In-House Privacy Counsel in Tech, AMA Forum

[Anonymous User]

This is all very helpful, thank you! I’m a biglaw privacy attorney in a niche practice area (think GLBA/HIPAA/FINRA/COPPA/FCRA). Are these positions also in demand for in house counsel roles, or are most companies looking for more generalist privacy attorneys (like GDPR, CCPA, FTC, etc.)? How hard would it be to sell a niche privacy role for a more general privacy role? And when do you think the best time is to make the switch from biglaw to in house privacy counsel?

How specialized are you really? At my firm certain associates would get designated as the “experts” in GLBA, HIPAA, COPPA etc, but we’d do general privacy work too. It’s surprising to me that it makes sense for the firm to specialize you that much if you really don’t do any CCPA/FTC work. (If it’s FCRA I understand more.)

Companies in your specific niche will be happy to hire people who have focused in their sector-specific law, though I imagine it’s pretty rare to just hire, eg, pure GLBA counsel.

If the specialty is FCRA, that might be tough to sell for a generalist privacy role, as we generally think of that as more of a regulatory specialty than privacy per se. CRAs would probably be more than fine with it for their privacy roles though. I’m not familiar with FINRA privacy requirements (other than the securities version of the GLBA privacy rule), so not sure how that could be sold.

The other specialties, I definitely think you can work with. The important thing will be to play up your generalist work (I’m sure you’ve worked on projects that are more about general privacy principles than super narrow applications of the sectoral law), and also demonstrating that you have a good understanding of at least CCPA, and *some* understanding of GDPR. If you aren’t very familiar with them, I would try to read up as much as you can, or try to do that kind of work at the firm. I do understand though that US firms usually farm their GDPR work out to EU/UK offices, and that’s what my firm did.

As far as timing, I think it starts being feasible (but hard) at 3 years, and there’s no reason not to leave whenever you can get a job you’re happy with (especially if you hate Biglaw and your debt is manageable). You probably limit your earnings potential at that specific company by anchoring yourself to a lower starting salary, but you should have plenty of marketability to other companies, and I doubt they offer less just because you left your firm earlier. But I don’t really know.

I’d say year 6-7 is probably when you’re at your peak marketability. Too much more senior and the roles you’re best qualified for will be more insistent on previous in-house experience.

[Anonymous User]

OP, thanks for doing this AMA. I am product counsel and looking to get more exposure to privacy.

To your earlier points, what exactly are "privacy principles"? When you are advising on a commercial offering that the business wants to move forward with, what "principles" are you operating under? Where can someone learn about these principles (as opposed to say, knowing what HIPAA/GDPR/etc. specifically say)?

[Anonymous User]

OP, thanks for doing this AMA. I am product counsel and looking to get more exposure to privacy.

To your earlier points, what exactly are "privacy principles"? When you are advising on a commercial offering that the business wants to move forward with, what "principles" are you operating under? Where can someone learn about these principles (as opposed to say, knowing what HIPAA/GDPR/etc. specifically say)?

A good place to start are the Fair Information Practice Principles (FIPPs). Those capture at a high-level the kinds of considerations we are trying to have baked into product offerings. (I'd also add to those that data shouldn't be kept longer than it's needed to fulfill the original purpose of collection, unless it's otherwise required to be retained.) If you want to dive deeper, I'd look at FTC guidance (there's a 2012 privacy report that's a little dated now, but still a good comprehensive source of their view of things) and Daniel Solove and Woodrow's Hertzog's scholarship trying to distill principles from the FTC's enforcement actions and guidance. Since the FTC's privacy legal authority doesn't have any substantive content, their enforcement efforts are a good reflection of what are considered appropriate privacy & security measures generally.

[Anonymous User]

Great thread! What’s your opinion on the CIPP certification? Is knocking that out in free time a good way for corporate/product counsel to get conversant in privacy issues in a useful way, or would that be overkill?

[Definitely Not North]

Hey -- I'm a product counsel in tech.

You should do a Product Counsel AMA

[Anonymous User]

Great thread! What’s your opinion on the CIPP certification? Is knocking that out in free time a good way for corporate/product counsel to get conversant in privacy issues in a useful way, or would that be overkill?

Definitely useful for signaling purposes. People deciding who to interview do care about it.

I haven’t actually got around to doing it, though I should. From briefly looking through it, it didn’t seem like a great course substantively, but I don’t really know.

[Anonymous User]

Hey -- I'm a product counsel in tech.

You should do a Product Counsel AMA

Is there interest? Feel free to ask a question here; if I get a couple more I'll open a thread.

[hangtime813]

Hey -- I'm a product counsel in tech.

You should do a Product Counsel AMA

Is there interest? Feel free to ask a question here; if I get a couple more I'll open a thread.

Definitely some interest--product counsel seems to vary a lot from company to company. How's your day to day and comp compared to biglaw?

[Anonymous User]

My comp is something like 3/4 or 3/5 what I'd be making as an 8th year in biglaw.

My day to day is quite different from biglaw, where I did litigation. In both cases I was relatively in charge of what I spent my time on, but I had that pressure to bill in biglaw and that is gone. I try to spend my time on what is most valuable to the company (reducing largest risks) but also sometimes I dig into projects out of my own curiosity to some degree. I am in more meetings and interact with non lawyers far, far more than I did in biglaw. I work far more predictable hours and overall work significantly less.

As an example, in biglaw I would read cases and revise a brief, now, I find issues myself (or react to those reported to me) and dig into them factually and do googling and talk with outside counsel (usually don't) to understand the law.

[Anonymous User]

My comp is something like 3/4 or 3/5 what I'd be making as an 8th year in biglaw.

My day to day is quite different from biglaw, where I did litigation. In both cases I was relatively in charge of what I spent my time on, but I had that pressure to bill in biglaw and that is gone. I try to spend my time on what is most valuable to the company (reducing largest risks) but also sometimes I dig into projects out of my own curiosity to some degree. I am in more meetings and interact with non lawyers far, far more than I did in biglaw. I work far more predictable hours and overall work significantly less.

As an example, in biglaw I would read cases and revise a brief, now, I find issues myself (or react to those reported to me) and dig into them factually and do googling and talk with outside counsel (usually don't) to understand the law.

Did you find it difficult to transition from big law litigation to a product counsel role? Did you have a specific litigation focus that you found helped you land the role?

[Anonymous User]

Thanks for taking the time to do this AMA! I am an incoming privacy associate at a biglaw firm in DC, and I’ve found this thread to be very informative.

What was your reasoning for going in-house versus going into the government?

Where do you expect your career to go from your current position? Do you see yourself remaining at your company? Lateraling? Returning to big law as a counsel or partner?

Is there anything you wish you had known as an incoming privacy associate?

[Anonymous User]

My comp is something like 3/4 or 3/5 what I'd be making as an 8th year in biglaw.

My day to day is quite different from biglaw, where I did litigation. In both cases I was relatively in charge of what I spent my time on, but I had that pressure to bill in biglaw and that is gone. I try to spend my time on what is most valuable to the company (reducing largest risks) but also sometimes I dig into projects out of my own curiosity to some degree. I am in more meetings and interact with non lawyers far, far more than I did in biglaw. I work far more predictable hours and overall work significantly less.

As an example, in biglaw I would read cases and revise a brief, now, I find issues myself (or react to those reported to me) and dig into them factually and do googling and talk with outside counsel (usually don't) to understand the law.

What are things a Tech Trans associate can do that can make them more competitive for product counsel exit opps vs corporate/commerical counsel opps?

[Anonymous User]

Thanks for taking the time to do this AMA! I am an incoming privacy associate at a biglaw firm in DC, and I’ve found this thread to be very informative.

What was your reasoning for going in-house versus going into the government?

Heavily considered both. About 6 months before I ended up leaving, I had a final round Fed interview for a job I didn't get, and I probably would've taken it if I'd gotten the offer. In retrospect though I'm glad I didn't get it, mostly just because I make a lot more money than I would have in the government, and I probably work less. Not being tethered to DC is also nice (though I like DC a lot). Having never worked in the government, and having mostly only engaged directly with government enforcement attorneys, I don't really have a great sense of what the day-to-day is like for more substance-focused government jobs. So beyond the pay and hours, I don't have much to offer to compare the two.

Where do you expect your career to go from your current position? Do you see yourself remaining at your company? Lateraling? Returning to big law as a counsel or partner?

I plan to stay at my company at least until my original stock grant vests (four years after I started). Leaving earlier would leave a ton of money on the table given the gains. After that, I could definitely stay put if I see room to grow (and the company has both historically been very good about promoting from within on the Legal team and is still growing very fast), since I'm very happy here. I could also see myself either lateralling to a similar or FAANG-type company, or moving to an earlier-stage company and being their first privacy attorney. After that, who knows. I don't know that I'd ever want to be a CPO for a public company (sounds stressful), but doesn't seem totally out of the question down the line. No desire to go back to biglaw unless something totally unexpected happens.

Is there anything you wish you had known as an incoming privacy associate?

The main thing I would say that's specific to privacy is this: a lot of your value is what you know. (Well, at least eventually. As a first year, your value is having a good attitude, being responsive and meeting your deadlines, like for every other first year.) As much as you can, try to absorb the substance of what you're doing rather than just pushing through an assignment. You don't need to try too hard at this, as it will eventually come naturally, and sometimes you just have to get things off your desk. But the quicker you can learn the CCPA, GDPR, and whatever other laws you specialize in, the quicker you're providing real value.

Then, just more general advice for starting as an associate is to be responsive and really consistent about deadlines for your first two years, while always having a smile as much as possible, and build up a good reputation. Then, try to chill out a bit. Once you have a good reputation, your goal should be to avoid burnout, which means establishing boundaries around your time (i.e., sometimes you have to say no), and not stressing too much when you make a small mistake. Biglaw is full of the kind of people who think a few commas in the wrong place is a capital offense, but at the end of the day, if you're otherwise good, they aren't going to do anything about it other than grumble. Once you have a bit of training, you're providing a lot of value, so just don't feel like you have to tiptoe all day and never make a mistake.

[Anonymous User]

Did you find it difficult to transition from big law litigation to a product counsel role? Did you have a specific litigation focus that you found helped you land the role?

I suppose I did find it somewhat difficult to get my first in-house job -- it took about a year of interviewing. After I figured out the right way to setup my resume (which took probably four months and the help of a former colleague), I started getting a fair amount of interviews, but it took me a long time to get good/decent at interviewing for these roles.

The first company I went to, yep, was dealing with a litigation familiar to the litigations I worked on, and also wanted to hire a product counsel. So I did both things for my first year there.

[Mooselaw2141]

Did you find it difficult to transition from big law litigation to a product counsel role? Did you have a specific litigation focus that you found helped you land the role?

I suppose I did find it somewhat difficult to get my first in-house job -- it took about a year of interviewing. After I figured out the right way to setup my resume (which took probably four months and the help of a former colleague), I started getting a fair amount of interviews, but it took me a long time to get good/decent at interviewing for these roles.

The first company I went to, yep, was dealing with a litigation familiar to the litigations I worked on, and also wanted to hire a product counsel. So I did both things for my first year there.

Do you mind sharing the changes you made to your resume that snagged you more interviews?

[Anonymous User]

Do you mind sharing the changes you made to your resume that snagged you more interviews?

I made it in-house/business-centric. So rather than using the buzzwords we litigators are used to ('deposed six fact witnesses and three expert witnesses,' 'second chaired SDNY trial on claims under securities act') I used terms that show ability and experience in the skills relevant to product counsel roles ('interviewed and prepared for testimony Fortune 500 marketing and finance leaders' / 'worked with in-house team to analyze legal and business risk of different options for injunctive relief' / 'managed team of three junior attorneys in reviewing documents for evidence of discrimination').

Does that make sense? And so working on class action cases become a skill of understanding "consumer protection" and working on products liability or patent cases becomes "assessing go-to-market plans for legal risk" or something. Not pushing the boundaries, but phrasing it in the lens relevant to the role.

[fmrez]

Do you mind sharing the changes you made to your resume that snagged you more interviews?

I made it in-house/business-centric. So rather than using the buzzwords we litigators are used to ('deposed six fact witnesses and three expert witnesses,' 'second chaired SDNY trial on claims under securities act') I used terms that show ability and experience in the skills relevant to product counsel roles ('interviewed and prepared for testimony Fortune 500 marketing and finance leaders' / 'worked with in-house team to analyze legal and business risk of different options for injunctive relief' / 'managed team of three junior attorneys in reviewing documents for evidence of discrimination').

Does that make sense? And so working on class action cases become a skill of understanding "consumer protection" and working on products liability or patent cases becomes "assessing go-to-market plans for legal risk" or something. Not pushing the boundaries, but phrasing it in the lens relevant to the role.

This is very helpful, thank you, How many applications did you send out in total?

[Anonymous User]

This is very helpful, thank you, How many applications did you send out in total?

Maybe 30 or 40?

[fmrez]

This is very helpful, thank you, How many applications did you send out in total?

Maybe 30 or 40?

Thanks! Would be great to PM, I'm on the hunt with similar background and getting discouraged with results.

[Anonymous User]

[Please Delete]

[SNightHighlights]

Hi all - I moved in-house in a privacy counsel role from a firm about a year ago to a pretty big, but not FAANGM, tech company. I've used TLS for info for years, so happy to pay it back by answering any Qs.

For background, before I took this job, I was a 5th/6th year in DC regulatory Big Law (focusing on privacy and another substantive area).

Hi OP! This is a fantastic thread - would you mind PMing me? I had some questions for you re Privacy practice that I'd prefer not to post.

Above = Accidental anon, sorry about that --

Hi OP! This is a fantastic thread - would you mind PMing me? I had some questions for you re Privacy practice that I'd prefer not to post.