Kevin L. Coy

Kevin is a partner and chair of the Privacy & Cybersecurity practice, co-chair of the Background Screening industry team, and a member of the International practice group and Life Sciences industry team. He advises consumer reporting agencies, background screening companies, data and information service providers, employers, housing organizations, life sciences companies, and international businesses on U.S. and global privacy, cybersecurity, and consumer protection compliance. For organizations that rely on sensitive personal information — including criminal history, credit and financial data, health information, biometric identifiers, and employee data — Kevin provides practical business guidance on using data lawfully, structuring compliant processes, and managing regulatory risk.

Kevin counsels clients on developing and updating privacy policies and notices, negotiating data protection provisions in commercial and vendor contracts, and building scalable privacy and information security compliance programs. His experience includes advising on the Gramm-Leach-Bliley Act (“GLBA”), Section 5 of the Federal Trade Commission Act, the Health Insurance Portability and Accountability Act (“HIPAA”), the Driver’s Privacy Protection Act, the Telephone Consumer Protection Act, and the growing number of comprehensive state privacy laws.

Employers, landlords, and background screening companies face increasing scrutiny over how consumer information is used in employment and housing decisions. Kevin works with these organizations to build compliant processes under  the Fair Credit Reporting Act (“FCRA”) and state and local fair chance and “ban the box” laws, including when and how criminal history, credit, and eviction data may be considered. His work includes designing required disclosures, timing, conditional offers, adverse action procedures, and risk mitigation strategies designed to align legal requirements with operational realities.

As organizations increasingly deploy artificial intelligence tools that ingest and process personal data, Kevin works closely with privacy officers, compliance teams, and business leaders to develop practical AI governance frameworks. He advises on risk assessments, internal governance structures, regulatory compliance strategies, and contractual safeguards for AI vendors and platforms, helping clients integrate innovation with defensible compliance.

Kevin is also well versed in the complex web of international privacy regimes. He manages transborder data flow issues and matters with the European Union General Data Protection Regulation (“GDPR”) and other foreign privacy laws and regulations. He also advises clients on international data transfer strategies, including standard contractual clauses and participation in the EU-U.S. Data Privacy Framework and related UK and Swiss programs.

When data security incidents arise, Kevin leads clients through breach response, notification analysis, regulator engagement, and remediation planning. He is known for providing clear, business-focused guidance, empowering organizations to protect their operations, reputation, and long-term growth.