Emily S. Tabatabai

Partner

Washington, D.C.


Read full biography at www.orrick.com
Emily S. Tabatabai is a partner and founding member of the Cyber, Privacy & Data Innovation practice, which was named Privacy Practice Group of the Year by Law360 in 2016 and is nationally ranked by The Legal 500 US for Cyber Law, Data Protection and Privacy. She has been recognized by The Legal 500 for her "extraordinary depth of knowledge in student data privacy matters," and by Chambers USA as "an invaluable resource to have when it comes to data privacy and security." 

Emily advises clients on an array of privacy and data management matters, helping clients navigate the complex web of privacy laws, rules, regulations and best practices governing the collection, use, transfer and disclosure of data and personal information. Emily works closely with client business teams and in-house counsel to assess and manage privacy risks, design and deploy compliance programs and implement privacy-by-design approaches to address key compliance objectives while supporting each client’s data innovation strategies and the development and use of cutting-edge digital technologies. She frequently guides child- and student-directed service providers through the complexities of compliance with the Children’s Online Privacy Protection Act (COPPA), the Family Educational Rights and Privacy Act (FERPA), California’s Student Online Personal Information Protection Act (SOPIPA) and similar state student privacy laws and advises companies across the industry spectrum as they work towards compliance with the California Consumer Privacy Act (CCPA). She also represents clients subject to regulatory investigations and litigation involving a spectrum of federal and state laws, including under Section 5 of the Federal Trade Commission Act (FTC Act), COPPA, the Fair Credit Reporting Act (FCRA), Gramm-Leach-Bliley Act (GLBA), the U.S.-E.U. Privacy Shield Program, the California Online Privacy Protection Act (CalOPPA) and others.

To make the CCPA more accessible, Emily developed Orrick's CCPA Readiness Assessment Tool. The tool provides companies an opportunity to test their compliance with the CCPA and similar laws as a first step to constructing their strategic compliance roadmap.

Emily also has an active consumer protection practice, focused on marketing and promotional issues. She counsels clients on interest-based advertising, sweepstakes and marketing promotions, retail sales and e-commerce platforms, advertising substantiation, new media and social media integration, and SMS text messaging and telemarketing, including matters involving the Telemarketing Sales Rule (TSR), the Telephone Consumer Protection Act (TCPA), the Restore Online Shoppers’ Confidence Act (ROSCA) and state and federal consumer protection statutes.

Emily is a Certified Information Privacy Professional in both U.S. and European privacy law (CIPP/US and CIPP/E) and member of the International Association of Privacy Professionals (IAPP) Publications Advisory Board. She is a frequent speaker on data privacy matters, with a particular focus on children’s privacy (COPPA), student data privacy and EdTech. She was featured as an “Up and Coming” Privacy & Data Security attorney by Chambers USA 2018.

Posts by: Emily Tabatabai

Privacy Policies and the Sale of Corporate Assets: It pays to plan ahead to preserve the value of your data assets

Personal data is a valuable corporate asset.  At times, the personal information collected from customers (such as email address, mailing address, phone number, etc.) can be a company’s most valuable asset.  Unfortunately, when a company attempts to sell this asset, it can find the value of the data significantly diminished due to promises made in a privacy policy the company implemented years before it ever contemplated such a sale.

A company’s privacy policy sets forth the company’s promises to its consumers as to how it will collect, store, maintain, and share the consumers’ personal data.  In an attempt to appeal to customer privacy concerns, it is common for a company to proclaim in such policies:

We share your personal data only in the ways described in this policy,”

or

We care about our customers and we will never sell or share your personal data.”

Most companies include these statements to highlight their promise not to capitalize on a consumer’s data by selling to third party marketers.  However, many companies do not realize that statements such as these could also severely restrict the company’s ability to sell data as a corporate asset in a company sale, merger, bankruptcy, or similar corporate transaction, unless there is also a clear statement within the policy which permits data to be transferred during the course of such events.

There are steps a company can take leading up to the corporate transaction to smooth the transfer of customer data, such as updating its privacy policy, providing additional notice to consumers, requesting opt-out or opt-in consent to the revised policy and/or the data sale.  Companies that fail to take these steps and attempt to transfer data in a manner that conflicts with promises made in its privacy policy may face regulatory scrutiny or litigation, both of which would ultimately diminish the value of their data assets in any eventual sale.

READ MORE