Sheri Porath Rockwell

SHERI PORATH ROCKWELL leads Sidley’s California Privacy and Cybersecurity practice. She advises clients on a wide range of state and federal privacy, artificial intelligence (AI), cybersecurity, and data governance issues, helping companies navigate emerging regulatory requirements, complex data use questions, and innovative
data-driven business initiatives.

Sheri provides practical, business-oriented advice informed by her experience as a litigator and former in-house counsel in a regulated industry. She works closely with legal, compliance, product, engineering, data science, marketing, and business teams to develop legally defensible strategies that account for commercial objectives and enterprise risk. Her clients span the technology, consumer products, home improvement, healthcare, life sciences, financial services, insurance, telecommunications, retail, and private equity sectors.

A recognized authority on California privacy law, Sheri advises on the California Consumer Privacy Act (CCPA) and other comprehensive state privacy laws; advertising technology and data broker requirements; children’s and minors’ privacy; consumer health and financial privacy; workplace privacy; and the use of AI involving consumer, health, and employment data. She helps clients design and implement privacy and AI governance programs, conduct risk assessments, develop internal policies and playbooks, and address novel questions involving product development and data commercialization.

Sheri also represents clients in privacy regulatory investigations and enforcement matters. She counsels companies on privacy litigation risk and participates in defending and resolving privacy- and advertising technology-related claims, including matters arising under federal and state wiretap laws. Her broader litigation experience includes complex commercial disputes, class actions, and copyright, trademark, right of publicity, real estate, and contract matters.

Sheri co-founded the Privacy Law Section of the California Lawyers Association which brings together regulators, litigators, in-house, and outside counsel working on privacy and AI matters in California and beyond. She served for several years as chair of the section and continues to serve on its Executive Committee. Sheri is also a member of Sidley’s AI Working Group, as well as the California Consumer Privacy Litigation Task Force, a dedicated group of lawyers focused on the California Consumer Privacy Act (CCPA), counseling clients on how to mitigate litigation risks.

She is an International Association of Privacy Professionals (IAPP) Certified Information Privacy Professional/United States (CIPP/US) and Europe (CIPP/E). 

Representative matters that demonstrate the scope of Sheri’s practice include the following: 

• Designing data privacy governance programs for in-house legal and compliance teams, including vendor management frameworks, data protection agreements, risk assessment processes, and internal policies and procedures.
• Advising on privacy and risk mitigation for advertising and marketing programs, including compliance with CAN-SPAM, the Telephone Consumer Protection Act (TCPA), The Campaign Registry requirements, and laws governing advertising technologies, online tracking, and data clean rooms.
• Serving as outside product counsel to engineering, data science, AI, product, marketing, and legal teams in connection with new products, features, and data uses.
• Conducting website and mobile application tracking technology assessments and audits, advising on consent architecture, and assisting with the implementation and optimization of consent management platforms.
• Advising on the design and implementation of AI governance programs, including use-case assessments, consumer disclosures, internal standards, and risk documentation.
• Conducting privacy, AI, and cybersecurity diligence in connection with mergers, acquisitions, and other strategic transactions.
• Representing clients in state privacy regulatory investigations and enforcement matters.
• Defending clients against demands and complaints arising under the California Invasion of Privacy Act (CIPA) and related federal and state privacy laws.

Regulatory and Commercial

• Provided strategic counseling to large consumer products company, across privacy, AI, ad tech, workplace privacy issues, including the development of playbooks, risk assessments, privacy policies, and internal SOPs.
• Advised several telehealth providers regarding intersection of state comprehensive privacy laws, consumer health privacy laws, health privacy regulations, and ad tech-related risks in development of data governance policies, consumer-facing disclosures and rights, interfacing with consent management providers and vendor management.
• Provided strategic counseling to large consumer payment platform regarding integration of artificial intelligence products, drafted consumer-facing notices, and worked closely with an outside consulting firm and leadership to conduct and document risk assessments.
• Advised several large pharmaceutical companies on design and implementation of U.S. privacy programs, including privacy policies and notices, management of talent acquisition companies, use of advertising technologies and data clean rooms, and mitigation of risks related to the use of online tracking technologies.
• Provided commercial contract counseling to leading U.S. radiology practice related to AI model training for use in medical field.
• Counseled a large social media platform regarding compliance with U.S. state data privacy laws, with a focus on data subject requests, management of internal data repositories, and data deletion protocols.

Transactions

• Ryan Specialty, a specialty insurance provider, wholesale broker, and managing underwriter, in its acquisition of US Assure Insurance Services of Florida, Inc., a provider of builder’s risk insurance for residential and commercial construction and renovations — in the SME segment of the builders risk insurance market — for approximately US$1.075 billion in cash and up to an additional US$400 million.
• DigiCert, Inc., backed by Clearlake Capital Group, L.P., TA Associates, and Crosspoint Capital Partners L.P., in its acquisition of DNS Made Easy.
• Perforce Software, Inc., a provider of solutions to enterprise teams backed by Francisco Partners and Clearlake Capital Group, L.P., in its acquisition of Puppet, an automation software platform which enables users to deliver, update, monitor, and secure software across physical and virtual machines.
• Clearlake Capital Group, L.P. in its acquisition of global edtech company Discovery Education, Inc. from Francisco Partners.
• Innovative clean makeup company ILIA Inc. in its acquisition by Famille C, the Courtin-Clarins family holding company and owner of the Clarins brand.
• nThrive, Inc., a leading healthcare revenue cycle management software-as-a-service platform backed by Clearlake Capital Group, L.P., in its US$1.74 billion acquisition of TransUnion Healthcare from TransUnion.
• Clearlake Capital Group, L.P. in its acquisition of Precisely together with TA Associates.

• Former Chair, Founding Member; Executive Committee Member; California Lawyers Association, Privacy Law Section
• Fellow, OnRamp Fellowship