Morrison Foerster is an international law firm with lawyers practicing throughout the United States, Asia, and Europe. Click to discover more.

mofo_share_image.jpg

Morrison Foerster

common-default.jpeg

Terms / Notices

Cookies

Privacy Policy

Reporting Hotline

Attorney Advertising

Alumni

  Linkedin

MoFo LinkedIN

  Facebook

MoFo Facebook

YouTube

MoFo Youtube

Morrison Foerster - Footer

DOJ Offers Narrow Window to Comply With New Data Security Rules

You have not solved the recaptcha challenge yet or session expired, try again.

Email Disclaimer

Disclaimer

Unsolicited e-mails and information sent to Morrison Foerster will not be considered confidential, may be disclosed to others pursuant to our <a href="https://www.mofo.com/about/privacy-policy.html">Privacy Policy</a>, may not receive a response, and do not create an attorney-client relationship with Morrison Foerster. If you are not already a client of Morrison Foerster, do not include any confidential information in this message. Also, please note that our attorneys do not seek to practice law in any jurisdiction in which they are not properly authorized to do so.

Feedback

mofo-logo-2022.svg

People

Capabilities

Resources

About

Community

Offices

Careers

Stay Connected

Kaylee Cox Bankston, Joe Folio, and Josh Fattal published an article in Bloomberg Law that highlights nine (9) key insights for...

<h3>Sorry, we weren’t able to find the terms you entered.</h3>Please try a different term or keyword.

People

Capabilities

Resources

Not Found Cards

We are Morrison Foerster — a global firm of exceptional credentials. Our clients include some of the largest financial institutions, investment banks, and Fortune 100, technology, and life sciences companies. Our lawyers are committed to achieving innovative and business-minded results for our clients, while preserving the differences that make us stronger.Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations. Prior results do not guarantee a similar outcome.

About Morrison Foerster

people-default-header-desktop.jpg

people-default-header-mobile.jpg

Default Meta Data

Kaylee Cox Bankston, Joe Folio, and Josh Fattal published an article in Bloomberg Law that highlights nine (9) key insights for U.S. companies to keep in mind as they navigate the new requirements under the Department of Justice's Bulk Sensitive Data regulations.Read the <a href="https://www.bloomberglaw.com/bloomberglawnews/us-law-week/X88RE2UG000000?bna_news_filter=us-law-week#jcite" target="_blank">full article</a>.

DOJ Offers Narrow Window to Comply With New Data Security Rules

Sign Up

Kaylee Cox Bankston is a partner in Morrison Foerster’s Data, Cyber + Privacy Group. She advises clients across all industries on complex cybersecurity, privacy, and data matters, including cybersecurity investigations and breach preparation, corporate governance and risk management, regulatory investigations, litigation and class action defense, and other emerging industry issues, such as the use and impacts of artificial intelligence (AI). Kaylee was recognized by The Legal 500 US for her work in cyber law (including data privacy and data protection) in 2023 and 2025. Kaylee is also a co-author of The International Handbook of AI Law: A Guide to Understanding and Resolving the Legal Challenges of Artificial Intelligence.<ul><li>Cybersecurity Investigations and Incident Response Preparedness: Kaylee has extensive experience leading clients in investigations of sophisticated cyberattacks and security breaches conducted by high-profile threat actor groups, including ransomware, data extortion events, and business email compromises. She also counsels clients on incident response programs and preparedness, including developing and conducting cybersecurity simulations and tabletop exercises, preparing clients for security assessments, audits, and testing, and advising on post-assessment implementation and risk mitigation strategies. Kaylee advises clients on cybersecurity information and intelligence sharing, data access requests, and related national security matters.</li><li>Regulatory Investigations and Litigation: Kaylee has substantial experience representing clients in privacy and security investigations and related regulatory actions. She has represented companies in cybersecurity and privacy matters before U.S. and international regulators, including the U.S. Federal Trade Commission (FTC), the U.S. Securities and Exchange Commission (SEC), the U.S. Department of Justice (DOJ), the U.S. Department of Health and Human Services, Office of Civil Rights (HHS OCR), New York Department of Financial Services (NYDFS), and state attorneys general, and in litigation matters in various U.S. federal and state courts.</li><li>Compliance, Corporate Governance, and Public Companies Counseling: Kaylee has counseled numerous companies on how to navigate and comply with the new DOJ “Bulk Data” regulations, implementing Executive Order 14117. She has advised clients on the recent SEC Cybersecurity Disclosure Rules, including counseling on disclosure obligations for material cybersecurity incidents and developing annual SEC cybersecurity disclosures for publicly traded companies. Kaylee also counsels executives and boards of directors on cybersecurity and privacy corporate governance and risk management matters and regularly advises clients on the development of cybersecurity and privacy programs and compliance with other regulatory requirements and standards, such as the NYDFS Part 500 cybersecurity requirements, the FTC Safeguards Rule, the FTC Act, the California Consumer Privacy Act (CCPA) and state data privacy laws, the Illinois Biometric Information Privacy Act (BIPA), the Children’s Online Privacy Protection Act (COPPA), the Health Insurance Portability and Accountability Act (HIPAA), the Family Educational Rights and Privacy Act (FERPA), the Gramm-Leach-Bliley Act (GLBA), and the Payment Card Industry Data Security Standard (PCI DSS).</li><li>Corporate Transactions and Vendor Management: Kaylee counsels clients on vendor management programs, including developing security and privacy contracting frameworks and negotiating data protection agreements. Kaylee also advises clients on privacy and security diligence matters in connection with corporate transactions.</li></ul>Kaylee is an adjunct professor at Georgetown University Law Center, where she teaches a cybersecurity course. Kaylee is a Certified Information Privacy Professional (CIPP) through the International Association of Privacy Professionals. She previously served on the Center for a New American Security, Technology Policy Lab Working Group for Data Privacy and the Bar Association of the District of Columbia Board of Directors and National Security Steering Committee. She is also a member of Women in CyberSecurity (WiCyS).

Kaylee Bankston

Partner

Joseph Folio is a trial lawyer and partner in Morrison Foerster’s Global Antitrust Law, Congressional Investigations (co-chair), Crisis Management, and Data, Cyber + Privacy Groups, with more than a dozen years of experience leading complex government investigations and high-profile litigation.Joe has extensive experience in cartel investigations, congressional investigations, and complex civil litigation. Having served in all three branches of the federal government, and with his experience in both criminal and civil litigation, Joe is able to leverage his insider knowledge across a variety of enforcement perspectives to guide clients through difficult cases. He is also a member of our global Sustainability + Corporate Responsibility steering committee.As a prosecutor in the Antitrust Division of the U.S. Department of Justice (DOJ), he investigated companies and individuals involved in domestic and international antitrust cartels. Among them, he oversaw all aspects of the investigation into generic pharmaceuticals as the case’s chief of staff, including the handling of the parallel multidistrict litigation case brought by several state attorneys general and private plaintiffs. He also prosecuted and investigated cases in the international freight forwarding industry and cases involving bid rigging in state infrastructure projects.Prior to joining Morrison Foerster, Joe served as Chief Counsel for the Committee on Homeland Security & Governmental Affairs, the chief oversight committee of the U.S. Senate. In this position, he oversaw a variety of investigations, including the coordination of investigations with other Senate and House committees with overlapping jurisdictions. He also advised the committee on all policy issues falling within its broad jurisdiction, including cybersecurity, border security, domestic terrorism, election security, supply chain security (including 5G policy), and reforming the National Emergencies Act. Joe advised committee members on oversight of the Cybersecurity and Infrastructure Security Agency (CISA) within the Department of Homeland Security, legislation providing CISA with administrative subpoena authority, the creation of the National Cyber Director, and oversight of government and private efforts to protect against and respond to cyber breaches and ransomware attacks.While at the Federal Programs Branch of the DOJ’s Civil Division, Joe handled complex, high-profile litigation, focusing largely on national security matters, and his clients included the FBI; the Departments of Defense, Homeland Security, and State; and several members of the U.S. Intelligence Community. He also represented the Export-Import Bank against multiple administrative and constitutional challenges. Due to the cutting-edge nature of this litigation, he has experience navigating the inter-agency process when cases raise novel legal or policy issues that must be resolved at the highest levels.Joe received his B.A., magna cum laude, in philosophy and government from Georgetown University; M.A. with honors in national security studies from Georgetown University; and J.D., cum laude, from the George Mason University School of Law. After graduating from law school, Joe clerked for the Honorable Richard L. Voorhees in the U.S. District Court for the Western District of North Carolina.<h4>Representative Matters</h4>Antitrust<ul><li>Representing a major U.S. healthcare company in a criminal antitrust investigation of alleged “no-poach” conduct.</li><li>Representing a senior executive of an international company in a U.S. criminal cartel investigation.</li><li>Representing Nexstar Media Group in a putative class action alleging that certain media companies conspired to fix the prices of local television advertising.</li></ul>Congressional Investigations<ul><li>Representing Andy Karsner, a member of ExxonMobil’s board of directors, in response to a high-profile House Oversight and Reform Committee investigation regarding the role of the fossil fuel industry in addressing climate change, including preparing him to testify before the committee.</li><li>Representing a former government official who testified before the House Select Committee to Investigate the January 6th Attack on the U.S. Capitol.</li><li>Representing a Fortune 100 company responding to inquiries from committees and members regarding its policies and practices.</li></ul>

Joseph Folio III

Joshua R. Fattal is an associate in Morrison Foerster’s Data, Cyber + Privacy Group. He advises clients across industries on data protection best practices with a focus on emerging issues at the intersection of data privacy, security, and new technologies, including artificial intelligence (AI) and national security regulations pertaining to sensitive U.S. personal data.Joshua regularly counsels clients ranging from startups to multinational corporations on the legal implications of using AI and large language models (LLMs). He advises on compliance with global AI regulations, including the EU AI Act and Colorado AI Act, and provides guidance on AI governance, responsible AI use, and generative AI best practices.He also advises clients on compliance with U.S. laws governing the protection of sensitive data from adversary countries. He has assisted in clients’ complex due diligence of their data use and disclosure practices and in developing cross-functional compliance programs to meet evolving cross-border data transfer requirements.Joshua’s experience spans a variety of industries, including technology, life sciences, edtech, fintech, crypto, and consumer services. He counsels clients on compliance under local, state, and federal privacy regulations such as the California Consumer Privacy Act (CCPA), biometric and financial data privacy laws, and cybersecurity regulations. He also guides clients through compliance with international frameworks like the General Data Protection Regulation (GDPR), the EU-U.S. Data Privacy Framework, and the EU ePrivacy Directive.His practice encompasses data incident response strategies, including breach investigations and regulatory notifications. He also conducts privacy and cybersecurity due diligence for corporate transactions and advises on information security policies, cybersecurity governance, vendor risk management, and privacy-by-design product development.Joshua maintains an active pro bono practice. He has successfully secured asylum for multiple clients, including a Cameroonian political activist and a Honduran survivor of gender-based violence. He has also represented tenants in housing litigation and advised nonprofits on privacy and cybersecurity matters.Joshua earned his J.D. from NYU School of Law, where he graduated cum laude, was a Robert McKay Scholar, and received the full tuition ASPIRE Cybersecurity Scholarship. He received his B.A., magna cum laude, from Columbia University and is a member of Phi Beta Kappa. He previously served in the U.S. Intelligence Community, including as an attorney advisor in the Intelligence Law Division at the U.S. Department of Homeland Security. He also clerked for the Honorable Sarah Netburn, U.S. Magistrate Judge in the Southern District of New York.