Phyllis B. Sumner

• Representing major automotive company in high-profile, multi-jurisdictional investigations involving over three dozen federal and state regulators—including the FTC, California Attorney General’s Office and Cal Privacy—concerning connected vehicle data practices. Advising on the full spectrum of regulatory, congressional, and civil exposure, while supporting enhancements to the company’s privacy compliance program.
• Lead counsel to international hospitality company in connection with regulatory investigations resulting from data security incidents announced in 2018 and 2020, including leading consent order negotiations with the FTC and multi-state group of attorneys general representing 49 states and the District of Columbia, to reach resolutions in October 2024, and advising on the company’s information security and privacy compliance programs.
• Led the defense of Equifax in connection with its 2017 data breach, including related regulatory investigations, enforcement actions, and congressional inquiries, and served as co-lead counsel in the ensuing MDL and class actions; negotiated and secured approval of global settlement resolving claims by approximately 147 million consumers, state attorneys general, and federal regulators.
• Advising boards and C-suite executives on enterprise-wide privacy and data security policies and controls to support effective corporate governance and leading customized senior executive and board-level tabletop exercises focused on escalation procedures, reporting, and decision-making authority.

Phyllis B. Sumner regularly counsels corporate boards, senior executives and other clients on cybersecurity preparedness, emergency response, remediation, compliance, internal and regulatory enforcement investigations, and data breach and privacy litigation.

She is a crisis manager and trial lawyer, who works with her clients' legal, compliance and business teams to strategize, manage and defend when significant privacy and security issues arise. She has assisted clients with their response to and management of hundreds of data security incidents and has represented clients defending against class actions and regulator investigations in some of the largest and most high-profile data security incidents.

A nationwide top ranked Privacy & Data Security lawyer by Chambers USA, Phyllis’ clients note “Her knowledge and expertise when it comes to ransomware incident response is second to none.” Phyllis is a recognized leader in the industry and consistently named to Cybersecurity Docket’s annual list of “the best incident response lawyers in the business,” including most recently to the Global Incident Response Elite. Three-time Law360 MVP, she also has earned recognition as a Daily Report’s “Distinguished Leader,” Atlanta Magazine’s "Women Making a Mark," Lawdragon’s global leader in “Cyber” and “Crisis Management” and as one of Global Data Review’s “Women in Data,” and she is listed in the Best Lawyers of America for her high caliber work in privacy and data security law.

She served as an Assistant U.S. Attorney for eight years, first for the Northern District of Illinois and then for the Northern District of Georgia, prosecuting high-profile cases such as Eric Rudolph, the Centennial Olympic Park bomber.

Outside of her work leading the firm’s privacy and cybersecurity efforts, Phyllis enjoys training and competing in the equestrian sport of dressage. She also periodically teaches a cybersecurity incident response course at the University of Georgia School of Law.