Sr. Counsel, Privacy, Technology & Data

Virtuoso is the leading global travel agency network specializing in luxury and experiential travel. This by-invitation-only organization comprises over 1,200 travel agency locations with more than 20,000 travel advisors in 58 countries throughout North America, Latin America, the Caribbean, Europe, Asia-Pacific, Africa and the Middle East. Drawing upon its preferred relationships with 2,800 of the world’s best hotels and resorts, cruise lines, airlines, tour companies and premier destinations, the network provides its upscale clientele with exclusive amenities, rare experiences and privileged access. Annual sales of (U.S.) $35 billion make Virtuoso a powerhouse in the luxury travel industry. For more information, visit www.virtuoso.com. 

The Senior Counsel, Privacy, Technology & Data owns Virtuoso’s legal program for privacy, data processing, technology transactions, Virtuoso’s own digital products, cybersecurity incidents, and AI across 54 countries. Technology owns security operations and technical incident response; this role owns their legal dimensions, including privilege, notification, regulatory exposure, and contractual remedies, and directs privacy compliance operations performed by Legal Operations.

Essential duties and responsibilities include the following. Other duties may be assigned.

1. Privacy and Data Sharing
   1. Own privacy compliance across all applicable data privacy laws including GDPR, UK GDPR, U.S. state privacy laws, Canadian law, China’s PIPL, and Asia Pacific regimes, including providing guidance and direction to business teams, technology, and operations regarding notices, records of processing, data protection impact assessments, and consent and marketing requirements.
   2. Provide direction to the Technology team for proper DSAR handling, data map upkeep, and provide privacy training administered by Legal Operations, and manage regulatory reporting obligations as they arise.
   3. Assess data protection officer and local representative requirements in each jurisdiction and recommend internal or external designation.
   4. Build and maintain enterprise-wide materials to assist the business in data sharing activities including maintaining and improving upon the existing data privacy and data sharing framework with country and use case schedules and/or examples, and negotiate DPAs, subprocessor terms, and manage cross-border transfer mechanisms.
   5. Support other legal department negotiations by providing data privacy expertise as related to other commercial agreements. 
2. Technology and AI
   1. Draft and negotiate technology, SaaS, API integration, licensing, and development agreements, and advise on ad tech and marketing data practices.
   2. Serve as product counsel for Virtuoso’s websites, apps, tools, and AI initiatives, and develop privacy resources for the member network.
   3. Establish AI governance, including an internal AI use policy, review standards for AI tools and vendor AI features, and monitoring of AI legislation.
3. Incidents and Security Partnership
   1. Serve as legal lead in cybersecurity incidents and fraud events, engaging cyber outside counsel to preserve privilege, and lead notification analysis and regulator, member, and partner communications.
   2. Partner with Technology security leadership on vendor risk, security audits, and policy requirements, escalating enterprise level matters to legal department leadership.

Educational and Skills Requirements:

• JD from an ABA accredited law school; active license in good standing in a U.S. jurisdiction, with State Bar of Texas membership or licensed in another U.S. jurisdiction with eligibility to provide legal services to a corporate employer in Texas
• 6 or more years of privacy and technology transactions experience, including in-house
• Experience with GDPR, U.S. state privacy laws, and cross-border data transfers
• Experience negotiating Technology agreements including but not limited to SaaS, API, and data processing agreements and supporting incident response activities
• Experience with AI and with ad tech or marketing data practices
• CIPP/E, CIPP/US, or CIPM certification, or completion within 12 months preferred 
• Technical fluency with technology platforms and data architecture preferred
• Experience with Asia Pacific privacy regimes, particularly China preferred
• Experience building AI governance programs preferred
• Core Competencies – Innovation; Leadership; Marketplace Awareness; Analytical Skills; Collaboration; Self-Starter

Measures of Success:

• Data sharing guidance materials are created and adopted and the DPA backlog cleared within two quarters
• Median time to close privacy matters falls below 30 days
• Reviewed and advised on the Incident Response Plan, and assisted Technology, with ensuring that notification decisions made on time as well as provided guidance and support to table top exercises
• An AI use policy and AI vendor review standards are approved and in use

Travel Requirements:

• Infrequent travel may be required to attend company events (1-3 trips per year).
• Travel will be primarily domestic, but may include some international.

Type/Nature of Contacts:

• External: Partner and vendor legal and security teams, outside counsel, and regulators as needed.
• Internal: Daily contact with Technology, Global Products, Data & Analytics, and Global Marketing.

We offer a competitive salary and full benefits package, including medical/dental/vision/life, 401(k) savings plan, and more. Virtuoso is an equal opportunity employer, dedicated to promoting a diverse workforce.

Pay ranges are intended to cover roles based across the United States. An individual's base pay depends on various factors including geographical location, experience, knowledge, skills, and abilities of the applicant.