Stransky, Steven

As a partner in the firm’s Business Litigation, Privacy & Cybersecurity, and Government Contracts groups, Steve primarily focuses on advising clients on complex national and international privacy and information security issues. He assists clients devise strategies to assess and mitigate cybersecurity and privacy risks, respond to cyber-attacks and data breaches, and maintain compliance with federal, state, and foreign laws and regulations governing data protection. He provides guidance on regulatory compliance and defends clients’ interests in litigation and government enforcement actions in the areas of data privacy and cybersecurity. In addition, Steve assists defense contractors and other private-sector businesses in satisfying cybersecurity standards issued by the federal government and in developing and maintaining insider threat programs.

Prior to joining Thompson Hine, Steve spent a total of 10 years serving in the federal government, including seven years with the U.S. Department of Homeland Security (DHS). While at DHS, he served as senior counsel in the Department’s Intelligence Law Division in Washington, D.C., where he oversaw the Department’s foreign intelligence, counterintelligence, and cybersecurity intelligence activities, including the production of cybersecurity threat assessments and data breach response recommendations for the private sector. He advised his clients on Executive Order 12333 and other intelligence community directives, orders, and procedures governing the collection, retention, and dissemination of foreign and domestic intelligence and data. Steve also provided guidance to DHS officials on designing and implementing programs and policies regulating the storage and safeguarding of classified and unclassified information and assisted DHS in designing and implementing an insider threat program in compliance with Executive Order 13587 and other national policies and standards.

In addition, Steve was selected to serve as a deputy legal adviser to the president’s National Security Council. In this role, he counseled White House officials on developing and coordinating a broad range of national security policies and programs, including on cybersecurity, intelligence and surveillance, and information sharing with foreign partners and the private sector.

Steve has obtained multiple credentials from the International Association of Privacy Professionals related to government and private sector data protection laws, statutes, regulations, and industry standards.

Also an adjunct law professor, Steve teaches courses on topics related to foreign affairs, intelligence activities, and national security law at the Frederick K. Cox International Law Center at Case Western Reserve University School of Law.

Data Privacy & Cybersecurity Compliance

Advised clients on drafting policies and procedures and developing internal compliance programs with respect to a broad range of data protection laws, statutes, and regulations, including consumer privacy requirements; employee data privacy notices and policies; data breach preparation and response; data subject requests; digital marketing and targeted advertising; medical data, clinical trials, and healthcare privacy laws; vendor management and data processing agreements; international data transfers and localizations; written information security plans; WCAG compliance; and biometric data processing.
Prepared data incident response plans and programs and assisted small, midsize, and large companies in responding to serious data events, including ransomware attacks and other incidents involving the unauthorized access, acquisition, or disclosure of personal data or confidential information.
Drafted online terms and conditions and privacy policies for domestic and global companies.
Prepared and negotiated third-party service provider agreements to address data privacy and information security, data breach liability, and confidentiality.
Assisted government contractors with adhering to the NIST standards and other federal regulations and rules on the safeguarding of controlled unclassified information.
Assisted organizations in establishing and maintaining insider threat programs to ensure the confidentiality and integrity of classified and other sensitive data.
Advised clients on a broad range of data protection laws, including the FTC Act, GLBA, HIPAA, CAN-SPAM, TCPA, COPPA, CFAA, ECPA, CCPA, CPRA, VCDPA, BIPA, and other privacy legislation.

California Consumer Privacy Act (CCPA)

Performed data mapping to identify whether an organization’s data processing activities implicate California residents and the CCPA.
Assessed and identified the current state of an organization’s policies and procedures to determine its compliance with the CCPA.
Drafted privacy notices and statements to address the CCPA’s notice requirement, including drafting website privacy policies, employee privacy statements, and job candidate privacy notices.
Drafted new, or supplement existing, internal policies and procedures to address how an organization will intake, process, and respond to CCPA data requests (e.g., access, portability, erasure).
Identified whether an organization “sells” personal information within the meaning of the CCPA, and, if so, developed mechanisms for customers to “opt in” or “opt out” of the sale of their personal information.
Provided contractual terms for an organization to use with its third-party vendors to ensure they address each party’s obligations pursuant to the CCPA and responsibilities related to data processing, assistance, and security.
Identified whether an organization offers financial incentives related to data processing and, if so, ensured such incentives align with the CCPA’s anti-discrimination requirements.
Drafted new, or reviewed existing, data incident response plans to ensure they align with California’s legal requirements and best practices.

Data Breach Response Matters

Assisted consumer goods company investigate and respond to data breach arising from unauthorized access to, and exfiltration of, customer data from the company’s third-party e-commerce platform due to compromise of an employee’s account credentials.
Counseled services industry business regarding Office 365 intrusion that resulted in malicious actor disseminating fraudulent invoices to customers from spoofed Internet domain.
Represented defense contractor in joint investigation by the Department of Defense and Federal Bureau of Investigation arising from Maze ransomware attack that potentially exposed controlled unclassified information, which resulted in the closure of the case without adverse action to client.
Assisted global manufacturing company in responding to ransomware attack that compromised sensitive employee and customer data, partnering with European Union counsel to facilitate notifications to supervisory authorities pursuant to the European Union (EU) General Data Protection Regulation and EU Member State law.
Counseled healthcare business associate regarding technical anomaly within its online patient portal that resulted in unauthorized disclosure of medical records and protected health information and drafted formal data breach notification communications and reports.
Advised private sector company with respect to an incident involving the unauthorized disclosure of sensitive employee data and invoking the “good faith” exception within certain U.S. state data breach notification laws.
Assisted global manufacturing company with response to the inadvertent disclosure of export-controlled data to foreign nationals, and drafting, preparing and submitting voluntary disclosures to federal department arising from the same.
Assisted employee health plan in investigating and responding to data breach that occurred within business associate’s information technology environment that resulted in unauthorized access to employees’ protected health information.
Assisted supply chain defense contractor with response to ransomware attack that compromised the confidentiality of sensitive employee data and controlled unclassified information, including drafting and submitting formal data breach notices to impacted individuals and government agencies.

The General Data Protection Regulation (GDPR)

Appointed by state attorney general to assist public university assess its compliance with the GDPR and UK Data Protection Act 2018, and retain and lead local counsel with respect to the same.
Assisted global enterprises in designing and implementing EU GDPR compliance programs, policies, and procedures.
Drafted webpage privacy policies for companies marketing and selling goods, services, and products in the European Economic Area (EEA).
Counseled clients on establishing and implementing procedures for exporting personal data from the EEA into the United States and other third countries.
Assisted companies in conducting data mapping exercises to identify the purpose, scope, and legal authorization for their data processing activities.
Drafted multiple joint controller and controller-to-processor data processing agreements for global corporations and their third-party service providers and contractors.
Drafted employee data privacy notices for global companies that have staff or contractors in the EEA.
Assisted multiple U.S.-based companies in evaluating whether they are legally required to appoint a Data Protection Officer (DPO) in accordance with the GDPR.
Provided legal analysis to several global companies on whether they need to undertake a data protection impact assessment (DPIA) when implementing routine and common business practices, such as network/employee monitoring.
Assisted businesses in responding to data subjects invoking rights under the GDPR, including a data subject’s requests for access and/or erasure.

M&A Due Diligence & Cybersecurity Risk

Provided businesses, including private investment firms, with data privacy and cybersecurity due diligence risk assessments in the M&A context.
Assisted in identifying a target company’s data processing activities, including how it collects, retains, and disseminates personal information.
Assessed whether a business’s data processing and cybersecurity measures satisfy federal, state, and foreign laws and regulations, and industry standards.
Provided recommendations, including representations and warranties, to purchasing companies to mitigate data privacy and cybersecurity risks when purchasing target companies.

Health & Medical Data Privacy

Appointed by state attorney general to counsel public university undertaking clinical trials in the European Union and the United Kingdom with respect to its legal obligations under data protection and pharmaceutical regulations and directives and, in conjunction with local counsel, develop and implement data protection and clinical trials compliance checklist.
Assisted covered entities in determining whether the unauthorized disclosure of protected health information constitutes a breach that warrants, in accordance with federal regulations, notification to the data subject and the Secretary of Health and Human Services.
Assisted covered entities and business associates in determining whether their encryption protocols satisfy certain technical safeguard requirements within the HIPAA Security Rule.
Drafted master contracts, including provisions governing data privacy and information security, for a global biopharmaceutical companies and their third-party contract research organizations.
Provided legal analysis to a late-stage drug testing firm on leveraging exemptions set forth in the GDPR to permit it to legally retain personal information concerning drug testing.
Determined whether a company’s notice and consent forms issued during medical clinical trial testing satisfy the EU Clinical Trials Regulation (No 536/2014) and other legal requirements.

Third Party IT Contracting

Drafted and negotiated a wide range of technology and data protection agreements and statements of work, including end user license agreements for software and embedded technology solutions; master service agreements with IT services providers; contracts and statements of work for cloud storage, penetration testing and vulnerability scanning, and managed IT services; and, personal data processing, transfer, and security agreements.
Routinely advised clients on third-party data security standards, data confidentiality and protection obligations, limited use and ‘do not sell’ clauses, third-party data assistance, cross-border data transfers and data localization, cyber insurance, and data breach response investigation, notification, and indemnification.

Panel Discussion, "Ethics in the Digital Age," Webinar, Baldwin Wallace University School of Business, April 22, 2021
Panel Discussion, "Global Issues Related to Arbitrating Data Breaches and Privacy Rights," ASIL Midyear Meeting, Case Western Reserve University School of Law, Cleveland, Ohio, October 29, 2020
"Cyber Risk Mitigation in the Chemical Sector," SOCMA Power Hour: A Fall Webinar Series, October 1, 2020
"New Frontiers in Export & Technology Controls," July 29, 2020
"Data Privacy Trends - How to Satisfy Privacy Notification Obligations in the Employment Arena," Association of Corporate Counsel, February 27, 2020
"Building an Incident Response Program," Information Security Summit, Cleveland, October 23, 2019
"The California Consumer Privacy Act: Implementing Sustainable Compliance Solutions," Information Security Summit, Cleveland, October 23, 2019
Panel Discussion, "Comparing International Terrorism and Domestic Violent Extremism," The Center for Strategic and International Studies, Washington, DC, September 16, 2019
"The Intersection of Legal and Cyber," CSO Xchange, Cleveland, August 7, 2019
"Cyber Security - Are You Ready?", SOCMA Executive Forum, University of Houston, May 23, 2019
"Staying Ahead of the Cybersecurity Curve: Practical Tips From the Experts," Thompson Hine LLP, Cleveland, May 16, 2019
"Data Privacy, the CCPA and Contracts: What You Need to Know," Association of Corporate Counsel, April 24, 2019
“What You Need to Know about Data Privacy Laws: International, Federal, State and Local,” The Association of Test Publishers, the Innovations in Testing Conference, Featured Speaker Session, March 18, 2019
“Meeting the Data Privacy Challenge: Complying with Multiple Laws in a Global Testing Environment,” The Association of Test Publishers, the Innovations in Testing Conference, March 19, 2019
“Reconciling the EU GDPR and US Discovery Obligations,” The William B. Bryant American Inn of Court, January 8, 2019
“GDPR: From Anticipation to Implementation,” Information Security Summit, October 25, 2018
“GDPR and Privacy Law,” Information Security Summit, October 23, 2018
“Understanding GDPR & Cyber Law,” BusinessTECH18 2018, October 18, 2018
“Privacy & Cybersecurity Compliance,” Thompson Hine Chief Compliance Officer Forum, October 4, 2018
“Strategies to Assess and Mitigate Cybersecurity Risks,” Ohio Electric Cooperatives, October 3, 2018
“Cybersecurity and Private-Public Partnerships,” Society for Corporate Governance, Cleveland, June 13, 2018
“Cybersecurity and Private-Public Partnerships,” USLFG Corporate and Securities Committee Meeting, Cleveland, May 15, 2018
"Cyber Threats & Public Private Partnerships," Chemistry Council of New Jersey 34th Annual Spring Conference, Princeton, New Jersey, May 1, 2018
“Managing Tomorrow’s Cyber Threats Today,” Thompson Hine LLP, Cleveland, April 26, 2018
Cleveland-Marshall College of Law 2018 Cybersecurity and Privacy Protection Conference, Cleveland, March 22, 2018
"Cybersecurity Risks and Employee Benefit Plans," WEB National Webinar, February 28, 2018

Professional Associations

Bar Association of the District of Columbia
International Association of Privacy Professionals, Certified Information Privacy Professional/Government (CIPP/G), Certified Information Privacy Professional/United States (CIPP/US)
Northern Ohio InfraGard Members Alliance
Ohio State Bar Association

Steven G. Stransky

Partner

Co-Chair, Privacy & Cybersecurity

Data Privacy & Cybersecurity Compliance

California Consumer Privacy Act (CCPA)

Data Breach Response Matters

The General Data Protection Regulation (GDPR)

M&A Due Diligence & Cybersecurity Risk

Health & Medical Data Privacy

Third Party IT Contracting

Society for Corporate Governance and Thompson Hine Review Board, Management Roles and Responsibilities Related to ESG Governance

‘A ‘Damned If You Do, Damned If You Don’t’- Type Thing: ESG Disclosures and the Prospect of Future Litigation

IM Coffee Chat - Recent Trends in Shareholder Litigation

Supply Chain Strategies - Policies and Practicalities to Address Transportation Challenges

SEC Proposes Enhanced Proxy Voting Disclosures

Securities Quarterly Update

Email Disclaimer

Thompson Hine LLP Disclaimer