Close Print
Print

Grant D. Petersen

Of Counsel || Tampa

Cross-Border, Traditional Labor Relations, Employment Law, Cybersecurity and Privacy, Technology, Global Reorganizations

Grant Petersen represents and counsels employers in a broad range of U.S. and international labor and employment laws, U.S. and global data privacy and data protection laws, and the Foreign Corrupt Practices Act and other international anti-corruption laws. He is the founder of the firm’s Cybersecurity and Privacy Practice Group and co-founder of the firm’s Cross-Border Practice Group. Grant has advised many clients regarding the impact of global data privacy laws in the workplace, the complexities of international transfers of human resources data, and practical steps for compliance with the General Data Protection Regulation. He speaks and writes on data privacy and employment issues regularly.

Cross-Border, Traditional Labor Relations, Employment Law, Cybersecurity and Privacy, Technology, Global Reorganizations
Learn more about Grant D. Petersen

Grant handles the following types of matters:

Education

Admission to Practice

Professional Activities

  • American Bar Association (Labor and Employment Law and International Sections)
  • Florida Bar Association (Labor and Employment Law and International Sections)
  • Illinois Bar Association
  • Hillsborough County Bar Association
  • Tampa Bay International Business Council (President)
  • Bay Area Manufacturers Association (Director)
  • British American Business Council Tampa Bay (President)
  • French-American Business Council of West Florida (Director)
  • International Association of Privacy Professionals
  • Certified Information Privacy Professional/Europe (CIPP/E)

Speeches

Insights by Grant D. Petersen

Hallway of servers.

The U.S. and EU Announce an “Agreement in Principle” to Replace the EU-U.S. Privacy Shield Framework: What Employers Need to Know

On March 25, 2022, the European Union (EU) announced that the United States and the EU had reached an agreement in principle to replace the EU-U.S Privacy Shield framework, which the European Court of Justice (CJEU) struck down in its July 2020 Schrems II decision. Since the Schrems II decision, U.S. and EU negotiators have been hammering out a workable data transfer mechanism to permit the transfer of EU data to the United States.

Systems administrator holding a laptop working on a server.

European Commission Adopts Two New Sets of Standard Contractual Clauses: What Employers Need to Know

On June 4, 2021, the European Commission adopted two new sets of standard contractual clauses (SCCs): one for data transfers from data controllers to data processors and one for data transfers from data exporters to data importers in the United States and other third countries. These new clauses update and replace the SCCs adopted in 2001, 2004, and 2010 that many employers currently use to legally transfer human resources (HR) data for employees based in the European Union (EU).

Systems administrator holding a laptop working on a server.

A GDPR Update for Employers, Part IV: Implementing Lessons Learned From GDPR Complaints and Enforcement Actions

The European Data Protection Board (EDPB) and EU supervisory authorities have reported that they have received a large number of complaints during the first six months following the effective date of the GDPR. For example, the EDPB reported that it had received more than 42,000 complaints since May 25, 2018. The French Supervisory Authority (CNIL) reported a 20 percent increase in complaints filed during the first six months the GDPR was effective compared to the same period in 2017. Similarly, the Irish Supervisory Authority reported a 50 percent increase in data breach reports and a 65 percent increase in data protection complaints over the same period. The Irish Data Protection Commissioner also stated that several investigations of multijurisdictional complaints against large companies are being completed and that she expects major GDPR fines to be issued in 2019.

Systems Administrator holding iPad and working on a server.

A GDPR Update for Employers, Part III: Preparing Required Data Protection Impact Assessments

Article 35 of the GDPR provides that a data protection impact assessment (DPIA) must be performed for data processing that “is likely to result in a high risk to the rights and freedoms of natural persons.” DPIAs must contain (1) a description of the processing operation along with the purpose of the processing and, where applicable, the legitimate interest for the processing; (2) an assessment of the necessity and proportionality of the processing operation in relation to the purpose; (3) an assessment of the risks to the rights and freedoms of the data subjects; and (4) the measures to be taken to mitigate the risks.

View All