Morrison Foerster is an international law firm with lawyers practicing throughout the United States, Asia, and Europe. Click to discover more.

mofo_share_image.jpg

Morrison Foerster

common-default.jpeg

Terms / Notices

Cookies

Privacy Policy

Reporting Hotline

Attorney Advertising

Alumni

  Linkedin

MoFo LinkedIN

  Facebook

MoFo Facebook

YouTube

MoFo Youtube

Morrison Foerster - Footer

A Look At Shifting Legal Landscape For Data Brokers

You have not solved the recaptcha challenge yet or session expired, try again.

Email Disclaimer

Disclaimer

Unsolicited e-mails and information sent to Morrison Foerster will not be considered confidential, may be disclosed to others pursuant to our <a href="https://www.mofo.com/about/privacy-policy.html">Privacy Policy</a>, may not receive a response, and do not create an attorney-client relationship with Morrison Foerster. If you are not already a client of Morrison Foerster, do not include any confidential information in this message. Also, please note that our attorneys do not seek to practice law in any jurisdiction in which they are not properly authorized to do so.

Feedback

mofo-logo-2022.svg

People

Capabilities

Resources

About

Culture

Offices

Careers

Stay Connected

This article discusses the evolving legal landscape for data brokers in 2025, highlighting new state and federal regulations aimed at enhancing national security and consumer protection. 

We are Morrison Foerster — a global firm of exceptional credentials. Our clients include some of the largest financial institutions, investment banks, and Fortune 100, technology, and life sciences companies. Our lawyers are committed to achieving innovative and business-minded results for our clients, while preserving the differences that make us stronger.Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations. Prior results do not guarantee a similar outcome.

About Morrison Foerster

people-default-header-desktop.jpg

people-default-header-mobile.jpg

Default Meta Data

This article discusses the evolving legal landscape for data brokers in 2025, highlighting new state and federal regulations aimed at enhancing national security and consumer protection. It also notes the expansion of the definition of data brokers to include consumer-facing businesses under state and federal requirements, and the implications for compliance. The article also covers the Consumer Financial Protection Bureau's proposed rules to extend the Fair Credit Reporting Act's reach and new federal laws restricting the sale of personal information to foreign adversaries. The authors emphasize the need for businesses to promptly evaluate their operations to ensure compliance with these new requirements.Read the <a href="https://www.law360.com/articles/2291316/a-look-at-shifting-legal-landscape-for-data-brokers" target="_blank">full article</a>.

A Look At Shifting Legal Landscape For Data Brokers

Sign Up

Boris Segalis is a partner in Morrison Foerster’s Privacy + Data Security Group. For over a dozen years, he has counseled clients on privacy and cybersecurity issues in the context of strategic product advice, corporate transactions, and regulatory investigations.Boris regularly advises clients on the development and implementation of data-driven products and services, on global privacy and cybersecurity compliance, and on handling cyber incidents affecting companies and users globally. Boris also regularly defends companies in U.S. federal, state, and global privacy and cybersecurity investigations, including representing clients in front of the Federal Trade Commission (FTC), the New York and California attorneys general, and foreign regulators.Boris’s practice focuses on advising clients on the requirements of a variety of U.S. privacy and cybersecurity laws, including the California Privacy Rights Act (CCPA/CPRA) and other U.S. state privacy laws; state cybersecurity requirements such as the New York State Department of Financial Services (NYDFS)’s Cybersecurity Regulation; the Children’s Online Privacy Protection Act (COPPA); the Family Educational Rights and Privacy Act (FERPA); CAN-SPAM; NIST’s Cybersecurity Framework (CFS); the Telephone Consumer Protection Act (TCPA); and the Video Privacy Protection Act (VPPA). Boris regularly advises financial institutions and Fintech companies on the Gramm-Leach-Bliley Act (GLBA), the Fair Credit Reporting Act (FCRA), and the Payment Card Industry Data Security Standard (PCI DSS). Boris also has experience advising companies on privacy concerns stemming from the Illinois Biometric Information Privacy Act (BIPA) and other biometric data requirements. Boris has a strong command of global privacy and cybersecurity laws and advises companies on regulations such as the General Data Protection Regulation (GDPR), the EU-U.S. Data Privacy Framework, and the EU’s ePrivacy Directive.Boris counsels clients ranging from emerging to late-stage to public companies across industries, including technology, data brokerage, AI, financial services and Fintech, crypto, life sciences, consumer services, e-commerce, AdTech, media, and others. For seven consecutive years, Boris has been individually recognized by Chambers USA in the Privacy & Data Security category and is recognized by Chambers Global for Privacy & Data Security – USA. He has also been recognized by The Legal 500 as a leading lawyer in cyber law (including data privacy and data protection). Crain’s New York Business has previously included him in its 40 Under 40 list, and New York Metro has recognized Boris as both a Super Lawyer and a Rising Star.Boris is a Certified Information Privacy Professional (CIPP/US) through the International Association of Privacy Professionals (IAPP), has previously served as co-chair of NYC IAPP KnowledgeNet, and served on the IAPP’s Research Board. Boris currently serves as one of the leaders of the UJA Privacy and Cybersecurity Group. Boris also is an adjunct professor at Vanderbilt University School of Law, where he co-teaches a class on the law of data as an asset.

Boris Segalis

Partner

Joshua R. Fattal is an associate in Morrison Foerster’s Privacy + Data Security Group. He advises clients across industries on data protection best practices, product development, complex national and international regulatory compliance, transaction diligence, incident preparedness and response, and emerging topics, such as the use of artificial intelligence (AI).Joshua regularly counsels clients in a variety of industries on complex data privacy issues related to local, state, and federal legal frameworks, including the California Consumer Privacy Act (CCPA) and other U.S. state privacy laws; the Biometric Information Privacy Act (BIPA) and other U.S. state and local biometric laws; the Gramm-Leach-Bliley Act (GLBA); the Fair Credit Reporting Act (FCRA); the Telephone Consumer Protection Act (TCPA); the Children’s Online Privacy Protection Act (COPPA); and the Family Educational Rights and Privacy Act (FERPA). Joshua also advises clients on cybersecurity laws, regulatory requirements, and best practices, including the SEC’s cybersecurity disclosure rules for public companies, registered investment advisors, and broker-dealers; the New York State Department of Financial Services’ (NYDFS) Cybersecurity Regulation; and the NIST Cybersecurity Framework. Joshua also advises global clients on foreign privacy and security frameworks, including the General Data Protection Regulation (GDPR), the EU-U.S. Data Privacy Framework, and the EU’s e-Privacy Directive.Joshua works with clients ranging from emerging to public companies across a variety of industries, including technology, life sciences, EdTech, Fintech, crypto, consumer services, and AdTech. Joshua assists clients in developing information security policies and procedures, standing up cybersecurity governance processes, negotiating data transfer and processing agreements, designing third-party vendor risk management programs, and product development and design. Joshua also advises clients on incident response strategy, assisting companies in investigating data breaches and preparing notifications to customers, affected individuals, and regulators. As part of his practice, Joshua performs privacy and cybersecurity due diligence and negotiates transaction documents in connection with public and private corporate deals.Joshua maintains an active pro bono practice. He has worked on numerous immigration matters, helping to reunite separated families and obtaining a grant of asylum for a Honduran woman escaping sexual violence. Joshua has also represented tenants in litigation against their landlords over unhabitable living conditions. Additionally, Joshua regularly helps nonprofits build and develop their privacy and cybersecurity programs.Prior to joining Morrison Foerster, Joshua was an associate in the data privacy and cybersecurity practice at another international law firm. Joshua previously worked in the U.S. Intelligence Community, including as an attorney advisor in the Intelligence Law Division at the U.S. Department of Homeland Security, where he advised government officials on compliance with domestic and international privacy regimes and data security matters related to information sharing, data analytics, and cloud computing technology. In 2020, Joshua was a judicial law clerk for the Honorable Sarah Netburn, U.S. Magistrate Judge, Southern District of New York.Joshua received his J.D. from New York University School of Law, where he graduated cum laude and was recognized as a Robert McKay Scholar. Joshua was also awarded the ASPIRE Cybersecurity Scholarship, a prestigious full-tuition merit scholarship providing a select group of students with a cybersecurity education from a multidisciplinary perspective. Joshua received his B.A. from Columbia University, where he graduated magna cum laude and was a member of Phi Beta Kappa.

Joshua Fattal

Associate

Privacy + Data Security

Privacy + Data Security Litigation