Steven G. Stransky

Data Privacy & Cybersecurity Compliance

• Assisted government contractors with adhering to the NIST standards and other federal regulations and rules regulating the safeguarding of sensitive information.
• Prepared data incident response plans and programs and assisted small, midsize, and large companies in responding to serious data incidents, including ransomware attacks, by providing data breach notifications to victims, law enforcement, and other government entities in accordance with federal, state, and foreign laws and regulations.
• Assisted energy sector companies with adhering to federal, state, and industry cybersecurity regulations and standards on the protection of operational control systems and customer personal information.
• Drafted online terms and conditions and privacy policies for domestic and global companies.
• Assisted government contractors and private businesses in establishing and maintaining insider threat programs to ensure the confidentiality and integrity of classified and other sensitive information.
• Prepared and negotiated third-party service provider agreements to address data privacy and information security, data breach liability, and confidentiality.
• Advised clients regarding compliance with the FTC Act, GLBA, HIPAA, CAN-SPAM, COPPA, and other privacy legislation.

The General Data Protection Regulation (GDPR)

• Assisted global enterprises in designing and implementing EU GDPR compliance programs, policies, and procedures.
• Drafted webpage privacy policies for companies marketing and selling goods, services, and products in the European Economic Area (EEA).
• Counseled clients on establishing and implementing procedures for exporting personal data from the EEA into the United States and other third countries.
• Assisted companies in conducting data mapping exercises to identify the purpose, scope, and legal authorization for their data processing activities.
• Drafted multiple joint controller and controller-to-processor data processing agreements for global corporations and their third-party service providers and contractors.
• Drafted employee data privacy notices for global companies that have staff or contractors in the EEA.
• Assisted multiple U.S.-based companies in evaluating whether they are legally required to appoint a Data Protection Officer (DPO) in accordance with the GDPR.
• Provided legal analysis to several global companies on whether they need to undertake a data protection impact assessment (DPIA) when implementing routine and common business practices, such as network/employee monitoring.
• Assisted businesses in responding to data subjects invoking rights under the GDPR, including a data subject’s requests for access and/or erasure.

M&A Due Diligence & Cybersecurity Risk

• Provided businesses, including private investment firms, with data privacy and cybersecurity due diligence risk assessments in the M&A context.
• Assisted in identifying a target company’s data processing activities, including how it collects, retains, and disseminates personal information.
• Assessed whether a business’s data processing and cybersecurity measures satisfy federal, state, and foreign laws and regulations, and industry standards.
• Provided recommendations, including representations and warranties, to purchasing companies to mitigate data privacy and cybersecurity risks when purchasing target companies.

Health & Medical Data Privacy

• Assisted covered entities in determining whether the unauthorized disclosure of protected health information constitutes a breach that warrants, in accordance with federal regulations, notification to the data subject and the Secretary of Health and Human Services.
• Assisted covered entities and business associates in determining whether their encryption protocols satisfy certain technical safeguard requirements within the HIPAA Security Rule.
• Drafted master contracts, including provisions governing data privacy and information security, for a global biopharmaceutical companies and their third-party contract research organizations.
• Provided legal analysis to a late-stage drug testing firm on leveraging exemptions set forth in the GDPR to permit it to legally retain personal information concerning drug testing.
• Determined whether a company’s notice and consent forms issued during medical clinical trial testing satisfy the EU Clinical Trials Regulation (No 536/2014) and other legal requirements.

• “Preparing for Ohio’s Cybersecurity Safe Harbor Law,” Thompson Hine Privacy & Cybersecurity Update, October 2018
• Co-author, “Border searches of your e-device: encryption may be of limited value in protecting client data,” The Law for Lawyers Today, October 2018
• “California Becomes First State to Regulate Internet-Connected Devices,” Thompson Hine Privacy & Cybersecurity Update, October 2018
• "The National Cyber Strategy and Legal Reform," Lawfare, October 8, 2018
• Quoted in “New WH Cyber Strategy Talks Big Game, But Has Big Holes,” Law360, October 3, 2018
• “Amendments to California Privacy Law Will Impact Businesses,” Thompson Hine Privacy & Cybersecurity Update, October 2018
• “Border Searches and the Limits of Encryption in Protecting Privileged Information,” American Bar Association Litigation Magazine, Summer 2018
• “Enhancing Cyber Threat Information Sharing,” Pratt's Privacy & Cybersecurity Law Report, July/August 2018
• “California Expands Consumer Privacy Protections,” Thompson Hine Privacy & Cybersecurity Update, July 2018
• "Adviser: Strengthen Your Data Mapping in the Era of GDPR," Crain's Cleveland Business, May 2018
• “CEA Report: Cost of Malicious Cyber Activity to the U.S. Economy,” Thompson Hine Privacy & Cybersecurity Update, February 2018
• “The Uber Hack, State Enforcement and Strategic Planning,” Thompson Hine Business Law Update, Winter 2018
• “FERC Proposes Cybersecurity Incident Reporting Rule,” Thompson Hine Privacy & Cybersecurity Update, January 2018
• “Telephone Metadata and the Fourth Amendment: An Overview of Recent Case Law,” 35 St. Louis U. Pub. L. Rev 3, Fall 2015
• Co-author, “Regulating Classified and Controlled Unclassified Information,” Whistleblowers, Leaks, and the Media: The First Amendment and National Security, American Bar Association, 2014
• “Re-Examining the Falkland Islands War: The Necessity for Multi-Level Deterrence in Preventing Wars of Aggression,” 39 Ga. J. Int’l & Comp. L. 2, Fall 2012
• “The Nuclear Nonproliferation Treaty and Pakistan: Interpreting Nuclear Security Assistance Prohibitions,” 23 Fla. J. Int’l L. 2, Spring 2011
• “Sanchez-Llamas v. Oregon: A Missed Opportunity in Treaty Interpretation,” 20 St. Thomas L. Rev. 25, 2007

• “Privacy & Cybersecurity Compliance,” Thompson Hine Chief Compliance Officer Forum, October 04, 2018
• “Strategies to Assess and Mitigate Cybersecurity Risks,” Ohio Electric Cooperatives, October 3, 2018
• “Cybersecurity and Private-Public Partnerships,” Society for Corporate Governance, Cleveland, June 13, 2018
• “Cybersecurity and Private-Public Partnerships,” USLFG Corporate and Securities Committee Meeting, Cleveland, May 15, 2018
• "Cyber Threats & Public Private Partnerships," Chemistry Council of New Jersey 34th Annual Spring Conference, Princeton, New Jersey, May 1, 2018
• “Managing Tomorrow’s Cyber Threats Today,” Thompson Hine LLP, Cleveland, April 26, 2018
• Cleveland-Marshall College of Law 2018 Cybersecurity and Privacy Protection Conference, Cleveland, March 22, 2018
• "Cybersecurity Risks and Employee Benefit Plans," WEB National Webinar, February 28, 2018

Professional Associations

• Bar Association of the District of Columbia
• International Association of Privacy Professionals, Certified Information Privacy Professional/Government (CIPP/G)
• Ohio State Bar Association