ranked by Legal 500 and known for
being “excellent” and “extremely responsive and client focused, succeeding at
meeting the needs of both in-house counsel and tech-savvy business clients.”
Kolvin earned particular praise from Legal
500 for “providing sensible, balanced advice” and combining "strategic
thinking with a proactive approach".
Kolvin is Global Co-Chair
of the Cyber, Privacy and Data Innovation, and the Technology Transactions practices. He
operates at the intersection of technology, intellectual property and data for leading public and private companies in high growth innovation driven markets. Kolvin is recognised for his technology focused cross-border expertise and assists fast-growing companies and multinational corporations on their most important, strategic transactions. His work regularly involves complex, cross-border matters that raise multi-faceted intellectual property, data privacy, consumer protection, and Internet regulatory issues.
Kolvin has significant experience advising on the legal issues related to the internalization of technology and internet enabled services including e-commerce, social media, big data, digital marketing and advertising. He has worked extensively with clients who are both providers and users of cloud software, data analytics platforms, IT infrastructure services, and mobile applications, in Europe, Asia and in the United States.
Clients praise the team as
‘genuinely excellent due to its strong business acumen and approach to matters
from a practical perspective’; it provides ‘responsive and customer-focused
On data privacy matters, Kolvin regularly partners with multi-national clients on the design, development and implementation of enterprise wide global compliance programs and risk mitigation strategies in relation to the use or deployment of privacy impacting technology. He has extensive expertise in all areas relevant to the European data protection regime, including applied practices pursuant to the new General Data Protection Regulation (GDPR):
Privacy readiness and assessment audits and projects
Third party vendor assessments and agreements
Preparation of employee and consumer-facing data protection policies and procedures, and implementation of global data privacy governance frameworks
Privacy diligence and counseling in the context of mergers and acquisitions, joint ventures and other strategic transactions
International and cross-border data transfer mechanisms, including global framework agreements, Model Contracts, safe harbor regimes and binding corporate rules (BCRs)
Cookie and tracking technology rules and compliance methodologies
“Big Data” analytics and applications
Privacy by design (PbD) and privacy impact assessment (PIAs) design and implementation in connection with B2C and B2B products and services
Security incident response planning and data breach response
Regulatory investigations and enforcement actions
- Records retention and information management
To make the law more accessible, Kolvin developed Orrick's GDPR Readiness Assessment Tool. The tool provides
companies an opportunity to stress test their compliance with the GDPR as a
first step to constructing their strategic GDPR roadmap.
Representative clients that
Kolvin has assisted include leading players such as Baidu, NVIDIA, Facebook,
Instagram, Levi’s, Neiman Marcus, Intuit, Made.com, WNS, Skimlinks, Qubit,
23andMe and Zoosk, Telenor and W.W. Grainger, Thread.com and Depop.
On January 21, 2019, the French data protection supervisory authority (“CNIL”) fined Google €50 million (approximately $57 million) for violating the European General Data Protection Regulation (“GDPR”). The fine penalizes Google for failing to comply with the GDPR’s transparency and notice requirements, and for failing to properly obtain consent from users for ads personalization. This is the largest GDPR fine imposed to date and the first action against a major global tech player. The CNIL’s decision sends an important message to companies that tough enforcement actions are not just a theoretical threat. Companies should look closer at data protection compliance and particularly work on their notices and consent forms. READ MORE
(Editors’ note: Thanks to Orrick trainee associate, Arne Senger, for his help with this blog post.)
With its recent ruling in Bărbulescu v. Romania (application no. 61496/08), the Grand Chamber of the European Court of Human Rights (ECHR) made a decision of enormous impact for employers in Europe. The decision makes clear that even when private use of business resources is prohibited, employers do not have unlimited access to all communications that occur on corporate systems.
Companies should carefully review their policies to ensure that they can access their corporate IT equipment, at least to the extent permitted by European data privacy law. READ MORE
Today, Orrick announced the launch of our automated General Data Protection Regulation (GDPR) Readiness Assessment Tool, which makes the EU’s new, complex, data privacy law, the GDPR, more accessible. The free tool is available to all organizations and allows businesses to stress test their compliance against the upcoming GDPR. It segments the GDPR into 14 workable themes and guides the user through a series of dynamic questions relating to each theme. Upon completion of the assessment, the tool provides a complimentary tailored report summarizing the likely key impacts of the GDPR for an organization. READ MORE
January 10, 2017 marked another important step towards reform of the EU data protection framework, with the release of the EU Commission’s proposals for a new Regulation governing privacy and electronic communications.
The main aims of the draft Regulation are to update the ePrivacy Directive to reflect new technologies and to better align it with GDPR. In addition to taking effect on the same day as the GDPR (25th May, 2018), penalties for non-compliance envisaged by the draft Regulation are the same as the GDPR, (i.e. potentially fines of €20m or 4% of annual global turnover, whichever is higher).
Happy U.S. National Cybersecurity Awareness Month! One year ago, in recognition of the Department of Homeland Security’s annual campaign to raise awareness about cybersecurity, Orrick’s Cybersecurity & Data Privacy Group launched its award winning blog Trust Anchor.
Almost daily we hear news about data breaches, cybersecurity and privacy enforcement proceedings, litigation, and new laws and regulations. Trust Anchor covers it all: recent cases, legislative and regulatory developments, emerging compliance standards and best practices for cybersecurity and privacy risk management, insurance trends and more! But, we don’t just report on these events, we highlight key takeaways and what these developments mean for you.
As of, August 1st, 2016, U.S. companies can now join the Safe Harbor successor EU-U.S. Privacy Shield (the “Privacy Shield”) for personal data transfers from the EU to the U.S.
This post gives a high level summary of what companies should consider with the Privacy Shield.
On July 12, 2016, the European Commission (the “Commission”) formally adopted the adequacy decision necessary to implement the Privacy Shield. This means that transfers of personal data from the EU to the U.S. that are made pursuant to the Privacy Shield’s requirements are lawful under EU law. The Privacy Shield replaces the EU-U.S. Safe Harbor Framework, which was invalidated by the Court of Justice of the European Union (“CJEU”) on October 6, 2015.
On July 6, 2016, the European Parliament passed the Network and Information Security (“NIS”) Directive, over three years after the initial draft was proposed. The Directive will enter into force in August 2016. EU Member States will then have 21 months to transpose the Directive into their national laws and 6 additional months to identify the operators of certain essential services that are subject to the Directive’s requirements.
After receiving the approval of the EU Member States, through the Article 31 Committee, last Friday, the European Commission has today, July 12th, 2016, formally adopted the Adequacy Decision necessary to implement the EU-U.S. Privacy Shield (the Decision).
The Decision will be notified to Member States today and, as such, will be effective immediately.
The adoption process had stalled in recent months due to ongoing concerns about the access to personal data by public authorities in the U.S. You can read about some of these concerns in our previous blog post.
The European Commission has received further commitments from the U.S. and has agreed clarifications and improvements on the bulk collection of data, strengthening the Ombudsperson mechanism and more explicit obligations on companies as regards limits on retention and onward transfers. Those commitments and clarifications have been sufficient to allay the EU member states, at least for now.
The Privacy Shield is subject to an annual review mechanism.
Today the EU-U.S. Privacy Shield was approved by the EU Member States, which sets the stage for the European Commission to grant final approval to the Privacy Shield as a basis for EU-U.S. transfers of personal data.
This development follows criticisms of the Privacy Shield this past April from the Article 29 Working Party, an advisory group comprised of the EU privacy regulators. We summarized the primary criticisms in a prior blog post. The Working Party was responding to the draft adequacy decision that was released by the European Commission on February 29, 2016, which we summarized here. The revisions to the Privacy Shield are intended to address the criticisms of the Working Party but it is not yet clear if the criticisms have been fully reflected.
Website providers that collect dynamic Internet Protocol addresses (“IP address”) from website visitors may soon be subject to even more scrutiny from data protection authorities in the EU.
Last week, Europe’s Advocate General Manuel Campos Sánchez-Bordona (one of the advisors to the European Court of Justice, “ECJ”) released an opinion which, if followed by the ECJ would end a long debated question whether IP addresses are personal data subject to EU data privacy law. The Advocate General takes the view that dynamic IP addresses are personal data when being in the hands of a website provider when a third party (e.g. the internet access provider) has access to additional information that would enable identification of the Internet user.