Beyond FCRA and GLBA: Financial Institutions, State AI Laws, and Missing Exemptions

Mr. Cox advises clients across diverse industries on privacy and cybersecurity matters, from startups to large, highly regulated organizations. Leveraging his technical data analytics background, he provides comprehensive guidance on implementing information security and incident response programs and compliance questions surrounding deploying complex data-intensive products. Mr. Cox has experience in responding to data breaches, directing forensic investigations, and handling communications with stakeholders such as insurers, customers, regulators, and affected individuals. He also counsels businesses undergoing mergers or acquisitions on cybersecurity and privacy concerns throughout the process. Additionally, Mr. Cox helps clients draft privacy policies and terms of use that comply with North American and European requirements. He is a CIPP/US-certified privacy professional and stays at the forefront of emerging trends and regulatory changes. Mr. Cox offers clients a proactive approach to regulatory compliance, which includes advising on laws such as the NYDFS Cybersecurity Regulation, CCPA, CPRA, and GDPR, as well as industry-specific standards like HIPAA, NIST, and CIS.

Ms. Patel focuses on proactive compliance, regulatory engagement, and risk mitigation. She advises clients on building and strengthening privacy programs, responding to regulatory inquiries, and managing data incidents, including breach preparedness and response. Ms. Patel also counsels companies on integrating privacy, artificial intelligence, and biometric considerations into product design, marketing, and operational practices. With deep experience in the financial services sector, she regularly works with banks, lenders, fintech companies, investment advisors, and insurance companies on regulatory compliance and risk mitigation. Ms. Patel brings sector-specific insight to issues involving affiliate data sharing, innovative data uses, and complex data protection obligations, helping clients align compliance strategies with business goals. Her practice spans the full regulatory lifecycle, from proactive compliance planning and program implementation to enforcement avoidance and regulatory engagement, and combines practical, forward-thinking advice with a nuanced understanding of how evolving data protection frameworks impact businesses across industries.