Sr Counsel - Data Privacy & Protection

Responsibilities

• Act as a key subject matter expert and advisor to Fujifilm attorneys and business teams on all matters relating to data privacy and protection law, including providing practical, timely, strategic, and high-quality legal advice on data privacy and security matters.
• Advise members of the legal and business teams on best practices and compliance with U.S. and global data protection laws, including legal and regulatory aspects of data collection and use, privacy disclosures and transparency, consent forms, and related issues.
• Collaborate with privacy and security colleagues to support and enhance the company’s privacy program to enable consistent, effective data privacy practices and minimize privacy risk.
• Support privacy impact assessments (PIAs/DPIAs), vendor risk reviews, and internal assessments using current data mapping and inventory information, collaborating with Data Governance Manager, as necessary.
• Support the development and management of privacy training and awareness initiatives to educate employees on privacy obligations, appropriate data handling, and regulatory requirements.
• Provide legal support for the strategic reviewing, drafting, and negotiating of AI, privacy and data security terms in contracts with business partners and vendors, including data processing agreements and data protection terms in agreements.
• Provide legal support for the drafting, reviewing and negotiating of AI, privacy and security related agreements, including Business Associate Agreements, Data Processing Agreements, Data Protection Agreements and Security Agreements.
• Provide advice and legal direction on data protection laws impacting business operations and contractual relationships.
• Strategically advise on emerging products and technologies while anticipating and successfully navigating privacy considerations.
• Provide legal counsel on investigations involving reports of inappropriate or unauthorized access, loss or disclosure of personal data, including advising on potential liability, identifying legal obligations, and supporting incident response efforts.
• Support development of enterprise-wide best practices for incident response readiness and advise on all aspects of incident response, whether privacy and/or cybersecurity related.
• Identify and advise on key legal issues requiring attention from the privacy compliance team and anticipate potential privacy legal issues within the organization.
• Provide legal counsel to Information Security, Compliance, and other individuals with privacy and data handling responsibilities in the organization to help set strategy and manage complex privacy matters involving systems and data processing activities.
• Support the organization’s AI governance and responsible use framework, ensuring alignment with applicable privacy, data protection, and ethical use standards, while monitoring emerging AI related privacy and data protection regulatory developments (e.g., U.S. state laws, GDPR adjacent obligations) and escalating impacts to leadership as needed.
• Partner with Compliance, Data Governance, IS, IT, and business stakeholders to assess privacy risks associated with AI and automated decision-making systems.
• Support HIPAA Privacy compliance obligations, as applicable, including incident response and regulatory alignment.

Requirements

• A JD degree and U.S. state bar membership in good standing are required.
• At least 8-12 years of experience as a practicing attorney, in-house and/or at a law firm, including at least 5-10 years of direct, hands-on experience providing legal counseling on data privacy and security matters.
• Understanding of relevant privacy statutes, regulations and guidance, such as comprehensive state privacy laws (e.g., CPRA, VDCPA), California Confidentiality of Medical Information Act (CMIA), state breach notification laws, HIPAA, EU General Data Protection Regulation (GDPR), TCPA, and CAN-SPAM.
• Substantial experience assessing legal risks relating to data protection and privacy, and AI, and identifying and advising on practical, compliant ways to mitigate those risks.
• Experience drafting and negotiating AI, privacy and security-related contracts and contract provisions.
• Experience with data loss prevention and cybersecurity events, including forensic investigations, breach notifications, and cybersecurity preparedness.
• Experience managing privacy and/or cybersecurity incident response efforts.
• Experience with privacy litigation and enforcement actions is a plus.
• Excellent negotiation and communication skills (both oral and written) are a must.