Site Search
Professionals 653 results
Capabilities 91 results
Practice Area
Winston takes a strategic approach to privacy and data security, integrating our extensive capabilities across practices to provide our clients with cutting-edge privacy and data security counseling, crisis management, security incident investigation and notification management, defense of data security class action litigation and regulatory inquiries, and international data protection. Our Global Privacy & Data Security Practice features a core team of privacy professionals and is bolstered by more than 40 attorneys from a variety of other disciplines firmwide. Our team combines compliance counselors, transactional lawyers, former government regulators and federal prosecutors, seasoned investigators, and experienced litigators. Few firms can rival our in-depth, sophisticated, and integrated experience in this area.
Practice Area
Privacy: Regulated Personal Information (RPI)
Winston’s Regulated Personal Information (RPI) Practice offers seamlessly integrated counseling and litigation services to companies looking for practical and solution-oriented assistance navigating the compliance, regulatory, and private class action enforcement risks presented by the emerging patchwork of complex (and often conflicting) privacy laws in the United States and beyond.
Industry
For decades, Winston has filled a unique niche in the media and entertainment industry, and we continue to be at the forefront of today’s most important and challenging cases. Our interdisciplinary team advises some of the world’s most prominent industry players—studios, production companies, entertainers, artists, athletes, other celebrities, and other sector participants—in connection with the disputes and deals that are moving this dynamic industry forward.
Experience 46 results
Experience
|March 4, 2026
End of the Line: Winston Wins Unanimous Supreme Court Victory Against NJ Transit
In a unanimous decision authored by Justice Sotomayor, the U.S. Supreme Court held that NJ Transit is not an arm of the State of New Jersey and therefore is not entitled to sovereign immunity. The ruling means that plaintiffs injured by NJ Transit outside of New Jersey—such as in Pennsylvania and New York—may pursue claims in the courts of the states where their injuries occurred. The court adopted Winston’s position that state-created corporations that are formally liable for their own judgments are not arms of the state, reversing the Pennsylvania Supreme Court’s dismissal of Cedric Galette’s negligence suit while affirming the New York Court of Appeals’ decision allowing Jeffrey Colt’s case to proceed.
Experience
|September 8, 2025
Winston represents a class of professional swimmers alleging World Aquatics (WA) violated antitrust laws by blocking their participation in the competing International Swimming League. After WA won summary judgment, Winston successfully appealed, arguing the court applied improper antitrust standards and wrongly denied certification of a damages class. In September 2024, the Ninth Circuit reversed both rulings, reviving all claims and issuing a landmark ruling on the possible application of the per se rule or quick look review to sports-associations rules. Am Law awarded Winston “Litigator of the Week” Runner-Up recognition for the win. In November 2024, the Ninth Circuit denied rehearing. In April 2025, the district court certified a damages class.
Experience
|July 30, 2025
Represent Norman W. Fries, Inc. d/b/a Claxton Poultry Farms in a series of 15+ antitrust class actions consolidated in the Northern District of Illinois and brought by plaintiffs who allege that Claxton and the nation’s other largest poultry producers conspired to fix the price of broiler chickens in a scheme from 2008 to 2016 that raised the price for broiler chickens by artificially reducing supply.
Insights & News 6,015 results
Benefits Blast
|March 31, 2026
|10 Min Read
The U.S. Department of Labor (the DOL) has published its long-awaited proposed rule on selecting alternative investments in participant-directed 401(k) plans.
False Claims Act Playbook
|March 30, 2026
|7 Min Read
On February 24, 2026, the U.S. Department of Justice (DOJ) and the U.S. Department of Homeland Security (DHS) jointly announced that the U.S. Attorney’s Office in Chicago would be a lead prosecutorial partner on the recently launched interagency Trade Fraud Task Force. Originally launched on August 29, 2025, the Trade Fraud Task Force aims to aggressively pursue importers, purchasers, supply chain actors, and other entities engaged in customs fraud, including duty evasion, misclassification of goods, and smuggling of prohibited items. In this article, we evaluate DOJ’s continued commitment to designate substantial resources to its initiative to combat customs and trade fraud.
Other Results 197 results
Law Glossary
A privacy audit, also known as a privacy compliance audit, is an assessment tool that looks at an organization’s privacy protection policies and procedures, specifically in light of current relevant laws or regulatory requirements. The audits may be conducted by private organizations or by government agencies that are verifying a company’s regulatory compliance. In terms of privacy audit law, the FTC can conduct audits of organizations and take action when a company is improperly securing private information. Action is taken under the FTC Act, which covers unfair trade practices. Health Insurance Portability and Accountability Act audits are also conducted to ensure that providers are following HIPAA law and protecting private health information.
Law Glossary
What Is Privacy Compliance Law?
The area of privacy compliance law addresses how organizations meet legal and regulatory requirements for collecting, processing, or maintaining personal information. Data privacy breaches can lead to regulatory investigations and fines. When privacy is compromised, consumers or employees may respond with civil lawsuits. It is recommended, but not required by a federal law, that companies create and post privacy policies on websites and mobile apps. Once posted, companies must follow these policies or face scrutiny by the Federal Trade Commission. (California and Delaware state law does require privacy policies to be posted on websites and mobile applications, if the site collects personally identifiable information).
Law Glossary
What Is Privacy Assessment Law?
The Privacy Impact Assessment (PIA) is a method of privacy risk identification. It is an analysis of how personally identifiable information is collected, used, shared, and maintained by an organization’s system. Within the area of privacy assessment law, companies perform PIAs to verify and document that they are in compliance with state or federal privacy regulations for protecting personally identifiable information. The impact assessment identifies the risks of collecting and sharing personally identifiable information.