North Carolina Administrative Code › Title 27 - STATE BAR › Chapter 01 - RULES AND REGULATIONS FOR THE NORTH CAROLINA STATE BAR › Subchapter D - RULES OF THE STANDING COMMITTEES OF THE NORTH CAROLINA STATE BAR › Section .3300 - CERTIFICATION STANDARDS FOR THE PRIVACY AND INFORMATION SECURITY LAW › Section 01D .3305 - STANDARDS FOR CERTIFICATION AS A SPECIALIST IN PRIVACY AND INFORMATION SECURITY LAW

Current through Register Vol. 39, No. 2, July 15, 2024
Each applicant for certification as a specialist in privacy
					 and information security law shall meet the minimum standards set forth in Rule
					 .1720 of this subchapter. In addition, each applicant shall meet following
					 standards for certification in privacy and information security law:
(a) Licensure and Practice - An applicant
				  shall be licensed and in good standing to practice law in North Carolina as of
				  the date of application. An applicant shall continue to be licensed and in good
				  standing to practice law in North Carolina during the period of
				  certification.
(b) Substantial
				  Involvement - An applicant shall affirm to the board that the applicant has
				  experience through substantial involvement in privacy and information security
				  law.
(1) Substantial involvement shall mean
				  that during the five years immediately preceding the application, the applicant
				  devoted an average of at least 400 hours a year to the practice of privacy and
				  information security law but not less than 300 hours in any one year.
(2) Practice shall mean substantive legal
				  work in privacy and information security law done primarily for the purpose of
				  providing legal advice or representation, including the activities described in
				  paragraph (3), or a practice equivalent as described in paragraph
				  (4).
(3) Substantive legal work in
				  privacy and information security law includes, but is not limited to,
				  representation on compliance, transactions and litigation relative to the laws
				  that regulate the collection, storage, sharing, monetization, security,
				  disposal, and permissible uses of personal or confidential information about
				  individuals, businesses, and organizations. Practice in this specialty requires
				  the application of information technology principles including current data
				  security concepts and best practices. Legal work in the specialty includes, but
				  is not limited to, knowledge and application of the following: data breach
				  response laws, data security laws, and data disposal laws; unauthorized access
				  to information systems, such as password theft, hacking, and wiretapping,
				  including the Stored Communications Act, the Wiretap Act, and other
				  anti-interception laws; cyber security mandates; website privacy policies and
				  practices, including the Children's Online Privacy Protection Act (COPPA);
				  electronic signatures and records, including the Electronic Signatures in
				  Global and National Commerce Act (E-SIGN Act) and the Uniform Electronic
				  Transactions Act (UETA); e-commerce laws and contractual legal frameworks
				  related to privacy and data security such as Payment Card Industry Data
				  Security Standards (PCI-DSS) and the NACHA rules; direct marketing, including
				  the CAN-SPAM Act, Do-Not-Call, and Do-Not-Fax laws; international privacy
				  compliance, including the European Union data protection requirements; social
				  media policies and regulatory enforcement of privacy-related concerns
				  pertaining to the same; financial privacy, including the Gramm-Leach-Bliley
				  Act, the Financial Privacy Act, the Bank Secrecy Act, and other federal and
				  state financial laws, and the regulations of the federal financial regulators
				  including the SEC, CFPB, and FinCEN; unauthorized transaction and fraudulent
				  funds transfer laws, including the Electronic Funds Transfer Act and Regulation
				  E, as well as the Uniform Commercial Code; credit reporting laws and other
				  "background check" laws, including the Fair Credit Reporting Act; identity
				  theft laws, including the North Carolina Identity Theft Protection Act and the
				  Federal Trade Commission's "Red Flags" regulations; health information privacy,
				  including the Health Information Portability and Accountability Act (HIPAA);
				  educational privacy, including the Family Educational Rights and Privacy Act
				  (FERPA) and state laws governing student privacy and education technology;
				  employment privacy law; and privacy torts.
(4) "Practice equivalent" shall mean:
(A) Full-time employment as a compliance
				  officer for a business or organization for one year or more during the five
				  years prior to application may be substituted for an equivalent number of the
				  years of experience necessary to meet the five-year requirement set forth in
				  Rule .3305(b)(1) if at least 25% of the applicant's work was devoted to privacy
				  and information security implementation.
(B) Service as a law professor concentrating
				  in the teaching of privacy and information security law for one year or more
				  during the five years prior to application may be substituted for an equivalent
				  number of years of experience necessary to meet the five-year requirement set
				  forth in Rule .3305(b)(1);