted in an Investor's Business Daily article that discusses the legal limbo facing tech giants like Amazon, Facebook, and Google resulting from ongoing deliberations regarding the proposed EU-U.S. Privacy Shield.

Mary Hildebrand comments in Bloomberg BNA on possible outcomes should the Article 29 Working Party issue a negative opinion on the EU-U.S. Privacy Shield arrangement.

Mary Hildebrand comments in SC Magazine on a leaked excerpt from the Article 29 Working Party Opinion on the EU Privacy Shield, the content of which points to further delays in the finalization of the agreement.

Mary Hildebrand comments in The Wall Street Journal regarding the Article 29 Working Party assessment of privacy protections in the Privacy Shield agreement.

Mary Hildebrand comments in The Wall Street Journal on the regulatory and compliance requirements companies will have to manage under the new Privacy Shield.

Mary Hildebrand is quoted in The Wall Street Journal and Law360 on the issues companies face in light of the new Privacy Shield announced by EU and U.S. authorities.

Mary Hildebrand comments in USA Today on new data privacy protections proposed by the European Union and their effect on transatlantic business.

Mary Hildebrand is quoted in The Wall Street Journal on the alternatives companies are using in place of Safe Harbor, while the European Court of Justice negotiates a new agreement.

Mary Hildebrand provides insight in a Corporate Secretary article on how U.S. companies must rethink compliance with EU data privacy laws.

Mary Hildebrand comments in CIO Magazine regarding the Court of Justice of the European Union's ruling declaring the Safe Harbor agreement invalid and how this could result in the loss of uniformity for privacy investigations throughout many European countries.