Andrew Hoffman Email & Phone Number

New York, Ny, Us

New York, New York, Us

• Advisory. Provide risk-based, commercially-minded advice for consumer (e.g., Marcus, Private Wealth), institutional (e.g., asset management, Transaction Banking) & employee initiatives, including by:--- Advising leadership on legal risks & compliance strategies for new business activities, via Privacy-by-Design approach.--- Collaborating w/ the Chief Privacy Officer & businesses to comply with new/amended laws (e.g., CCPA / CPRA, Reg. S-P).--- Drafting consumer- and employee-facing materials (e.g., privacy notices, consents, breach notice letters, responses to data subject requests) to balance legal compliance with competing concerns.--- Providing direction on emerging risks (e.g., AI/ML, cross-border transfers, blockchain, biometrics).--- Calibrating advice to enable multi-national business under different privacy regimes (e.g., GDPR).• Transaction Support. Support both significant & routine transactions, including by:--- Recommending response to red-flag privacy diligence issues in M&A and investment transactions.--- Counseling on privacy operational requirements in integrations and divestitures.--- Resolving escalations of privacy / security terms in vendor, client & partnership agreements.• Incident Response: Primary lawyer in incident response, working closely w/ Tech Risk (InfoSec) during investigation & remediation; determine notification requirements; draft consumer notices, regulatory filings, talking points.• Leadership. Interact with senior audiences, including by:--- Presenting to oversight committees on impact of new laws/developments; and to advise on privacy risks in transactions and new business activities.--- Participating in trade group activities to comment on proposed laws / rules.--- Developing, delivering internal training on privacy topics; speaking on external conference panels.--- Developing business case for creation of separate Cyber Legal function, leading to hiring of an MD.--- Managing lawyer direct report.

An invitation-only, non-profit professional association dedicated to empowering in-house cybersecurity.

Palo Alto, Ca, Us

• Provided risk-based advice to Fortune 500 & VC-backed companies in SaaS, FinTech, pharma, consumer product, hospitality, and education industries, including by:--- Guiding the development & implementation of clients’ GDPR and CCPA compliance strategies.--- Drafting privacy notices for websites & apps; counseling on UX design & disclosures/consents.--- Preparing briefing materials for boards of directors, executive leadership & CLOs/General Counsel.--- Developing guidance documents for businesspeople incorporating legal requirements & best practices.--- Advising on digital advertising practices under US and EU law (e.g., GDPR, ePrivacy Directive).--- Leading global privacy compliance initiatives, overseeing local counsel in LatAm, Europe & Asia-Pacific.• Led privacy/cyber diligence in multi-billion dollar VC/PE/M&A transactions; negotiated reps & disclosures.• Directed companies’ legal response to, and forensic investigations of, data security incidents.• Negotiated data protection & information security terms in technology transaction agreements.• Managed junior associates & summer associates’ work product, legal research & writing.• Editor of law firm blog "cyber/data/privacy insights."

Purchase, Ny, Us

-- Performed privacy review of Mastercard Track B2B payment product, including work w/ business team to incorporate privacy by design principles, document data flows, and negotiate vendor and partner agreements. -- Led internal investigation responding to regulatory inquiry; developed strategy, presentation & written materials. -- Negotiated privacy and information security contractual provisions with vendors, including GDPR DPAs.-- Advised security incident response team on legal requirements in responding to potential data leakage incidents. -- On loan to Mastercard a second time from Norton Rose Fulbright & Cooley.

Global, Gb

Help businesses address legal requirements and best practices for the collection, use, disclosure, and protection of personal information and confidential corporate information. Representative experience includes:-- Advising on the implementation of Privacy by Design in connection with websites and mobile apps.-- Counseling regarding compliance with privacy and consumer protection statutes and regulations (including TCPA, GLBA, HIPAA, Do-Not-Call Rule, and the California Song-Beverly Credit Card Act and similar state laws).-- Developing strategies to comply with cross-border data transfer requirements, such as the transfer of data from Europe to the United States.-- Drafting privacy policies and Terms of Use for general audience and B2B-oriented websites and mobile apps.-- Drafting employee-facing agreements and policies (including Bring Your Own Device (BYOD) policies, and policies regarding physical searches, telephone monitoring, and employer data collection and retention of information).-- Counseling corporate clients in response to data security breaches.-- Reviewing websites and mobile apps for compliance with privacy, security, and consumer protection laws and regulations.

Purchase, Ny, Us

Revamped partner intake and assessment process and privacy/data rights sections of contract for a product involving third-party data sharing under GLBA exceptions. Provide overflow assistance in responding to business-as-usual privacy requests. On loan to Mastercard's Privacy Office from Norton Rose Fulbright.

Chicago, Illinois, Us

Counsel corporate clients regarding compliance with privacy and consumer protection laws (including TCPA, GLBA, HIPAA, Do-Not-Call Rule, CAN-SPAM, California Song-Beverly Credit Card Act & similar point of sale data collection laws, etc.).Counsel on incident response and data breach notification requirements; draft notification letters.Develop Bring Your Own Device (BYOD) policies and Written Information Security Programs.Draft website and mobile app privacy policies and Terms of Use. Interview clients regarding data practices.Counsel clients in response to FTC and state regulator investigations and inquiries.Litigate privacy and consumer protection matters. Notable representations:-- Represent text messaging software platform in defense of putative class action brought pursuant to the Telephone Consumer Protection Act (TCPA) alleging that merchants using client’s platform failed to obtain consent to send marketing text messages to consumer.-- Successfully defended third party administrator in lawsuit alleging invasion of privacy and breach of medical confidentiality, obtaining dismissal pursuant to California’s anti-SLAPP statute.-- Represented online search service in privacy investigation by the Federal Trade Commission.

New York, New York, Us

Commercial and fiduciary litigation and appeals in state and federal court. Privacy and data security counseling.Notable Representations:-- Successfully petitioned for writ of certiorari on behalf of developers of mixed-use real estate project who sought to quash orders authorizing a receiver (funded by the developers) to pay the attorneys’ fees of the plaintiff prior to the judgment in the underlying lawsuit. Fortune Int’l Hospitality, LLC v. M Resort Residences Condominium Ass’n, 77 So. 3d 741 (Fla. 3d DCA 2011).-- Successfully defended final judgment favorable to multinational bank in ultra high-net worth client’s breach of contract suit against the bank regarding the manner in which the client’s assets were held. Herman v. J.P. Morgan Securities, Inc., 126 So.3d 1066 (Fla. 4th DCA 2013) (per curiam affirmed).-- Successfully defended nonprofit in appeal of judgment in nonprofit’s favor in its breach of contract suit against a vendor. Arena Advertising & Publishing, LLC v. Alvin Ailey Dance Foundation, 44 So. 3d 593 (Fla. 3d DCA 2010) (per curiam affirmed).-- Appealed order impleading healthcare holding company and certain individuals in special statutory proceedings in aid of execution of a $110 million judgment, when the company and individuals had not been served with process and an impleader complaint. Fundamental Long Term Care Holdings, LLC v. Estate of Jackson, 110 So. 3d 6 (Fla. 2d DCA 2012).-- Defended broker-dealer in arbitration, and its parent company in litigation over investment in Madoff feeder fund.-- Defended private equity fund and its principals against investor derivative suit.-- Defended a payment processor in employment litigation against wrongful termination and breach of contract claims.-- Represented a pharmaceutical product manufacturer in litigation alleging distributor’s breach of contract.

Provide research and advice regarding the resolution of appeals.

New York, New York, Us

Worked primarily for the Privacy & Data Security Group.

Us

Wrote proposed orders and legal memos in response to motions in civil cases.

Washington, Dc, Us

Research the EU Data Privacy Directive and national transpositions in response to the European Court of Justice overturning the US-EU passenger name record sharing agreement. Report on privacy laws in Latin America. Placed with Privacy Office through the U.S. Department of Homeland Security Scholars Program.

Washington, District Of Columbia, Us

Policy research in Vice President Cheney's offices. Edit White House communications.

Los Alamos, Nm, Us

Work on team studying psychological aspects of nuclear security culture and the intersection between psychology and physical security. Designed study assessing attitudinal professionalism and job turnover intentions in security guards.* Placed with the Team through the U.S. Department of Homeland Security Scholars Program.* In the literature on physical security, annual job turnover rates of 100-300% have been estimated for security guards. For guards that are posted to nuclear and critical infrastructure facilities, such high turnover can pose threats to human life and safety. Industrial/organizational psychological literature has reported a negative correlation between the maintenance of an attitude of professionalism and job turnover intentions in non-security guard populations. To address these reports, a study would seek to address whether professionalism was associated with decreased turnover intentions and actual turnover in security guard populations. In the study, security guards made available via participating employers would complete a psychological survey designed to assess professionalism and report on their job satisfaction and intent to leave their job; and the participating employers would report on whether the employee actually changed jobs upon a 6 month follow-up. If it was validated that professionalism had a negative impact on actual turnover in guard populations, future research could assess, in a security guard population, the efficacy of potential interventions designed to decrease job turnover.

Juris Doctor (J.D.), Cum Laude, Law

Bachelor’S Degree, English (B.A.), Summa Cum Laude; Psychology (B.S.), Cum Laude