In a recent article we discussed the cybersecurity challenges for publicly traded companies with Nardello & Co. One of the issues of concern raised was the potential for insider trading to occur in the context of a cyber breach. In March, a former top executive of Equifax was charged with insider trading in connection with a breach. This raises a host of new questions about how publicly traded companies – which are almost invariably multinational – should respond to a cyber breach. Now, with the GDPR (General Data Protection Regulation) entered into force for more than a month, many companies are being overwhelmed with complaints and requests for information. If a cyber incident occurs, in addition to U.S. law implications in the securities law context, listed companies need to consider global regulation and obligations applicable to data breach issues generally.
Mark Ray and John Fitzpatrick are Managing Directors at Nardello & Co., a global investigations firm that, among other things, specializes in cybersecurity consulting, internal investigations and incident response. Ray is a former special agent with the Federal Bureau of Investigation who led global investigations involving transnational cyber-criminal organizations, and currently leads Nardello’s Digital Investigations and Cybersecurity practice from the U.S. Fitzpatrick is based in the UK, and is an international lawyer with more than 20 years of legal, compliance and regulatory experience in multiple countries in EMEA, including expertise on data privacy issues, and in particular GDPR.
