Craig Hoffman is a leading member of the firm's Chambers USA-ranked Privacy and Data Protection team. He provides proactive counsel on the complex regulatory issues that arise from data collection and use, including customer communications, data analytics, emerging payments, cross border transfers, and security incident response preparedness. He uses his experience as a litigator and work with hundreds of companies who have faced security incidents to help clients develop a practical approach to meet their business goals in a way that minimizes regulatory risk. For example, Craig conducts incident response workshops—built upon applicable notification laws and guidelines, "good" and "bad" examples from other incidents, and a tabletop exercise—to prepare companies to respond to security incidents quickly, efficiently, and in a manner that complies with applicable law while mitigating risk and preserving customer relationships.
Trusted for his knowledge, experience, and client service, Craig is engaged by clients as soon as they learn of a potential data security incident. He immediately begins to work with their internal team and third parties to identify and contain the incident, remediate issues to maintain business operations, and develop information needed to deliver effective public communications designed to preserve customer relationships and minimize the likelihood and consequences of litigation and regulatory investigations. Craig works to favorably position clients to face the card networks' revalidation, fines, and assessment rules in incidents involving payment card data. Craig also guides clients through informal and formal regulatory investigations brought by state attorneys general and the Federal Trade Commission (FTC). When putative class actions are filed, Craig uses his years of litigation experience and comprehensive knowledge of the incident response to ensure that the litigation strategy is consistent with the client's customer relations and regulatory defense efforts. Craig serves as the editor of BakerHostetler's Data Privacy Monitor blog, providing commentary on developments in data privacy, security, social media, and behavioral advertising.