Consumer Data Transfers Under New Privacy Laws: Contracting Requirements; Due Diligence; Vendor Management
Best Practices for Drafting and Modifying Documents to Ensure Continued Compliance With Ever-Evolving Privacy Laws

Course Details
- smart_display Format
On-Demand
- signal_cellular_alt Difficulty Level
Intermediate
- work Practice Area
Commercial Law
- event Date
Tuesday, October 10, 2023
- schedule Time
1:00 p.m. ET./10:00 a.m. PT
- timer Program Length
90 minutes
-
This 90-minute webinar is eligible in most states for 1.5 CLE credits.
This CLE course will guide business and technology counsel in managing transfers of U.S. consumer data in light of nearly a dozen new state privacy laws, including on conducting data practice assessments and drafting and updating technology vendor agreements, and data sales and license agreements, to meet the new and upcoming requirements of these laws. In addition, the new EU/U.S. personal data transfer mechanism, the Data Privacy Framework (DPF), which replaces Privacy Shield, and how to qualify under it will be explained. The panel will also discuss the evolving privacy landscape and provide practical advice to ensure that businesses abide by enhanced protections for consumers by reviewing requirements for compliance, differences in the scope of application with the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA), the EU General Data Protection Regulation, and other state privacy laws as well as due diligence tactics for evaluating personal data transfers.
Faculty

Ms. Yushchak has over 20 years of experience in technology and litigation consulting, including compliance consulting relating to EU privacy and data protection laws (including, but not limited to, the GDPR), e-discovery and litigation support, cyber breach, change management, and information governance.

Ms. Jacobson is a partner in the Data Privacy, Cybersecurity & Digital Assets Practice. She offers practical and tactical counsel on privacy and cybersecurity compliance strategies, data breach response, technology transactions and marketing initiatives for national and multinational organizations. Ms. Jacobson assists clients with the design and development of privacy-sensitive policies for the collection and use of personal data. She regularly advises businesses on the privacy and cybersecurity aspects of environmental, social and governance (ESG) programs, ethical data use, machine learning and artificial intelligence, vendor contracting and management and business sales, combinations and acquisitions.

Mr. Friel is a thought leader in digital media, IP, data privacy and protection, and consumer protection law, with over three decades of relevant experience to address the intersection of law and technology. Having served as a GC for several years in the late 1990s before returning to private practice, Mr. Friel has the necessary expertise to advise clients on making practical and informed business decisions, and help companies and entrepreneurs navigate the complex opportunities created by disruptive technology. With his in-house and private practice experience, he assists clients with creating data inventories, and information governance and data privacy and security programs; developing and implementing policies and procedures for providing consumer data privacy transparency, choice and access; drafting and negotiating privacy and data security provisions for commercial contracts; evaluating privacy impact assessments; addressing data privacy and security issues in merger and acquisitions transactions; structuring personal data transfer arrangements (including cross-border, intracompany, sales and licenses, and disclosures that are exempt from, and/or comply with, certain legal restrictions); drafting and revising external and internal privacy and data security policies and procedures; and addressing complex intellectual property and consumer protection issues related to digital media, advertising and commerce, such as in connection with the development and deployment of artificial intelligence, tailored and targeted advertising practices, and digital transformation and data commercialization strategies. Mr. Friel is a sought-after speaker and is affiliated with UCLA as an assistant professor in a multidisciplinary project at the Graduate School of TV, Film and Digital Media, and is an adjunct professor at Loyola Marymount School of Law.
Description
U.S. consumer privacy compliance continues to evolve as California has strengthened its law and nearly a dozen states have followed with their own legislation. Companies must be aware of what this means for privacy regulation in California and beyond.
As of Jan. 1, 2023, human resources and B-to-B personal data are now fully in scope under CCPA. While the other states have limited the scope of regulation to traditional consumers, most join California in providing special treatment for "high risk" activities such as the sale of personal data, transfers related to targeted (cross-context) advertising, sensitive personal data, and profiling. This includes the need to conduct and document data practice assessments for these activities, including considering vendors and other recipients. Many of the states also require contracts with recipients with requirements for specific provisions.
Since Privacy Shield was invalidated, personal data transfers from the EU to the U.S. have been challenging, necessitating the use of standard contractual clauses (SCCs) or binding corporate rules and complex transfer risk assessments (TRAs)/transfer impact assessments (TIAs). The need for TRAs/TIAs has made use of U.S. vendors to process exported EU personal data challenging. In July 2023, the EU found adequacy for the DPF, designed to replace Privacy Shield, and ruled that transferring under the DPF no longer requires TRAs/TIAs. Learn how to qualify for DPF and how DPF adequacy can be leveraged to aid in completing TRAs/TIAs if SCCs remain the applicable vendor transfer mechanism.
Listen as our authoritative panel of privacy attorneys and consultants clarifies state privacy law and DPF requirements and provides best practices for drafting and modifying documents to ensure continued compliance.
Outline
- History of U.S. state consumer privacy laws
- What has changed under the new generation of U.S. consumer privacy laws
- Contracting requirements for personal data transfers under U.S. consumer privacy laws
- The benefits of DPF for EU-U.S. personal data transfers and how to qualify for DPF and leverage it for non-DPF transfers
- Performing due diligence on existing vendor agreements for compliance
- Drafting vendor and third-party transfer contracts or amending existing agreements
- Tips for implementing an effective vendor risk management program
Benefits
The panel will review these and other relevant topics:
- Data transfer contracting requirements under new U.S. consumer privacy laws:
- for service providers/processors
- for other transfers (sales and licenses)
- regarding sensitive data, targeted advertising, and other high risk data practices
- The role of assessments
- How DPF can be used to enable EU-U.S. personal data transfer
- Vendor management best practices
Unlimited access to premium CLE courses:
- Annual access
- Available live and on-demand
- Best for attorneys and legal professionals
Unlimited access to premium CPE courses.:
- Annual access
- Available live and on-demand
- Best for CPAs and tax professionals
Unlimited access to premium CLE, CPE, Professional Skills and Practice-Ready courses.:
- Annual access
- Available live and on-demand
- Best for legal, accounting, and tax professionals
Related Courses

USTR Final Action on Port Entry Fees for Chinese-Operated, -Owned, and -Built Vessels; Non-U.S. Built Vehicle Carriers
Tuesday, May 6, 2025
1:00 p.m. ET./10:00 a.m. PT

Supply Agreements: Structuring Defense, Indemnity, and Insurance Provisions
Thursday, May 29, 2025
1:00 p.m. ET./10:00 a.m. PT

M&A Asset Sales vs. Stock Sales: Pros and Cons of Each Structure, Buyer and Seller Preferences, Negotiation Strategies
Friday, May 23, 2025
1:00 p.m. ET./10:00 a.m. PT
Recommended Resources
Navigating Modern Legal Challenges: A Comprehensive Guide
- Business & Professional Skills
- Career Advancement
How to Build a Standout Personal Brand Without Sacrificing Billable Hours
- Career Advancement