Photo of Joseph J. Lazzarotti

Joseph J. Lazzarotti is a principal in the Tampa, Florida, office of Jackson Lewis P.C. He founded and currently co-leads the firm's Privacy, Data and Cybersecurity practice group, edits the firm’s Privacy Blog, and is a Certified Information Privacy Professional (CIPP) with the International Association of Privacy Professionals. Trained as an employee benefits lawyer, focused on compliance, Joe also is a member of the firm’s Employee Benefits practice group.

In short, his practice focuses on the matrix of laws governing the privacy, security, and management of data, as well as the impact and regulation of social media. He also counsels companies on compliance, fiduciary, taxation, and administrative matters with respect to employee benefit plans.

The National Association of Secretaries of State has recognized that the newest victims of identity theft are small and medium-sized businesses. These businesses need to take steps to safeguard not only personal information of customers, employees and others, but also the businesses’ corporate and financial data.
Continue Reading Small to Mid-Sized Businesses Wake Up! The National Association of Secretaries of State Warns Identity Theft Does Not Just Hurt Individuals

A recent criminal case involving a government employer harmed by a computer hacking incident affecting its personnel records may provide support for companies seeking to recover the costs they incur when taking appropriate steps to investigate these data incidents and mitigate harm when a breach is found to have occurred.
Continue Reading Restitution Includes Credit Monitoring Costs Following Data Breach Under CFAA

This recent Michigan case makes clear that when handling protected health information, HIPAA is not the only game in town. Health care providers also must consider state law protections which, as this and other courts have held, will trump HIPAA when the state laws are more protective.
Continue Reading Cautionary Tale for Health Care Providers Subject to HIPAA – Don’t Forget State Law

A new law in New York (eff. April 1, 2011) and a flurry of bills across the country (New Jersey, Nevada, Florida, Connecticut and Oregon) are aimed at requiring businesses to deal with their electronic waste in one form or another. Before discarding that old laptop, businesses should make sure they do so securely and in accordance with applicable state law.
Continue Reading Wondering What To Do With Your “Electronic Waste”?

Companies frequently receive requests for information about current and former employees. These requests often come in the form of an attorney’s demand letter or a subpoena and apply to the individual’s medical records. Failing to carefully think through whether and how to respond can be a costly trap for the unwary.
Continue Reading ADA Violated When Employer Responds to State Subpoena and Discloses Former Employee’s Medical Records

A NY court refuses to order a former employee to stop blogging about his former employer because the court could find no extraordinary circumstance that would overcome constitutional protections, despite the individual’s signing an agreement during his employment to maintain the confidentiality of confidential business information.
Continue Reading Ex-Employee’s Blogs Can’t Be Stopped Absent Extraordinary Circumstances, New York Court Rules