Alex Altman | People | Arnold & Porter

Alex Altman's practice focuses on the rapidly changing area of global data protection, privacy, and cybersecurity law. With more than 10 years of experience, Alex has counseled clients from a wide array of industries — including media, technology, finance, retail, and life sciences – on developing privacy and cybersecurity compliance programs, conducting due diligence in the M&A context, negotiating data protection agreements, responding to data breaches, and responding to litigation and government investigations. Responsiveness, strategic thinking, and creative problem solving are the touchstones of his practice. Alex has a genuine intellectual curiosity in — and dedication to — privacy and cybersecurity law. This makes him uniquely skilled at helping his clients stay ahead of the curve in a constantly fluctuating legal landscape.

Focus Areas

Experience

Publicly listed, nationwide consumer retail company in defending against data breach claims, including compelling claims to arbitration (N.D. Cal.)
Publicly listed, nationwide consumer retail company in defending against wiretapping claims arising from company's alleged use of website cookies (N.D. Cal.)
Publicly listed, global technology company in defending against wiretapping claims arising from company's alleged use of website tracking technologies (N.D. Cal.)
Warner Media and HBO Max in currently pending VPPA class action litigation relating to the use of data pixels. (S.D.N.Y.)
Gilead Sciences Inc., in defending privacy class action relating to program Mailers. (California)

Canon Business Process Services and General Electric, in defending pending data breach class action litigation (S.D.N.Y.)
Georgetown Hospital System, in obtaining dismissal of data breach class action litigation relating to ransomware attack. (South Carolina)

Global medical device manufacturer in leading its data strategy vision and providing global data protection, privacy, and cybersecurity counseling, including with respect to the California Consumer Privacy Act, the Health Insurance Portability and Accountability Act, the General Data Protection Regulation, and the Chinese Personal Information Protection Law; and negotiating privacy and security terms of and agreements in connection with customer and vendor contracts.
Fortune 100 technology manufacturer in performing due diligence into privacy practices of acquisition target, a fabless chipmaker.
Major medical laboratory company in conducting privacy and security risk assessments under the Health Insurance Portability and Accountability Act.
Fintech startup in developing privacy compliance program, including notices, policies, and contracting templates, under various laws, including the Gramm-Leach-Bliley Act.
Arts-focused mobile app developer in contracting with U.S. school districts for compliance with the Family Educational Rights and Privacy Act and Children's Online Privacy Protection Act.

Global health and beauty supplier in assessing and supplementing privacy program and negotiating data processing agreements.
Premium TV network and digital media content provider in privacy and data security compliance and design for its app, data risk management issues, and updating its privacy and security program and related documents.
Global pharmaceutical company on global data protection issues, including with respect to patient-focused apps, related to compliance with the California Consumer Protection Act, the Health Insurance Portability and Accountability Act, and the General Data Protection Regulation.
Global medical device and data companies in conducting due diligence and opining on risk of proposed mergers and acquisitions.
Consumer mobile app developer ;in developing global privacy program, — including under the CCPA and GDPR, negotiating data protection agreements with licensees.

Federal government subcontractor in investigating and responding to business email compromise incident, including reporting to federal contracting agency.
Publicly listed, nationwide consumer retail company in responding to investigation by states attorneys general over vendor's data breach.
Medical laboratory company in managing response to investigation by U.S. Department of Health and Human Services.
Publicly listed media company in incident response, crisis management and global breach notification management.
Global medical device manufacturer in multiple incident response matters, which have included conducting HIPAA risk assessments and determining notification obligations in one instance and determining notification obligations and engaging with works council under the GDPR in another.

Perspectives

April 15, 2024

DoorDash Fined $375,000 by California AG in Second-Ever Publicly Disclosed CCPA Settlement

Enforcement Edge: Shining Light on Government Enforcement

January 16, 2024

Deployers of AI Systems Beware: The FTC Begins Its Crackdown

Enforcement Edge: Shining Light on Government Enforcement

January 12, 2024

The FTC Cracks Down on Rite Aid’s Deployment of AI-Based Technology

Consumer Products and Retail Navigator

January 8, 2024

The Crackdown Commences: The FTC’s Case Against Rite Aid’s Deployment of AI-Based Technology

Advisory

January 2, 2024

California Edges Closer to Regulating Automated Decision-Making Technology Using Personal Information

Advisory

More

Recognition

Best Lawyers

Commercial Litigation (D.C.) (2024)

Credentials

Education

J.D., Fordham University School of Law, 2013
B.A., Philosophy, Vassar College

Admissions

New York
California
U.S. Court of Appeals for the Second Circuit
U.S. District Court, Northern District of California
U.S. District Court, Southern District of New York
U.S. District Court, Northern District of New York

Activities

Member, Sedona Conference Working Group 11 on Data Security and Privacy Liability
Member, New York City Bar International Law Committee
Member, New York City Bar Communications & Media Law Committee