Kevin L. Coy

Kevin chairs Arnall Golden Gregory LLP’s Privacy & Cybersecurity practice and co-chairs its Background Screening industry team. He advises consumer reporting agencies, background screening companies, data and information service providers, employers, housing organizations, life sciences companies, and international businesses on U.S. and global privacy, cybersecurity, and consumer protection requirements. His work often concerns the lawful use of sensitive information, including criminal history, credit and financial data, health information, biometric identifiers, and employee data.

Kevin helps clients develop privacy notices and policies, negotiate data protection terms in commercial and vendor agreements, and build privacy and information security compliance programs. His counseling addresses the Gramm-Leach-Bliley Act, Section 5 of the Federal Trade Commission Act, HIPAA, the Driver’s Privacy Protection Act, the Telephone Consumer Protection Act, and comprehensive state privacy laws. When security incidents occur, he leads clients through breach response, notification analysis, regulator engagement, and remediation planning.

A substantial part of Kevin’s practice focuses on the use of consumer information in employment and housing decisions. He works with employers, landlords, and background screening companies on processes governed by the Fair Credit Reporting Act and state and local fair chance and “ban the box” laws. That work includes questions about when and how criminal history, credit, and eviction data may be considered, as well as disclosures, timing, conditional offers, adverse action procedures, and risk mitigation.

Kevin also advises privacy officers, compliance teams, and business leaders on governance for artificial intelligence tools that process personal data. His work includes risk assessments, internal governance structures, regulatory compliance strategies, and contractual safeguards for AI vendors and platforms. In cross-border matters, he addresses transborder data flows, the EU General Data Protection Regulation and other foreign privacy laws, including transfer strategies involving standard contractual clauses and the EU-U.S. Data Privacy Framework and related UK and Swiss programs. Kevin is also a member of the firm’s International practice group and Life Sciences industry team.

• Advised a digital health and wellness company on the development of consumer privacy disclosures, user authorizations, and governance frameworks for an artificial intelligence (“AI”)-powered chatbot, addressing HIPAA, state privacy laws, and emerging AI regulatory requirements.
• Advised a U.S.-based multinational software-as-a-service provider on the applicability of the U.S. Department of Justice bulk data rule and the design and implementation of a tailored compliance program, including policies, certifications, and contractual updates.
• Advised a national property management company on revisions to its tenant screening program to comply with federal, state, and local requirements governing the use of criminal history, credit, and eviction information, including updates to screening criteria and adverse action procedures.
• Advised a client in connection with the development of a consolidated online privacy policy to govern more than 80 company websites. Work included assisting the client in developing a survey tool to assess website privacy practices, reconciling the survey results, making best practice recommendations regarding changes in website practices, and developing a consolidated online privacy policy.
• Successfully represented a consumer reporting agency before the Federal Trade Commission in a nonpublic FTC inquiry into compliance with the Fair Credit Reporting Act. Following document productions, responses to interrogatories, and meetings with the FTC staff, the inquiry was closed without further action by the FTC.
• Advised a consumer electronics retailer regarding consumer data breach notification obligations and other steps to respond to a data breach. In addition to advising the client regarding consumer, regulatory, and other notifications advice also addressed matters pertaining to the investigation of the breach, cooperation with law enforcement, and enhancing internal controls to minimize the potential for additional breaches.
• Advised a client regarding the development of a HIPAA/HI-TECH Act compliance program covering its potential obligations as a business associate of HIPAA-covered entities. Assisted the client in the conduct of a gap analysis to identify areas where further action may be necessary depending upon proposed changes to the HIPAA privacy, security, and breach notification regulations.
• Represented a large consumer information company in one of the nation’s first high-profile data breaches. In addition to representing the client before the Federal Trade Commission, we also advised the client on consumer breach notification issues, congressional testimony, and enhancements to the client’s internal controls.

• Georgetown University Law Center, Juris Doctor
• Georgetown University, Bachelor of Arts, cum laude

• District of Columbia – 1998
• State of Texas – 1997

• Professional Background Screening Association
  • Educational Resources Committee, Co-Chair, 2016-18
• American Bar Association
• National LGBTQ Bar Association
• C. LGBTQ Bar Association
• C. Equality Chamber of Commerce
• International Association of Privacy Professionals, CIPP/US, CIPP/E, CIPM, FIP, PLS