Data Privacy Law Careers Forum

[Anonymous User]

I am interested in possibly pursuing a career in data privacy law. Does anyone have any insight into possible career paths? Obviously there are opportunities in house, but these mostly require some previous experience. From what I've been told, most big law firms also don't start associates out in data privacy law. What are some possible career paths? Is working/interning in related consulting field (information governance?) a good option?

Also, is taking the CIPP during law school advisable?

Thanks!

[patogordo]

sounds pretty narrow

[Elston Gunn]

Have no specific knowledge, but basically, go to a big D.C. firm that has a Privacy/Data Security practice group. A bunch of them do, and I don't think they're particularly small. If you don't have those kind of credentials, I really don't know. There are some boutiques that focus on this stuff but I don't know anything more than that.

EDIT: I guess here would be the place to start.

[sinfiery]

A lot of non-profits do advocacy work here (Eff, Epic, PK, access, mozilla) and I know that NYU offers those who want to go into this area a chance at a full scholarship if you work for the govt after....so likely many positions thwre. DHS or something, would be my guess.

[Anonymous User]

I'm a BigLaw litigator who does > 70 percent privacy/data breach/other cyberlaw cases. What, exactly, do you want to do, and where do you want to end up? Why are you interested in this field? Your life will be very different if you are doing HIPAA compliance vs. data breach prevention vs. consumer class action litigation vs. FTC work.

[r6_philly]

Thanks for chiming in, can you talk a bit about consumer class action? TIA

[Anonymous User]

I'm a BigLaw litigator who does > 70 percent privacy/data breach/other cyberlaw cases. What, exactly, do you want to do, and where do you want to end up? Why are you interested in this field? Your life will be very different if you are doing HIPAA compliance vs. data breach prevention vs. consumer class action litigation vs. FTC work.

OP here. I got to work in the field a little over the summer and really thought it was interesting (in house at a Fortune 500 company). I'd love to eventually end up in a position similar to the in house attorneys at the company. The company basically has a lot of data and part of the business is packaging it into products to sell. The data privacy legal team would advise the product teams what data could be shared both in the sales pitches and actual products.

[Anonymous User]

Thanks for chiming in, can you talk a bit about consumer class action? TIA

BigLaw litigator here again. Sorry for the delay. Work has been crazy (as usual).

Cyberlaw-flavored consumer class action work is great. I recommend it highly, for these reasons:

- Questions of first impression. Technology is evolving much, much quicker than law. This means the plaintiffs' bar is often challenged to think creatively to fit new technology into old statutory frameworks, and the defense bar is challenged to think of creative responses. For defense-side lawyers, the uncertainty is taxing on our clients, but wrestling with it can be very intellectually rewarding for us. (You learn very quickly in litigation that completely predictable outcomes are boring and lead to early settlements.)

- You get to play with/learn about interesting technology, and you often get to interface with technical client-side folks from whom you can learn a lot. For those who have tech-leaning tendencies or a pre-LS background in a relevant field, but who aren't much for patent work, this can be a great way to scratch that itch.

- The work you do is all over the news. People have opinions about it because it is interesting. That said, if you're doing defense-side work, be prepared for some hostility from friends who are more strong privacy-rights types.

- You get to participate in behind-the-scenes conversations about changes to privacy practices. If you're doing this work for cutting-edge SV clients, helping them think through what data they should/should not create, mine, analyze, market, etc. is a really interesting topic.

- The work more often has you wrestling with legally thorny questions than the minutiae of discovery. Much of my time is spent at the motion to dismiss phase, opposing class certification, dealing with MDL issues, or dealing with settlements/certifying settlement classes; it's often possible to arrange only for limited pre-certification discovery. Most of the litigators I know who dislike their jobs dislike being in the weeds of discovery, and I've been able to avoid getting too bogged down in this.

However, class action defense comes with one big downside for the diehard litigator: most cases that do not get dismissed either settle before or immediately after class certification. It's difficult to get trial experience. That's why I recommend maintaining no more than a 70-80% class action defense caseload: you want to take other cases that have a shot at going to trial, even if it means more tedious discovery before you get there.

Hours-wise, I seem to bill 220-280/month and routinely work through weekends. The people doing this work seem generally to put in more hours than our litigators as a whole - but I think we're also happier because the work is so damn interesting.

That's what comes to mind off the top. Happy to answer specific questions.

[r6_philly]

Wow thank you for the detailed reply! I understand how hard it is to find the time, so really appreciate it.

Do you mind sending me a pm? I would like to ask you some details if you are willing. Thank you.

[Anonymous User]

Thanks for chiming in, can you talk a bit about consumer class action? TIA

BigLaw litigator here again. Sorry for the delay. Work has been crazy (as usual).

Cyberlaw-flavored consumer class action work is great. I recommend it highly, for these reasons:

- Questions of first impression. Technology is evolving much, much quicker than law. This means the plaintiffs' bar is often challenged to think creatively to fit new technology into old statutory frameworks, and the defense bar is challenged to think of creative responses. For defense-side lawyers, the uncertainty is taxing on our clients, but wrestling with it can be very intellectually rewarding for us. (You learn very quickly in litigation that completely predictable outcomes are boring and lead to early settlements.)

- You get to play with/learn about interesting technology, and you often get to interface with technical client-side folks from whom you can learn a lot. For those who have tech-leaning tendencies or a pre-LS background in a relevant field, but who aren't much for patent work, this can be a great way to scratch that itch.

- The work you do is all over the news. People have opinions about it because it is interesting. That said, if you're doing defense-side work, be prepared for some hostility from friends who are more strong privacy-rights types.

- You get to participate in behind-the-scenes conversations about changes to privacy practices. If you're doing this work for cutting-edge SV clients, helping them think through what data they should/should not create, mine, analyze, market, etc. is a really interesting topic.

- The work more often has you wrestling with legally thorny questions than the minutiae of discovery. Much of my time is spent at the motion to dismiss phase, opposing class certification, dealing with MDL issues, or dealing with settlements/certifying settlement classes; it's often possible to arrange only for limited pre-certification discovery. Most of the litigators I know who dislike their jobs dislike being in the weeds of discovery, and I've been able to avoid getting too bogged down in this.

However, class action defense comes with one big downside for the diehard litigator: most cases that do not get dismissed either settle before or immediately after class certification. It's difficult to get trial experience. That's why I recommend maintaining no more than a 70-80% class action defense caseload: you want to take other cases that have a shot at going to trial, even if it means more tedious discovery before you get there.

Hours-wise, I seem to bill 220-280/month and routinely work through weekends. The people doing this work seem generally to put in more hours than our litigators as a whole - but I think we're also happier because the work is so damn interesting.

That's what comes to mind off the top. Happy to answer specific questions.

What are the most interesting questions of first impression you've dealt with recently? I am interested in learning a lot about data breach in my last semester at law school, and figure writing a paper for credit is a good strategy. Is there anything in particular you think is worth writing about?

[Anonymous User]

I work for a big firm that is really looking to develop that area. Right now, its a sub-niche that has aspects of IP, labor and employment, and a few other areas. But we have one partner who almost entirely deals in data privacy work, and he is a guaranteed source for work whenever anyone is slow. I get the feeling that my firm, and other firms, are looking to develop and grow this area. Yeah, its narrow, but its sometimes good to carve out a niche.

[Anonymous User]

I work for a big firm that is really looking to develop that area. Right now, its a sub-niche that has aspects of IP, labor and employment, and a few other areas. But we have one partner who almost entirely deals in data privacy work, and he is a guaranteed source for work whenever anyone is slow. I get the feeling that my firm, and other firms, are looking to develop and grow this area. Yeah, its narrow, but its sometimes good to carve out a niche.

Does he have lots of tech certifications, like CISSP, etc.?

[Big Shrimpin]

u could work in an outsourcing-type practice

lots of Ks/agmnts with data privacy provisions i think

iono tbh