Christian Lee

Christian focuses his practice on advising data-driven companies on cyber, data and privacy issues. He works with companies from startups to large Fortune 500 multinationals across a wide range of industries.

Christian also advises clients on complying with US and international data protection laws, including the California Consumer Privacy Act (CCPA) and similar laws passed in other states, Washington’s My Health My Data Act, California’s Confidentiality of Medical Information Act (CMIA), the federal Telephone Consumer Protection Act (TCPA), Children’s Online Privacy Protection Act (COPPA), Gramm-Leach-Bliley Act (GLBA), Electronic Communications Privacy Act (ECPA) and Stored Communications Act (SCA), and Europe’s General Data Protection Regulation (GDPR) and ePrivacy Directive.

Christian has substantial experience advising on the cyber, data and privacy aspects of strategic and commercial transactions ranging from series seed financings to nine-figure mergers & acquisitions. He also helps clients prepare for and respond to security incidents – including drafting incident response plans, running tabletop exercises, sending breach notifications, and responding to regulator inquiries.

In addition, Christian assists clients in responding to third-party and law enforcement requests for user and corporate data, including subpoenas, court orders and search warrants. He has litigated many such matters through appeals, which have involved issues of first impression and resulted in published opinions.

Christian’s representative matters include advising:

• The petitioner in Facebook v. Sup. Ct. (Touchstone), 10 Cal. 5th 329 (2020), resulting in the criminal defendant having a burden to satisfy a seven-factor test to justify a subpoena to the social media provider*
• The petitioner in Facebook v. Sup. Ct. (Hunter), 4 Cal. 5th 1245 (2018), resulting in a ruling that the criminal defense subpoenas seeking private content from the social media provider were unenforceable*
• The petitioner in Facebook v. Sup. Ct. (Touchstone), 15 Cal. App. 5th 729 (2017), resulting in a ruling that the criminal defendants had no constitutional right to the discovery of social media records held by the social media provider*
• A nonparty email provider in response to a subpoena in Europlay Capital Advisors v. Does, 323 F.R.D. 628 (C.D. Cal. 2018), resulting in a ruling that the discovery motions against the email provider must be filed in the district where the provider is headquartered and where its custodians of records reside – not in any district where the provider has an office – per Rule 45 of the Federal Rules of Civil Procedure (FRCP)*
• A company served a search warrant that included a notice preclusion order in In Matter of Search Warrant for [redacted].com, 248 F. Supp. 3d 970 (C.D. Cal. 2017), resulting in a ruling that the indefinite nondisclosure order to the custodian violates its First Amendment right to speak*
• Several nonparties on behalf of the petitioner/objector/appellant in Yelp v. Sup. Ct., 17 Cal. App. 5th 1 (2017), resulting in a ruling that the review website has standing to assert the First Amendment rights of its users*
• A nonparty social media provider in response to subpoenas in Music Grp. v. Does, 82 F. Supp. 3d 979 (N.D. Cal. 2015), resulting in a ruling that the proper district to enforce an FRCP Rule 45 motion against a social media provider is the district where it is headquartered, not where it has offices*

* Representation handled prior to joining Cooley

Speaking engagements

• Speaker on “Regulating Dark Patterns and Design,” Cooley Privacy Talks webinar series, October 2023
• Speaker on “Meeting the CCPA’s Training Requirements,” Cooley Privacy Talks webinar series, September 2023
• Speaker on “CPRA and US State Privacy Laws: A Mid-Year Update on the Regulations and Compliance Approaches,” Cooley Privacy Talks webinar series, June 2023
• Speaker on “Ransomware Response,” Rocky Mountain Intellectual Property Technology Law Institute, June 2023
• Speaker on “Privacy Governance as a Strategic Initiative,” Cooley Privacy Talks webinar series, April 2023
• Panelist for “Global Legal ConfEx: GRC, Data Privacy & Cyber Security,” Events 4 Sure panel, November 2022
• Speaker on “Operationalizing the SEC’s New Cybersecurity and Governance Requirements,” Cooley webinar, September 2022
• Panelist for “Future Proofing Your Privacy Compliance Program,” Asian Pacific American Bar Association of Silicon Valley panel, September 2022
• Speaker on “US Data Privacy Landscape,” 2022 Association of Reporters of Judicial Decisions annual meeting, August 2022
• Speaker on “Data Privacy, Cyber Security & GRC,” Global Legal ConfEx Live roundtable discussion, February 2022
• Speaker on “US Privacy Compliance Journey 2022 – CPRA Roadmap,” Cooley Privacy Talks webinar series, February 2022
• Speaker on “CCPA Training for Privacy and Customer Support Teams,” Cooley webinar, May 2020
• Speaker on Career Panel, Berkeley Law Patent Law Society panel, March 2020
• Speaker on “California Consumer Privacy Act 101,” California Lawyers Association webinar, February 2020
• Moderator for “The Journey to Becoming a Privacy Attorney,” Asian Pacific American Bar Association of Silicon Valley panel, September 2019