Privacy Litigation and Class Actions with Benjamin Softness

In this episode of Privacy in Practice, Kellie du Preez and Danie Strachan speak with Benjamin Softness, Partner at King & Spalding, about U.S. privacy class actions and how companies can prepare for and respond to demand letters and litigation. They explain how class actions work, what SB 690 changes for California Invasion of Privacy Act (CIPA) claims, what to do first when a complaint arrives, and how the language in a privacy notice can be used as evidence in litigation.

In this episode of Privacy in Practice, Kellie du Preez and Danie Strachan speak with Tanvi Mehta Krensel, Partner at Squire Patton Boggs and former lead product privacy lawyer for APAC and emerging markets at TikTok. They discuss how Australian privacy law differs from the GDPR, including the absence of a controller/processor distinction under the Privacy Act, how to approach Australian contracts, and the separate requirements for privacy policies and APP5 collection notices. They also consider what global organizations should know when operating in Australia.

In this episode of Privacy in Practice, Kellie du Preez and Danie Strachan speak with Patricia Kosseim, Information and Privacy Commissioner of Ontario, about how privacy law operates across Canada’s federal, provincial, territorial, and sector-specific regimes. They discuss the interaction between PIPEDA and provincial privacy laws, cross-jurisdiction regulatory cooperation, Ontario’s PHIPA framework for health information, and what regulators may expect organizations to demonstrate in practice. The conversation also examines constructive engagement with privacy regulators.

Children’s privacy requires more than applying adult privacy rules to younger users. Age thresholds vary across jurisdictions, children may lack the legal capacity to consent to certain processing, and the methods used to identify young users can introduce additional privacy, security, and compliance risks. Addressing these challenges successfully requires coordinated decisions across legal, compliance, product and design, engineering, and trust and safety teams. Hailun Ying, Head of Privacy and Security, Legal at Roblox, joins Kellie du Preez and Danie Strachan to discuss the global patchwork of children’s privacy laws, the practical challenges of age assurance, and why privacy-protective defaults need to be built into products from the beginning. Hailun also discusses why children’s privacy must be treated as a cross-functional responsibility rather than solely as a legal or compliance matter.

In this episode of Privacy in Practice, Kellie du Preez and Danie Strachan speak with Tom Kemp, Executive Director of the California Privacy Protection Agency (CalPrivacy), about California’s approach to consumer privacy rights and business compliance. They discuss what regulators expect businesses to get right in practice, including functioning opt-out mechanisms, Global Privacy Control (GPC) signals, third-party vendor tools, California risk assessments, good faith compliance, and CalPrivacy’s work to make privacy rights easier for Californians to exercise at scale.

In this episode of Privacy in Practice, Kellie du Preez and Danie Strachan speak with Daniel Solove, Professor of Intellectual Property and Technology Law at George Washington University Law School, and CEO of TeachPrivacy, to debunk pervasive myths that undermine effective privacy strategies and leave businesses making weaker privacy and compliance decisions. Daniel is also one of the most cited legal scholars in the field of law and technology.

Gabe Maldoff is a Partner in Goodwin Procter, where he helps companies navigate privacy, cybersecurity, and AI governance in the context of data-driven products, corporate transactions, and regulatory investigations. He’s worked across the U.S. and the UK and advises clients on cross-border data transfers, international frameworks, and emerging technologies like AI, virtual and augmented reality. Gabe is also an Adjunct Professor at the University of Maine School of Law, where he teaches Global Privacy Law. This episode focuses on privacy considerations in M&A, especially from the perspective of startups preparing for acquisition and what acquirers really look for when evaluating privacy programs. In this episode of Privacy in Practice, Kellie du Preez and Danie Strachan speak with Gabe Maldoff, a partner in Goodwin’s Data, Privacy, and Cybersecurity practice, about privacy in mergers and acquisitions Together, they discuss why startups and fast-growth companies should address privacy early, how to navigate privacy due diligence without derailing deals, and how clear confident answers about data practices can help build trust during a transaction.

In this episode of Privacy in Practice, Kellie du Preez and Danie Strachan speak with Leah Camilla R. Besa-Jimenez, Group Head, Enterprise Risk Management at PLDT, about how she approaches privacy inside one of the largest Southeast Asian telecommunications companies. The discussion focuses on privacy as an operational practice and the importance of using risk matrices to structure decisions, coaching teams to exercise judgment, raising privacy issues early in project conversations, and shifting the company mindset from data ownership to data stewardship.

California continues to set the pace for U.S. privacy enforcement, and 2025 is proving to be a pivotal year. In this episode of Privacy in Practice, hosts Kellie du Preez and Danie Strachan sit down with Daniel Goldberg, Partner and Chair of the Data Strategy, Privacy, and Security Group at Frankfurt Kurnit Klein & Selz and 2025 California Privacy Lawyer of the Year, to unpack what’s really happening behind the scenes of CCPA enforcement. Drawing on his direct experiences defending companies facing California privacy enforcements, Daniel shares firsthand insights from public and non-public investigations, including trends emerging from actions involving companies like Sephora, DoorDash, and Jam City. The conversation explores what regulators actually prioritize, why misconfigured opt-outs and vendor oversight remain the most common pitfalls, and how the new Delete Act and data broker rules could dramatically shift compliance obligations.

In this episode of Privacy in Practice, hosts Kellie du Preez and Danie Strachan sit down with Lisa Sotto, Chair of the Global Privacy and Cybersecurity Practice at Hunton Andrews Kurth, for a practitioner-level conversation on the full arc of a cyber incident, from first detection through board notification and the regulatory long tail that follows. Drawing on Lisa’s decades of advising Fortune 500 companies and global regulators, the conversation examines why incident response efforts often fail when confined to IT and how organizations can meet complex international notification requirements with imperfect information.. Lisa breaks down real‑world ransomware negotiation dynamics and touches on the Bybit investigation, which has received significant media attention worldwide, as well as high‑profile cases like the Uber criminal conviction and the Drizly FTC consent order signal for executive accountability. Kellie draws on VeraSafe’s own client experience with cyber insurance and cross-boarder breach notification, while Danie bridges the US liability to Europe’s NIS 2 Directive and its implications for executive oversight. This episode goes far beyond cybersecurity basics. It’s a strategic, practitioner‑level briefing for leadership teams who need to understand not just how incidents unfold, but how to respond effectively under intense regulatory and operational pressure.