Privacy & Information Security

Analysis Group assists clients at every stage of privacy and information security litigation by combining technical expertise in source code, data systems, and system architecture, with deep capabilities in economics, consumer behavior, marketing science, damages measurement, and cybersecurity.

Our experts evaluate issues related to liability, causation, injury, Article III standing, class certification, and damages in matters arising under domestic and international privacy laws and regulatory frameworks. Our experience spans matters involving among others: the California Invasion of Privacy Act (CIPA); the California Consumer Privacy Act (CCPA); the Video Privacy Protection Act (VPPA); the Biometric Information Privacy Act (BIPA); the Family Educational Rights and Privacy Act (FERPA); federal and state wiretapping and electronic communications laws; laws governing pen registers and similar tracking technologies; and General Data Protection Regulation (GDPR).

Analysis Group applies comprehensive economic, technical, and industry expertise to privacy and information security questions that appear in consumer and commercial litigation, regulatory proceedings, and business-to-business disputes involving the collection, access, use, sharing, and protection of data, as well as the responsibilities of companies, vendors, service providers, and other business partners. We also support organizations addressing privacy related allegations in competition cases, trade-secret theft and other intellectual property disputes, as well as matters of international arbitration, labor, securities, health litigation, and mass arbitrations.

We help clients answer questions on a range of topics, including:

• Data and Technology
  • What data were implicated and how do the affected data vary across individuals and other relevant dimensions?
  • Who received or accessed the data, for what purposes, and were reasonable industry standards followed to protect the data?
  • What was the relevant technology and how did it operate?
  • How was the data flowing through the data systems?
  • What specific data were collected, shared, or exposed as a result of the choice architecture?
  • What information is available on the dark web and when did it appear?
• Consumer perceptions/Surveys
  • What data privacy expectations do consumers have regarding the collection, use, sharing, and/or protection of their data?
  • How did website, application, or interface design, including alleged “dark patterns,” choice architecture, or allegedly deceptive design practices affect consumer attention, understanding, choices, or consent?
  • Did consumers understand the choices available to them regarding the collection, use, sharing, retention, or protection of their data, and what factors influenced those choices?
  • How did consumers understand a company’s privacy disclosures, and what expectations did those disclosures create?
  • How did consumers perceive an organization’s collection, receipt, use, sharing, or retention of data, and what evidence bears on allegations that those practices were unexpected or harmful?
• Damages/Class Certification
  • Is there a causal relationship between the alleged misuse, disclosure, or theft of consumer data and any subsequent alleged harm?
  • Was there any concrete, measurable economic injury, and if so, what was its extent and did it affect all impacted individuals uniformly?
  • What incremental costs and losses were incurred by a company following a cybersecurity incident?
  • Whether damages, if any, can be reliably measured and quantified, and, if so, what is the quantum of those damages?
  • Do the evidence and available data support common impact and class-wide damages, or do material differences among consumers predominate?

Our Methods