Cyber Academy Webinar: Ethical Issues in International Data Privacy Matters

In this Constangy Cyber Academy session, Constangy Cyber Team Vice Chair Richard Goldberg is joined by Seaton Gordon and Nathalie David of Clyde & Co to explore the legal, ethical, and cultural considerations that arise when cybersecurity and data privacy matters span multiple jurisdictions. Working through practical cross-border scenarios involving the United States, United Kingdom, and Canada, the presenters examine when foreign privacy laws apply, the professional conduct rules that shape incident response advice, ransomware payments and sanctions restrictions, client confidentiality, and the ethical challenges law firms face when they experience a breach themselves.

When Do Foreign Privacy Laws Apply to a U.S. Company's Cyber Incident?

Even companies that operate entirely in the U.S. may store data abroad or collect information on individuals in other countries. Seaton and Nathalie discuss the factors that can trigger foreign privacy regimes, including the GDPR, the UK GDPR, and Canada's PIPEDA. They also address how "personal data" abroad compares to PII in the U.S. and the regulatory, litigation, and contractual exposure a company may face if it decides not to notify outside the U.S.

What Ethical Duties Guide Lawyers Advising on International Cyber Incidents?

The presenters compare professional conduct obligations in the UK, Canada, and the U.S. Topics include independence, competence, candor, confidentiality, and acting in the best interests of multiple related clients in different jurisdictions. Drawing on real incident experience, they discuss how counsel should respond when a client resists notification, when evidence may be at risk, or when a client considers "hacking back." They also explain when escalation or withdrawal may be required.

Can Organizations Choose Which Country's Law Applies After a Breach?

When a single incident affects operations, servers, cloud providers, and staff across several countries, multiple laws may apply at once. Nathalie and Seaton examine whether the applicable law can ethically be chosen, what organizations can legitimately allocate by contract before an incident, and how European regulators view attempts to use the EU as a "data haven." They also discuss how to approach notification obligations to U.S. residents when European and U.S. requirements point in different directions.

Can a Foreign Subsidiary Make a Ransomware Payment That a U.S. Company Cannot?

Rich addresses a question that arises for many U.S. multinationals hit by ransomware from a sanctioned or prohibited location. He walks through the OFAC screening process and U.S. Treasury guidance on transactions by non-U.S. persons, and explains why the answer depends heavily on the facts.

What Ethical Obligations Apply When a Law Firm Suffers a Data Breach?

With attacks on law firms on the rise, the session closes with a look at firms' own incident response obligations. Rich discusses ABA Formal Opinion 483, and Nathalie and Seaton explain how provincial conduct rules in Canada and a firm's own data controller obligations in the UK can shape its response.

Key Takeaways for Employers

• Evaluate foreign privacy laws, contractual requirements, and the locations of affected individuals, not just U.S. law, when assessing your response obligations after a cyber incident.
• Recognize that "personal data" under laws like the GDPR may be much broader than the PII covered by U.S. breach notification laws.
• Involve local counsel in affected jurisdictions as early as possible, since different notification clocks may be running at the same time.
• Allocate breach responsibilities in vendor and service provider contracts before an incident, including who notifies, who pays, and on what timeline.
• Conduct an OFAC sanctions check before any ransomware payment, and don't assume that routing a payment through a foreign subsidiary avoids U.S. sanctions exposure.
• Issue document preservation instructions at the outset of an incident so forensic evidence isn't deleted or altered.

Related Resources

• Constangy Cyber Advisor: You've Been Hit with Ransomware. Think Twice Before You Pay.
• Constangy Resource: Data Privacy Interactive Map and Cybersecurity & Data Privacy Desktop Reference
• Constangy Blog: Constangy Cyber Advisor
• Cybersecurity & Data Privacy Practice

Constangy Speaker

Richard Goldberg
Partner, Cybersecurity & Data Privacy Vice Chair
Rich is a vice chair of the Constangy Cyber Team and is based in Philadelphia. He counsels clients on all aspects of data privacy and cybersecurity, with a focus on managing complex incident response, crisis management, and regulatory investigations. He has more than 25 years of experience, including as a former cybercrime prosecutor with the U.S. Department of Justice, and has handled data breaches impacting millions of people across multiple jurisdictions. He also serves as an adjunct professor at Villanova Law School and speaks frequently on ransomware, cyber insurance, and data privacy enforcement.