People

Matthew E.S. Coleman 合伙人

New York; Boston

Matthew helps clients comply with the Controlling the Assault of Non-Solicited Pornography And Marketing Act (CAN-SPAM), the Children’s Online Privacy Protection Act (COPPA), the California Consumer Privacy Act of 2018 (CCPA), the Fair Credit Reporting Act (FCRA), the Gramm-Leach-Bliley Act (GLBA), the General Data Protection Regulation (GDPR), the Telephone Consumer Protection Act (TCPA), and state breach notification, biometric privacy, and cybersecurity laws. He counsels on self-regulatory privacy programs, including Binding Corporate Rules, the Asia-Pacific Economic Cooperation Cross-Border Privacy Rules (APEC CBPRs); programs covering online behavioral advertising, including the Digital Advertising Alliance (DAA), the European Interactive Digital Advertising Alliance (EDAA), the Interactive Advertising Bureau (IAB), and the Network Advertising Initiative (NAI); and programs covering payment card processing. Matthew also provides compliance solutions for emerging technologies, including artificial intelligence and blockchain.

Matthew’s federal regulatory experience helps clients stay compliant and avoid regulatory scrutiny. His comprehensive data management knowledge helps him counsel beyond the letter of the law and facilitates worldwide expansion, interoperable business processes, and innovative uses of consumer data while maintaining user trust. His all-encompassing, risk-based approach involves developing and executing internal and external policies for the collection, use, disclosure, sharing, retaining, transferring, and destruction of personal information. This includes managing contractual relationships with vendors, employees, acquired entities, and creditors as well as building privacy into companies’ product development life cycle and change management strategies.

Prior to joining Orrick, Matthew was an Enterprise Privacy Solutions Manager for TrustArc (formerly TRUSTe), a San Francisco-based privacy consulting and certification firm, and an adjunct law professor of Privacy Law at Santa Clara University. Matthew is a Certified Information Privacy Manager and a Certified Information Privacy Professional with a specialization in United States privacy law.

Catherine Conners 律师

Boston

Catherine's practice focuses on buy-side and sell-side mergers and acquisitions, both domestic and cross-border. She practices across a variety of industries, including energy, technology and software, healthcare and life sciences. As a member of the firm's EnergyTech team, Catherine focuses on advising companies developing next-generation technologies in energy storage, carbon capture, alternative fuels and agtech.

David Curtis 顾问律师

西雅图; Boston

David drafts and negotiates data licenses and other commercial contracts in which privacy and security issues are a key concern. In addition, he regularly advises clients on privacy policies, website terms and conditions and data processing agreements. David also counsels clients on digital advertising, Internet law and consumer protection, with a particular focus on compliance with the California Consumer Privacy Act of 2018 (CCPA), the California Privacy Rights Act (CPRA), the EU General Data Protection Regulation (GDPR), restrictions on unfair and deceptive trade practices and app store privacy requirements. David helped develop Orrick’s CCPA Readiness Assessment Tool, which enables companies to test how ready they are to comply with the CCPA as a first step to constructing a strategic compliance roadmap.

Before joining Orrick, David was an associate at Ropes & Gray LLP and an adjunct professor at Harvard Law School, where he taught legal research, writing and analysis. David clerked for Justice Barbara Lenk of the Supreme Judicial Court of Massachusetts.

Kathryn "Katy" de Visscher 主理律师

Boston

Katy assists clients in their data breach investigations and cybersecurity incident response, including advising clients on data breach notification responsibilities and providing strategic advice on how to manage cybersecurity risks. She advises on enhancing existing privacy and information security policies and procedures, such as online privacy notices.

Her work includes counseling on compliance with the California Consumer Privacy Act (CCPA) and General Data Protection Regulation (GDPR) for day-to-day business operations and the development of new products.

Katy graduated from Boston College Law School. During that time, she externed in the Data Privacy & Security Unit at the Massachusetts Attorney General’s Office where she supported consumer protection enforcement actions. She also interned with The Future of Privacy Forum and in-house with a leading cloud-based software company.

Tori Downey Data Privacy & Cybersecurity Innovation Attorney

Boston

Tori advises clients on enhancing their data privacy and security profiles and building comprehensive global data protection programs. She provides guidance on issues relating to a vast array of state, federal and international privacy and cybersecurity laws, including:

• Children’s Online Privacy Protection Act (COPPA)
• EU General Data Protection Regulation (GDPR)
• Section 5 of the Federal Trade Commission (FTC) Act
• Telephone Consumer Protection Act (TCPA)
• U.S. surveillance-related laws
• U.S. state data breach notification laws
• U.S. state privacy laws in California, Colorado, Connecticut, Utah and Virginia (CCPA, CPRA, CPA, CTDPA, UCPA, VCDPA)

Tori also supports clients in developing strategies to reduce the risk of security incidents, regularly advises on general consumer protection issues, and counsels on sweepstakes, marketing, and advertising matters.

Prior to joining Orrick, Tori served as an in-house data privacy and security law clerk at a pharmaceutical company in Boston, at a large nonprofit corporation in New York City, and at an international oil and gas company in Beijing. She also worked on data privacy matters in the Office of the General Counsel of Northeastern University. Having worked across diverse business sectors, including life sciences, technology and energy, Tori brings an in-house perspective to her client matters.

Nicholas Farnsworth 合伙人

Boston

Nick provides compliance guidance on both proposed and effective laws on a federal and state level in the United States, including:

• Controlling the Assault of Non-Solicited Pornography And Marketing Act (CAN-SPAM)
• Children’s Online Privacy Protection Act (COPPA)
• Illinois Biometric Information Privacy Act (BIPA) and other biometric privacy laws
• Fair Credit Reporting Act (FCRA)
• Gramm-Leach-Bliley Act (GLBA)
• Section 5 of the Federal Trade Commission Act (FTC) Act
• Telephone Consumer Protection Act (TCPA)
• U.S. state breach notification laws
• U.S. state privacy laws
• U.S. artificial intelligence laws

He also counsels clients on the impact of international laws from a U.S. perspective, including the General Data Protection Regulation (GDPR), the ePrivacy Directive (ePD), and the EU Artificial Intelligence Act.

Nick helps clients develop flexible governance frameworks for the development and use of artificial intelligence in the face of ever evolving AI legislation. He also advises clients on strategies, policies and procedures for the sourcing of AI training data, the responsible use of AI by employees, the assessment of risks presented by AI tools, the design of consumer-facing AI, the negotiation of AI-related contracts and the handling of AI-related regulatory inquiries and investigations.

Nick also devotes a portion of his practice to innovative client solutions and community engagement. He was part of the Orrick team that developed Orrick’s AI Resource Center, EU AI Act reference guide, U.S. AI Law Tracker and Gen AI Policy Builder. His pro bono practice has included representing clients in immigration and innocence matters and assisting small businesses with their legal needs.

Nick has obtained the Certified Information Privacy Professional -/ United States (CIPP/US), Certified Information Privacy Technologist (CIPT) and Privacy Law Specialist (PLS) designations from the International Association of Privacy Professionals (IAPP).