Chatrie and Location-Data Demands: Constitutional Objections, Scope, and Compliance Strategy

Paul Lanois, Director, Data | Fieldfisher

Paul Lanois is a Director in Fieldfisher’s Data practice, where he advises companies on complex privacy, cybersecurity, and technology matters. His work spans global data protection compliance, cross-border data transfers, cybersecurity risk, incident response, and the design of privacy-forward products and services. Drawing on his experience across the United Kingdom, France, Luxembourg, Switzerland, Hong Kong, and the United States, Paul advises clients ranging from startups to Fortune 500 multinationals on navigating evolving privacy regimes, including the GDPR, the ePrivacy Directive, the CCPA/CPRA, and other U.S. state privacy laws. He has particular experience with emerging technologies and data-driven business models, including Internet of Things, mobile applications, artificial intelligence and machine learning, virtual and augmented reality, and cloud-based integrations.

• Education & Credentials

Paul is admitted to practise in California, New York, the District of Columbia, and before the Supreme Court of the United States. He holds several leading privacy and security credentials, including Fellow of Information Privacy (FIP), CIPP/A, CIPP/US, CIPP/E, CIPP/C, CIPM, CIPT, CDPSE, SSCP, and PCIP. He is fluent in English and French and has intermediate German proficiency.

• Recognition & Leadership

Paul has been recognized for his work in privacy, cybersecurity, and technology law, including as a winner of the 2022 California Legal Awards “Lawyers on the Fast Track (under 40)” by The Recorder, inclusion in Global Data Review’s “40 under 40,” and recognition among Security Magazine’s “Most Influential People in Security.” He was also selected for the Privacy Shield Framework Binding Arbitration Program list of arbitrators developed by the U.S. Department of Commerce, the European Commission, and the Swiss Federal Administration.

• Professional Involvement

Paul is an active speaker, author, and industry contributor. He serves in leadership roles within the American Bar Association’s Science & Technology Law Section, including co-chairing the E-Privacy Law Committee, and he co-chairs a subgroup of the NIST Privacy Workforce Public Working Group. He is a member of the IAPP’s CIPP/US Exam Development Board and the California Lawyers Association’s Privacy Law Section Executive Committee. He also teaches data privacy at UC Law San Francisco and in the Law Society of Ireland’s Certificate in Data Protection Practice program.

• Experience

Paul advises on a broad range of privacy and cybersecurity matters, including incident response, risk assessments, policy development, regulatory compliance, and multi-country privacy projects. Before joining Fieldfisher, he served as Vice President and senior legal counsel at Credit Suisse in Switzerland and Hong Kong. Earlier in his career, he worked on technology transactions at international law firms in London and Luxembourg and served as an Associate Professor at the University of Cergy-Pontoise Law School in France.

Katelyn N. Ringrose, Data, Privacy & Cybersecurity Attorney | McDermott Will & Schulte

Katelyn N. Ringrose (CIPP/US, CIPP/E, CIPM, FIP) advises leading global companies on complex privacy, cybersecurity, and artificial intelligence matters. She counsels clients on the handling of sensitive personal data, cross-border data flows, and compliance with rapidly evolving state, federal, and international privacy regimes, with a focus on practical, industry-specific governance solutions. Katelyn regularly supports multinational organizations on high-visibility issues that shape trust in digital products and global data flows, with work spanning incident response, AI governance, and regulatory strategy.

• Education & Credentials

Katelyn earned her J.D. from Notre Dame Law School and her B.A. from the University of California, Davis. She is admitted to practice in the District of Columbia and before the Supreme Court of the United States and the U.S. Court of Appeals for the Fifth Circuit. She holds the CIPP/US, CIPP/E, CIPM, and FIP privacy certifications from the International Association of Privacy Professionals.

• Recognition & Leadership

Katelyn has received significant recognition for her leadership in privacy and technology law, including the IAPP Privacy Leadership Award (2025), the SANS Institute Difference Maker Award (2021), the United State of Women Changemaker Award (2020), and selection as a Fastcase 50 honoree recognizing “the most courageous innovators, techies, visionaries, and leaders in the law” (2018). She serves as a lead author on amicus briefs in high-profile matters, offering courts—including the U.S. Supreme Court—expert analysis on geofence warrants and the constitutional implications of age-verification mandates.

• Professional Involvement

Katelyn is a recognized subject-matter expert on technical and online privacy issues, and a prolific author and commentator on developments in AI regulation, age verification, biometric privacy, data breaches, and SEC cybersecurity disclosure. She has authored lead amicus briefs in NetChoice v. Lynch, Chatrie v. United States, and multiple state-level age-verification challenges, and contributes regularly to outlets and forums including the IAPP, the Harvard Law School Forum on Corporate Governance, and PR Daily, as well as McDermott’s client alerts and reports.

• Experience

Katelyn advises clients on a broad range of privacy and security matters, including the Foreign Intelligence Surveillance Act, the Electronic Communications Privacy Act, the Stored Communications Act, the Cyber Incident Reporting for Critical Infrastructure Act, SEC disclosure rules, and emerging sectoral, age-verification, and biometric privacy laws. Before joining the firm, she served as the global policy lead for law enforcement and government access at a major technology company, where she directed global strategy on cybercrime, data localization and retention, and government-access frameworks. She draws on that experience when guiding clients through data security incidents, government inquiries, and the development of robust cybersecurity and privacy programs.

SESSION 1 – Chatrie and the Third-Party Custodian: Standing to Object to Location-Data Demands | 2:30pm – 3:30pm

This session examines the Supreme Court’s June 29, 2026 decision in Chatrie v. United States and its direct implications for third-party data custodians who receive government demands for location data. Attorneys will learn how Chatrie extends Carpenter, why the Court’s “reasonably views as his own” standard shifts compliance obligations for custodians, and what doctrinal tools — Fourth Amendment standing, Stored Communications Act mechanisms, and emerging state property-rights theories — are available to challenge overbroad demands. Attendees will leave with a framework for evaluating each demand’s constitutional sufficiency before compliance and for identifying when to raise particularity, probable-cause, and third-party standing objections.

BREAK | 3:30pm – 3:40pm

SESSION 2 – Responding to a Location-Data Demand: Scope Objections, Sequencing, and Escalation | 3:40pm – 4:40pm

When a subpoena, 2703(d) order, or geofence warrant for location data lands on a company’s desk, the constitutional question of who may object is only the beginning — someone still has to decide what gets produced, in what order, and where to draw the line. This session takes the custodian’s seat and walks through the operational response: triaging incoming legal process, mapping the demand against the location signals the company actually holds, and building scope objections grounded in overbreadth, particularity, and technical infeasibility. Paul Lanois covers the meet-and-confer letter, staged and anonymized production sequencing, negotiated narrowing of geofence radius and time windows, nondisclosure orders and user notification timing, and the escalation triggers that justify moving to quash or demanding a warrant. He also addresses the cross-border layer — GDPR Article 48, the CLOUD Act, and MLAT sequencing — plus the internal governance, vendor-chain obligations, and data-minimization design choices that reduce exposure before the next demand arrives.