HJ Brehmer – Debevoise Data Blog

Announcement

Debevoise Data Blog: Top 5 Privacy Posts of 2025

By: Charu A. Chandrasekhar, Luke Dembosky, Avi Gesser, Erez Liebermann, Robert Maddox, Julie M. Riewe, Kristin Snyder, Rick Sofield, Sheena Paul, Johanna Skrzypczyk, HJ Brehmer, Martha Hirst, Suchita Mandavilli Brundage, Melyssa Eigen, Ned Terrace, Michelle Shen, Diane Bernabei and Mengyi Xu December 11, 2025

As we approach the end of the year, here are the top 5 privacy posts on the Debevoise Data Blog in 2025. Takeaways for Large Firms from the SEC’s Reg…

Announcement

Debevoise Data Blog: Top 5 Cybersecurity Blog Posts of 2025

By: Andrew J. Ceresney, Charu A. Chandrasekhar, Luke Dembosky, Avi Gesser, Daniel M. Gitner, Erez Liebermann, Jim Pastore, Benjamin R. Pedersen, Jeff Robins, Julie M. Riewe, Kristin Snyder, Matt Kelly, HJ Brehmer, John Jacob, Gabriel Kohan, Amer Mneimneh, Andreas Constantine Pavlou, Lily Schoen, Cameron Sharp, Stephanie Thomas and Cindy Tu December 10, 2025

As we approach the end of the year, here are the Top 5 Cybersecurity posts on the Debevoise Data Blog in 2025. 1. Protecting Privilege in Incident Response: Litigation Lessons…

Cybersecurity

Protecting Privilege in Incident Response: Litigation Lessons

By: Luke Dembosky, Daniel M. Gitner, Erez Liebermann, Jim Pastore, HJ Brehmer, Gabriel Kohan and Amer Mneimneh September 15, 2025

Overview Companies responding to data breaches are faced with the question of whether their incident response investigation is protected by attorney-client privilege or attorney work-product doctrine. The issue primarily relates…

CCPA

CPPA Adopts Long Awaited Rulemaking Package

By: Avi Gesser, Johanna Skrzypczyk, HJ Brehmer and Melyssa Eigen July 25, 2025

The California Privacy Protection Agency (the “CPPA”) Board met on July 24, 2025, to decide whether to adopt its comprehensive rulemaking package covering cybersecurity audits, automated decision-making technology, and other…

Artificial Intelligence

An Employee Just Uploaded Sensitive Data to a Consumer AI Tool – Now What?

By: Avi Gesser, Matt Kelly, HJ Brehmer, Michael Bloom and Nathaniel Waldman April 16, 2025

Most companies have implemented protocols for when an employee emails confidential information to the wrong person. A new version of that problem occurs when an employee uploads sensitive information to…

Automated Decision Making

CPPA Proposed Rulemaking Package Part 2 – Automated Decision-Making Technology

By: Avi Gesser, Matt Kelly, Johanna Skrzypczyk, HJ Brehmer, Amer Mneimneh, Ned Terrace and Mengyi Xu February 13, 2025

In Part 1 of this series, we discussed the annual cybersecurity audit requirements in the proposed rulemaking package (the “Draft Regulations”) of the California Privacy Protection Agency (the “CPPA”). In…

CISA

Webcast – CISA Proposes Major Reporting Obligations for Critical Infrastructure

By: Luke Dembosky, Erez Liebermann, HJ Brehmer and Stephanie Thomas April 12, 2024

On April 22, 2024, Luke Dembosky, Erez Liebermann, HJ Brehmer, and Stephanie Thomas from our Data Strategy and Security Group hosted the next installment of our Data Security Webcast, where…

CISA

CISA Proposes Major Reporting Obligations for Critical Infrastructure

By: Avi Gesser, Luke Dembosky, Jim Pastore, Erez Liebermann, Caroline Novogrod Swett, HJ Brehmer, Gabriel Kohan, Michael R. Roberts, Stephanie Thomas and Annabella M. Waszkiewicz April 8, 2024

Adding to the growing number of cybersecurity incident reporting obligations, the Cybersecurity and Infrastructure Security Agency (“CISA”) has introduced a reporting requirement that will impact all critical infrastructure sectors, featuring…

Cybersecurity

NIST Releases Most Significant Update to Cybersecurity Framework Since 2014

By: Avi Gesser, Erez Liebermann, Michael R. Roberts, HJ Brehmer and Annabella M. Waszkiewicz March 14, 2024

On February 26, 2024, the National Institute of Standards and Technology (“NIST”) announced the release of Version 2.0 of the Cybersecurity Framework (“Version 2.0” or the “Framework”). We previously wrote…

Cybersecurity