John A. Vogt

Vogt is a founding member of Jones Day’s 91-lawyer cybersecurity, privacy and data protection practice. In more than 20 years at the firm, he has defended more than 100 state, federal and national class actions involving data breach and consumer privacy issues. He advises clients on their cybersecurity and data privacy obligations and leads teams responding to state attorney general and government regulatory investigations over cybersecurity and data privacy issues.

He advises clients on their upcoming obligations under the new California Consumer Privacy Act, which was enacted in June 2018 and takes effect Jan. 1, 2020. “Businesses that fall within the statute should be actively pursuing compliance,” Vogt said. He noted in a Daily Journal column in September, written with two Jones Day colleagues, that the CCPA creates new data privacy rights that in turn create additional requirements for businesses related to notice, disclosure and response to consumer requests—rights that go further even than the European Union’s new General Data Protection Regulation.

“We ask large companies with lots of subsidiaries whether there’s a uniform policy. We ask whether they encrypt their data, and point out that encryption is a defense when there’s a breach.”

Officials from the state attorney general’s office have scheduled public forums in six cities this month and in February to discuss the new law.

“The state is taking this very seriously, and so are lawyers,” Vogt said.

A major client is Experian Data Corp., a consumer credit reporting agency. In one of several cases for Experian, Vogt is the lead lawyer in what began as a nationwide class action arising from the acts of a now-convicted identity thief who posed as a private investigator and accessed credit data including Social Security numbers.

“It started as a humungous case with all sorts of negligence and damages claims,” Vogt said. “Plaintiffs’ counsel thought they could show harms traceable to a data breach—which is very hard to do. We said we think we can persuade you to dismiss, and we showed them the transcript from the thief’s criminal trial, which had testimony showing the information came not from Experian but from a Russian hacker.”

Opposing counsel dismissed their original complaint and refiled with a new theory and new plaintiffs. Vogt got two more dismissals and has now narrowed the litigation to three plaintiffs in three states seeking only injunctive relief. Vogt said he is poised to file a summary judgment motion. Patton v. Experian Data Corp., 8:17-cv-01559 (C.D. Cal., filed Sept. 8, 2017).

“It went from a national class action to a three-state case,” Vogt said.

– John Roemer