New York; Boston
Matthew develops global privacy, AI and cybersecurity programs to meet state, federal and international laws and self-regulatory regimes. He also leads Orrick’s data protection team in supporting mergers and acquisitions and data licensing transactions. Matthew counsels on cybersecurity breach preparedness and leads the immediate response after an incident to guide clients through an investigation, incident remediation, consumer and regulatory notifications and government inquiries.
Matthew helps clients comply with:
- U.S. state comprehensive privacy laws, including the California Consumer Privacy Act of 2018 (CCPA)
- The General Data Protection Regulation (GDPR)
- U.S. state AI laws
- U.S. state biometrics privacy laws, including Illinois’ Biometric Information Privacy Act
- U.S. state consumer health data laws, including Washington’s My Health My Data
- The Controlling the Assault of Non-Solicited Pornography and Marketing Act (CAN-SPAM)
- The Children’s Online Privacy Protection Act (COPPA)
- The Fair Credit Reporting Act (FCRA)
- the Gramm-Leach-Bliley Act (GLBA)
- The Telephone Consumer Protection Act (TCPA) and state breach notification, biometric privacy and cybersecurity laws
He counsels on self-regulatory privacy programs, including:
- NIST, ISO, AICPA and OECD frameworks for AI risk management and cybersecurity
- Programs covering online behavioral advertising, including the Digital Advertising Alliance (DAA), the European Interactive Digital Advertising Alliance (EDAA), the Interactive Advertising Bureau (IAB) and the Network Advertising Initiative (NAI)
- Payment Card Industry Data Security Standard
- EU-U.S. Data Privacy Framework
- Binding Corporate Rules
- The Asia-Pacific Economic Cooperation Cross-Border Privacy Rules (APEC CBPRs)
Matthew also acts as product counsel and provides compliance solutions for emerging technologies, including artificial intelligence and blockchain. His comprehensive data management knowledge enables clients to meet regulatory obligations while supporting business innovation, interoperability, growth and digital trust. He takes a risk‑based approach to developing and implementing policies governing the full lifecycle of personal information and manages data‑related relationships with vendors, employees, acquired entities and creditors. He also integrates privacy considerations into product development and change‑management processes.
Matthew’s past role with the Federal Trade Commission (FTC) helps clients stay compliant and avoid regulatory scrutiny. Prior to joining Orrick, Matthew was an Enterprise Privacy Solutions Manager for TrustArc (formerly TRUSTe), a San Francisco-based privacy consulting and certification firm and an adjunct law professor of Privacy Law at Santa Clara University. Matthew is a Certified Information Privacy Manager and a Certified Information Privacy Professional with a specialization in United States privacy law.