Home - Blank Rome LLP

Register to receive insights and analyses on breaking news and trends across varying industries.
<a class="link-primary mt-4" href="/subscribe">Subscribe</a>

Philadelphia, PA

New York, NY

Wilmington, DE

Cincinnati, OH

Princeton, NJ

Los Angeles, CA

Houston, TX

Tampa, FL

Shanghai

South Florida

Pittsburgh, PA

Washington, D.C.

Chicago, IL

Orange County, CA

Dallas, TX

Boston, MA

Main

CO-CHAIR, PRIVACY, SECURITY &amp; DATA PROTECTION PRACTICEPhil Yannella regularly counsels clients on data, privacy, and cybersecurity issues relating to the use of digital information. He represents financial institutions, media organizations, tech companies, online platforms, life sciences companies, global manufacturers, gaming companies, and higher eds.Phil has counseled and represented clients in a wide array of privacy and data security litigations including lawsuits filed under the Telephone Consumer Protection Act (“TCPA”), Defense of Trade Secrets Act, Computer Fraud and Abuse Act, Stored Communications Act, Video Privacy Protection Act (“VPPA”), and Illinois Biometric Information Protection Act, as well as state wiretap and data breach class actions and website accessibility claims. He has extensive experience coaching clients through data breaches. He has handled over 500 breaches for clients to date, managing breach notification in all 50 states and more than 35 foreign jurisdictions, and has led the defense of numerous regulatory investigations relating to data breaches, including those brought by state Attorney Generals, the Office of the Comptroller of the Currency (“OCC”), New York State Department of Financial Services (“NY DFS”), the UK Information Commissions Office, and Canadian privacy regulators.In addition, Phil regularly advises clients on compliance with federal, state, and international data protection laws including California, Virginia, Colorado, Connecticut, and Utah state privacy laws, the Children's Online Privacy Protection Act, Health Insurance Portability and Accountability Act (“HIPAA”) security rules, the General Data Protection Regulation (“GDPR”), UK Data Protection Act, UK Age Appropriate Design Code, and ePrivacy Directive. He works closely with banks and other financial institutions on compliance with the privacy and security components of the Gramm Leach Bliley Act, Interagency Guidelines, NY DFS cyber-regulations, and the Payment Card Industry Data Security Standard (“PCI DSS”). He is accredited as a Certified Information Privacy Professional (“CIPP/US”).Phil is a frequent commentator, presenter, and author on legal issues related to data privacy, cybersecurity, and information governance. He has received multiple Readers’ Choice awards from JD Supra for his writing on cybersecurity issues. He is the author of Cyber Litigation (Thomson Reuters, March 2021). He has been named to The Legal 500 US, Dispute Resolution.While in law school, Phil was a member of the Political and Civil Rights Law Review and Temple Moot Court and a recipient of the Trial Advocacy Program’s Outstanding Advocate Award.

core/freeform

Pennsylvania

New Jersey

Consumer Finance Litigation

Financial Services

Life Sciences

Data Privacy

Technology

Gaming, Sports & Entertainment

Artificial Intelligence

Data, Data Analytics, and AI: Licensing, Litigation, and Regulation

Blank Rome Attorneys Recognized in the 2026 Lawdragon 500 Leading Global Cyber Lawyers

The BR Privacy, Security & AI Download: May 2026

From the Boardroom to the Courtroom: Navigating Risk in the Era of Privacy and Data Breaches

How the FTC’s COPPA Policy Statement Promoting Responsible Age-Verification Practices Impacts Companies

The BR Privacy, Security & AI Download: April 2026

The BR Privacy, Security & AI Download: March 2026

Social Media Trial Sparks Reckoning for Product Design

The BR Privacy & Security Download: February 2026

Tiktok’s ‘Immigration Status’ Collection — Here’s What It Means

The BR Privacy & Security Download: January 2026

The BR Privacy & Security Download: December 2025

Litigation and Employment Issues for In-House Counsel 2025

Financial Crimes & Corporate Investigations

Steps to Address the New California Audit Rule That Seeks to Reset Reasonable Security

Litigation and Employment Law Issues for In-House Counsel CLE Event 2025

The BR Privacy & Security Download: November 2025

The BR Privacy & Security Download: October 2025

The BR Privacy & Security Download: September 2025

Navigating Three New State Laws That Require Apple and Google App Stores to Check All Users’ Ages

The BR Privacy & Security Download: August 2025

New California Privacy Assessment Rules Spur Compliance Scramble

Growing Data Breach Disputes Require Sharp Eye on Contract Terms

The BR Privacy & Security Download: July 2025

180 Days of the Trump Administration—Quick Hits on Executive Orders, Actions, and Policies

The BR Privacy & Security Download: June 2025

Digital Blind Spots Leave Fintech Firms Exposed as Cyber Litigation Explodes

The BR Privacy & Security Download: May 2025

Sharon R. Klein, Alex C. Nisenbaum, and Philip N. Yannella Recognized in the 2025 Lawdragon 500 Leading Global Cyber Lawyers

Philip N. Yannella Publishes 2025 Edition of Cyber Litigation: Data Breach, Data Privacy & Digital Rights with Thomson Reuters

AI in the ABL Industry—Opportunities and Barriers

Utah Data Sharing Law Creates Path to Upend Social Media Model

The BR Privacy & Security Download: April 2025

The BR Privacy & Security Download: March 2025

The BR Privacy & Security Download: February 2025

Massachusetts Plaintiffs Pivot to Save Health Site Privacy Suits

Cyber Insights 2025: Cybersecurity Regulatory Mayhem

The BR Privacy & Security Download: January 2025

EU Privacy Watchdog Noyb Primed to Pursue U.S.-Style Class Actions

The BR Privacy & Security Download: December 2024

Litigation and Employment Issues for In-House Counsel

Unpacking the Second Circuit’s Bombshell VPPA Ruling

The BR Privacy & Security Download: November 2024

NBA Video-Privacy Ruling Defies Class Action Dismissal Trend

Second Circuit’s Broad Reading of VPPA May Spark New Wave of Litigation

Litigation and Employment Law Issues for In-House Counsel CLE Event

The BR Privacy & Security Download: October 2024

Takeaways and Looming Questions After Ninth Circuit Cuts DPIA from California’s Age-Appropriate Design Code

The BR Privacy & Security Download: September 2024

Navigating Government Investigations of Privacy Practices

The BR Privacy & Security Download: August 2024

Pennsylvania Legislation to Watch in 2024: A Midyear Report

Understanding Key Definitional Concepts Under the EU AI Act

Maryland Passes Unique and Operationally Challenging Privacy Law

The BR Privacy & Security Download: July 2024

New State Privacy Laws Creating Complicated Patchwork of Privacy Obligations

The BR Privacy & Security Download: June 2024

The BR Privacy & Security Download: May 2024

Raft of Privacy Suits Ignites Abuse Concerns over NJ Law

Addressing the Operational Complexities of Complying with the Washington My Health My Data Act

The BR Privacy & Security Download: April 2024

Daniel’s Law: The Next Wave in Privacy Litigation

The BR Privacy & Security Download: March 2024

Minding Integrity in the Face of Calamity: Professional Rules of Ethics for Counsel Responding to a Cybersecurity Crisis

The BR Privacy & Security Download: February 2024

Litigator Philip Yannella Joins Blank Rome as Partner and Co-Chair of the Privacy, Security & Data Protection Practice

Noteworthy Speaking Engagements

Noteworthy Publications

Product Liability

Litigation

Business Litigation

Privacy, Security & Data Protection

Class Action Defense

Privacy Class Action Defense

Mass Torts & Complex Disputes

Complex Litigation &amp; Regulatory Investigations
<ul>
<li>Obtained dismissal in a putative class action under the VPPA, alleging that a radio station shared video viewing history of subscribers via use of Meta Pixel.</li>
<li>Obtained dismissal of a putative class action under the VPPA, alleging that a broadcasting company shared video viewing history of subscribers via use of Meta Pixel.</li>
<li>Obtained dismissal of state healthcare department in class action premised on vendor’s breach of personal medical information collected as part of COVID-19 tracking program.</li>
<li>Successfully represented a software-as-a-service provider in an action seeking a preliminary injunction to require the company to implement additional security controls in its software.</li>
<li>Obtained dismissal of a lifestyle magazine in wiretap litigation under Florida state law premised on company’s use of “session replay” software.</li>
<li>Represented a major data aggregator in NY DFS investigation relating to the exposure of driver’s license information in online insurance quote tools.</li>
<li>Successfully represented an auto finance company in a bet-the-company TCPA action with damage allegations of more than $100 million. Defeated class certification and prevailed on summary judgment on grounds that the client had not used an auto-dialer within meaning of TCPA.</li>
<li>Successfully represented a national bank in overdraft litigation, asserting eight-figure losses relating to use of decisioning tools for processing of debit card transactions that trigger overdraft fees. Successful defense of settlement against objector claims in Eleventh Circuit.</li>
<li>Successfully represented a national bank in overdraft litigation, asserting nine-figure losses relating to use of decisioning tools for processing of debit card transactions that trigger overdraft fees.</li>
<li>Represented a biopharmaceutical business regarding effect of French, German, and UK data protection laws on discovery of clinical trial and other information in U.S. products liability litigation.</li>
<li>Successfully represented a science and technology company in a civil action seeking publication of anonymized clinical data valued at one billion dollars. Using a re-identification analysis, successfully persuaded the court that publication would reveal private health information of 95 percent of clinical trial patients. Represented party regarding effect of French blocking statute and UK Data Protection Act on discovery in U.S. litigation.</li>
</ul>
Crisis Management &amp; Incident Response
<ul>
<li>Represented an international FinTech company in connection with ransomware attack of vendor systems by Maze/Ragnar threat actors. Attack resulted in exfiltration and exposure of 500 GB of customer data. Assisted in defense of client in follow-on Securities and Exchange Commission investigation.</li>
<li>Representing international toy manufacturer in ransomware attack by Hive threat actors, managing U.S. and EU reporting obligations.</li>
<li>Represented international household appliance manufacturer in ransomware attack involving exfiltration of 50 GB of consumer and employee data.</li>
<li>Counseled a nonprofit hacked by Chinese nationals and coordinated a response with the FBI.</li>
<li>Counseled health finance company on HIPAA and Federal Trade Commission reporting obligations arising from use of online tracking technologies.</li>
<li>Counseled a major telecommunications company on potential legal exposure arising out of review of hacked e-mails posted to WikiLeaks.</li>
<li>Conducted multiple internal investigations spanning several years for a leading online retailer arising out of suspected violations of access and identity management policies, resulting in developer access to production environments.</li>
<li>Counseled a gaming company in response to a suspected credit card skimming operation. Guided the client through an initial investigation and engagement with credit card fraud units and government entities, and provided advice on data breach notification procedures.</li>
<li>Represented national mortgage processor in OCC investigation relating to security incident involving alleged compromise of customer account information.</li>
<li>Counseled a global biotech in connection with theft of trade secrets by a former contractor.</li>
</ul>
Privacy Counseling
<ul>
<li>Advised clients in identifying technologies that constitute artificial intelligence (“AI”) under existing privacy laws, such as GDPR and California Consumer Privacy Act (“CCPA”), that trigger additional compliance requirements and risk assessments. These technologies include employee screening and monitoring tools, facial recognition AI, etc.</li>
<li>Advised clients regarding AI biometric scanning technologies covered under U.S. biometric laws.</li>
<li>Counseled multiple tech startups on compliance with U.S. biometric laws in connection with development of facial surveillance software.</li>
<li>Advised a lifestyle magazine on privacy, data security, e-commerce, and 2257/FOSTA issues in connection with launch of Centerfold platform.</li>
<li>Counseled numerous media and gaming companies on privacy and tech compliance in connection with mergers, sales, and acquisitions.</li>
<li>Counseled international FinTech company on data protection compliance in connection with launch of data cloud and analytics-as-a-service platform.</li>
<li>Assisted numerous banks, telecommunications companies, rental car companies, specialty chemical manufacturers, and life science companies on the implementation of global information governance programs.</li>
<li>Advising gaming companies on privacy, contractual, intellectual property, and wiretapping issues in connection with use of ChatGPT.</li>
<li>Counseling business information provider on consenting and notice requirements under CCPA, GDPR, UK GDPR, and Swiss, Australian, and Brazilian privacy laws relating to the sale of business contact information.</li>
<li>Counseling a leading rental company on ownership and monetization of connected car data.</li>
<li>Assisting a major auto loan finance company in connection with PCI DSS compliance project.</li>
<li>Counseling media organizations, gaming companies, and buy-now-pay-later payment providers on compliance issues relating to use of application programming interfaces and web scraping tools.</li>
</ul>

Philip N. Yannella

Philip N. Yannella

Offices

Stay Connected

Slide Menu

Slide Search

Offices

Stay Connected