Tanya Forsheit

Practicing primarily as a compliance and transactional attorney in the privacy and data security space, Forsheit admits there’s a lot she can’t discuss.

“A lot of these things never become public,” said Forsheit, who serves as outside counsel to the chore-sharing app TaskRabbit and online fraud protection company MaxMind. She’s also in the middle of a significant cyber breach investigation.

Every year, Forsheit and her team handle dozens of cybersecurity incidents, some of which are just troubleshooting to try to determine whether or not notices are legally required that would be sent to affected parties, state regulators or, in some cases, the media.

The process to determine the legally required steps isn’t easy. Oftentimes counsel works with a third-party, independent group to determine whether or not information was accessed or acquired. They also frequently collaborate with law enforcement, who handle the criminal investigation into the matter.

Once counsel has a sense of what happened, they determine how to proceed based on state, federal and international guidelines. They also handle any regulatory investigations and private litigation that the incident triggers.

What qualifies as sensitive information has expanded beyond social security numbers and health records to include more information such as an unencrypted email address or username with password, Forsheit said.

Because the internet is borderless, Forsheit spends a significant time working with companies to educate them and get them into compliance with European privacy and security regulations, which tend to be more stringent than in the U.S.

In September, her team published a white paper on how an upcoming major change in European cyber regulations is going to affect online publishers. It began as a legal memo commissioned by the firm’s client Digital Content Max, a large online publisher’s trade association that includes ABC, Bloomberg, ESPN, NBC, New York Times and NPR.

Though an experienced litigator, Forsheit said she now focuses more on proactive, rather than reactive, solutions.

“One of the reasons why I don’t do that much litigation anymore is because my clients just don’t get sued,” Forsheit said.

— Lila Seidman