Michael G. Morgan

Michael Morgan is a leader of the Firm’s Global Privacy and Cybersecurity practice. Recognized as one of the nation’s leading lawyers in cyber incident response, Mike has guided clients through some of the largest and most complex data breaches, including state-sponsored attacks, breaches involving more than 50 million records, and incidents affecting persons in more than 100 countries around the world. He represents clients in the defense of breach-related government investigations and class action litigation as well as pre-breach planning and post-breach remediation. Read Michael Morgan's full bio.

Firm/Organization: McDermott Will & Emery

Blogs: Employee Benefits Blog, Of Digital Interest

Latest Articles

Of Digital Interest

California Enacts a Groundbreaking New Privacy Law

By Michael G. Morgan, Daniel F. Gottlieb, Matthew R. Cin, Jonathan Ende, Amy C. Pimentel & Li Wang

June 29, 2018

California’s Senate and Assembly unanimously approved AB 375 (also known as the California Consumer Privacy Act of 2018), on June 28, 2018. This new consumer privacy bill will be the most progressive and comprehensive privacy law in the United States, reaching far beyond California’s borders to give California consumers more visibility and control over their personal information. Continue Reading.…

Of Digital Interest

The General Data Protection Regulation: Key Requirements and Compliance Steps for 2018

By Ashley Winton, Romain Perray, Sabine Naugès, Paul McGrath, Mark E. Schreiber, Michael G. Morgan, Dr. Wolfgang Freiherr Raitz von Frentz, Wilko van Weert, Camille Spegt, Leon C.G. Liu, Jared T. Nelson & McDermott Will & Emery

February 6, 2018

Enforceable in all EU member states on 25 May 2018, the General Data Privacy Regulation will require action by organisations both inside and outside the European Union to ensure compliance with this far-reaching privacy legal framework. Compliance is even more urgent given that the GDPR provides for large penalties in cases of infringement. As some entities are not yet aware of the extent to which GDPR may be applicable to them, the GDPR expressly applies…

Employee Benefits Blog

To Scan or Not to Scan: Surge in Lawsuits under Illinois Biometrics Law

By Michael G. Morgan, Kristin E. Michaels, Christopher M. Murphy, Mark E. Schreiber & Lynette Ryan Arce

January 9, 2018

The Illinois Biometric Information Privacy Act is having its moment. At least 32 class action lawsuits have been filed by Illinois residents in state court in the past two months challenging the collection, use and storage of biometric data by companies in the state. This may cause a reassessment of company strategies and development of new defenses in the use of advancing biometric technology. Continue Reading.…

Of Digital Interest

To Scan or Not to Scan: Surge in Lawsuits under Illinois Biometrics Law

By Michael G. Morgan, Kristin E. Michaels, Christopher M. Murphy, Mark E. Schreiber & Lynette Ryan Arce

November 8, 2017

Although the Illinois Biometric Information Privacy Act has been on the books for almost 10 years, a recent surge in lawsuits has likely been brought on by developments in biometric scanning technology and its increased use in the workplace. At least 32 class action lawsuits have been filed in recent months by Illinois residents in state court challenging the collection, use and storage of biometric data by companies in the state. This could potentially cause…

Of Digital Interest

Irish Court Casts Serious Doubt on EU Model Clauses

By Mark E. Schreiber, Ashley Winton, Michael G. Morgan, Romain Perray, Amy C. Pimentel, Katherine F. Froelicher & McDermott Will & Emery

October 17, 2017

The validity of Model Clauses for EU personal data transfer to the United States is now in real doubt as a result of a new Irish High Court judgment stating that there are “well founded grounds” to find the Model Clauses invalid. The issue of Model Clauses as a legitimate data transfer mechanism will now be adjudicated by the European Court of Justice (ECJ), the same court that previously overturned the Safe Harbor arrangement. EU…

Of Digital Interest

The Department of Transportation Helps Clear the Road for Autonomous Vehicles

By William M. Friedman, Michael G. Morgan, Ashley Winton & Amy C. Pimentel

September 27, 2017

The US Department of Transportation’s National Highway Traffic Safety Administration recently released A Vision for Safety 2.0, an update to its prior guidance on automated driving systems. The new guidance adopts a voluntary, flexible approach to regulation of automated driving systems and clarifies that it alone, and not the states, is responsible for regulating the safety design and performance aspects of such systems. Continue Reading…

Of Digital Interest

New York’s Cybersecurity Requirements Pose Multi-Year Compliance Challenges

By Mark E. Schreiber, Michael G. Morgan, Scott Weinstein & McDermott Will & Emery

September 20, 2017

New cybersecurity regulations issued by the NYDFS define the nonpublic information they regulate in exceptionally broad terms. This expanded definition of Nonpublic Information will create major challenges for regulated companies and their third-party service providers that will likely ripple through other ancillary industries. Continue Reading.…

Of Digital Interest

New Cybersecurity Report Asks the Private Sector to Join Forces with the Government

By Michael G. Morgan

September 13, 2017

The government is continuing to ask for more help from the private sector to defend against cyber attacks. The National Infrastructure Advisory Council (NIAC) recently published a report discussing current cyber threats and urging private companies and executives to join forces with the government to better address those threats. The report proposes “public-private and company-to-company information sharing of cyber threats at network speed,” among other things discussed here. Continue Reading…

Of Digital Interest

UK Government Issues Cybersecurity Guidance for Connected and Automated Vehicles

By Michael G. Morgan & Ashley Winton

September 13, 2017

On 6 August 2017, the UK government released ‘The Key Principles of Vehicle Cyber Security for Connected and Automated Vehicles’, guidance aimed at ensuring minimum cybersecurity protections for consumers in the manufacture and operation of connected and automated vehicles. Connected and automated vehicles fall into the category of so-called ‘smart cars’. Connected vehicles have gained, and will continue to gain, adoption in the market and, indeed, are expected to make up more than half of…

Employee Benefits Blog

Guidance on Ransomware Attacks under HIPAA and State Data Breach Notification Laws

By Michael G. Morgan & Anthony A. Bongiorno

January 12, 2017

The US Department of Health and Human Services has recently issued guidance under the Health Insurance Portability and Accountability Act on what covered entities and business associates can do to prevent and recover from ransomware attacks; however, other state data breach notification laws can also be triggered by a ransomware attack. The authors of this article explain the guidance and what to do if you are subject to a ransomware attack. Read the full article …

Michael G. Morgan

California Enacts a Groundbreaking New Privacy Law

The General Data Protection Regulation: Key Requirements and Compliance Steps for 2018

To Scan or Not to Scan: Surge in Lawsuits under Illinois Biometrics Law

To Scan or Not to Scan: Surge in Lawsuits under Illinois Biometrics Law

Irish Court Casts Serious Doubt on EU Model Clauses

The Department of Transportation Helps Clear the Road for Autonomous Vehicles

New York’s Cybersecurity Requirements Pose Multi-Year Compliance Challenges

New Cybersecurity Report Asks the Private Sector to Join Forces with the Government

UK Government Issues Cybersecurity Guidance for Connected and Automated Vehicles

Guidance on Ransomware Attacks under HIPAA and State Data Breach Notification Laws

Stay Connected

Company

Support

New to the Network