Receiving notice that their personal information or online activity has been stolen and shared with criminals is many people’s worst nightmare. That’s why attorney Jean-Marc Appolon has dedicated his career to forming a piece of the wall that protects New Yorkers’ sensitive data and information.
Currently a subject matter expert in privacy, cybersecurity, and technology at civil litigation firm Labaton Keller Sucharow LLP, Appolon proactively reviews the data privacy practices of companies from the outside – examining how they’re handling information, testing to see if their stated policies are actually being followed, and analyzing if their conduct is in line with city, state, and federal law.
Based on that work, he then takes legal action against companies if they are improperly or illegally handling people’s personal identifying information. That role has become an increasingly critical one in the ever-advancing digital age, Appolon says.
“There’s a lot of privacy issues that I find very interesting today because now, we don’t just have to worry about a ‘peeping tom,’” Appolon said. “We have to worry about people internet stalking and companies collecting vast amounts of information that’s very personal to you and leveraging that to maximize profit.”
A material example of the type of work Appolon does includes nabbing a menstrual cycle tracking app for illegally sharing users’ private medical data with unauthorized third parties looking to use that information to direct targeted advertisements to app users or sharing it with other entities that are improperly using, analyzing, and storing it in ways that put people’s privacy at risk.
If a company is hacked or experiences a data breach that puts people’s private information — like medical records, credit card numbers, government identification, or other sensitive data — at risk, Appolon and his firm respond by assessing whether the entity had the proper safeguards in place, whether they were followed, and accounting for what information has been compromised. He and his team also work to uncover whether a company is illegally or improperly tracking and collecting information on what videos a person watches or sites they visit online or other pieces of their digital footprint.
“For example, let’s say you go on a website that has a cookie-sharing policy, and a notice pops up asking, ‘Do you want your [cookies] information to be shared?’ and if you click no, are they actually not sharing your personal information? That’s what I’m looking for,” Appolon said. “It’s really using my background in cybersecurity and privacy to find companies that are breaking the law and moving forward with claims against those companies for breaking the law, as well as protecting consumer protection policies.”
Not many attorneys specialize in this specific type of law, Appolon said. He told amNewYork Law he was drawn to it because preventing data and identity theft felt like one of the most pressing issues of the present day, particularly as the growth of artificial intelligence has resulted in an exponential increase in data privacy issues.
“My passion for this first started when I was trying to look at what’s relevant and why it’s important,” Appolon said. “Issues that used to happen in the physical world were happening in the virtual world, for lack of better words. It’s super interesting.”
Jean-Marc Appolon’s road to law
Prior to his current position, he provided legal counsel to companies on how to create and enforce strong data privacy protections to prevent breaches and hacks. He’s also worked for the New York State Insurance Fund, where he handled cybersecurity for the state’s workers’ compensation program, making sure people’s information was kept confidential. There, he was also tasked with reviewing and assessing every AI program the state was deploying in his department – right at the time generative AI was beginning to sprout up.
Appolon’s inclination towards dedicating himself to the most pressing, collective-consciousness capturing issues is at the root of what drew him to law in the first place.
“I was always wanting to be involved in social issues that are relevant to people in general and my immediate community,” Appolon said. “For example, when you hear about the Constitution and things of that nature as a kid, people talk about it as a big thing and something that’s very important that really sets the standards for America. As a kid, you’re like, ‘Okay, it was just a piece of paper.’ But, I was curious enough to look into why this document is more important than everything else.”
“That natural curiosity that led me into law,” he added.
Appolon’s desire to help his community is also what’s led him to dedicate large swaths of his time to the City Bar and pro bono data privacy work for small nonprofits after his day job effectively serving as a data privacy watchdog.
As the co-chair of the City Bar’s Privacy, Technology and Cybersecurity Committee, Appolon has helped develop a report on AI and student data privacy in the city’s public school system that the City Bar is now in the process of reviewing and submitting to Mayor Zohran Mamdani.
The report – which involved Appolon and colleagues reviewing and interrogating contracts the city has with vendors whose products are in the school system to determine whether their privacy policies properly protect student data – includes recommendations for the city’s Department of Education on how to improve its data governance and incident preparedness plans.
“We identified the laws that they need to follow, and then we went in and reviewed the vendors that they contract with, the language for the privacy requirements and the security requirements,” Appolon said. “One thing that we found is that some of the technology vendors are collecting vast amounts of kids’ personal information.”
For example, he said, the city was contracting with an electronic hall pass company that was essentially monitoring how long students were in the bathroom. This tracking — along with grading and gamifying basic student activities — are things that Appolon’s committee advised against.
“They were collecting so much information about kids in the city,” Appolon said. “The New York City public school system – most public schools – do not have a stellar record when it comes to protecting that information.”
After his work on the report, Appolon gave testimony in a September City Council hearing focused on the use of AI in public schools as an expert on the matter. He said he encourages the city to reconsider the guidance on artificial intelligence and screen time, like the complete prohibition on the use of AI for grading purposes, as well as to provide greater clarity regarding the implementation of screen time recommendations.
He believes the jury is still out on whether AI will help or harm student learning, so the school system should implement a limited pilot program for artificial intelligence and grading in order to create an evidence-based approach to creating policy.
“We need a pilot program,” Appolon said. “It’s so important that the city, the state, and the federal government are not creating policy based on just what we think. We need to create policies based on evidence, and that could only be gathered after doing pilot programs and testing things out.”
Appolon’s also spent the past three years working with a professor and students from New York Law School – his alma mater – to offer free legal support to nonprofits, museums and other small organizations, helping them develop and enforce secure data privacy and protection for their clients and donors that they otherwise wouldn’t be able to afford.
“We’re helping nonprofits get the documents they need to be prepared on knowing how to handle personal information, their clients’ information, or their members’ information, and also knowing how to respond to a cybersecurity attack,” Appolon said. “For their privacy policy, that basically means setting the terms of how they use people’s personal information, what they collect, how they share it, who they share it with, the list goes on.”
“We also help them with [developing] a cybersecurity incident response plan for when things go bad, or if they were to be hacked,” Appolon continued. “That’s something that’s very important because, as more and more of our lives are being taken online, an incident like that could cost the company. For example, in the case of a nonprofit, if your donor’s personal information is out there, that could cost you the donor no longer donating to your nonprofit if their information has been compromised by your site.”
Appolon said he sees this type of volunteer work as extremely important because it allows him to give something back to organizations that he feels are having a positive impact on the world and ensure they’re able to keep doing their work securely.
“Being able to help someone that’s fighting a good fight is something that I think is always net positive,” Appolon said. “It’s a way for me to give back to the city, and it’s a way for me to really use my knowledge and my position in a way that helps an organization out. And by helping them, I am helping New Yorkers and Americans because I’m trying to make sure that their personal information is safe.”
Appolon said his work on all of these issues is far from over. He sees himself remaining in this type of law long-term – the need for it is only going to go up as time goes on, technology continues to develop and people’s personal data becomes increasingly more valuable to everyone, including bad actors.
“This work is important because it’s not if it’s going to happen; it’s when it’s going to happen,” Appolon said of data breaches and identity theft. “That’s basically the reality of the present time.”
