Privacy Expert Witness

Privacy disputes often depend on a technical question: what information a system collected, where it went and who or what could access it. The examination follows the available evidence through collection, processing, storage and sharing.

Privacy questions require an understanding of what a system actually collects, retains and sends. We examine the relevant technology and records within the agreed scope. A policy describes intended practice; technical evidence is needed to assess the implementation and the period to which an opinion applies.

Depending on the approved scope, evidence may include configurations, data inventories, access records, application behavior, retention settings and relevant notices. We document the test conditions and distinguish observed data flows from assumptions about the system.

For example, a dispute may concern whether a web interaction transmitted a particular field to another service. The inquiry needs to identify the field, destination, conditions and available historical evidence. The presence of an integration alone does not establish that every visitor’s information was transmitted in the same way.

Permission to access data is different from evidence of access. A disclosed recipient is different from a confirmed transfer. Gaps in retained records can limit conclusions about historical activity.

Testing should record the configuration and conditions under which an observation was made. Supplied logs, application behavior and configuration history can help assess whether that observation is relevant to the disputed period. Where historical records are absent, current behavior must not be presented as a reconstruction without explaining that limitation.

GDF explains the technical findings and the records supporting them. Counsel addresses legal duties and conclusions. Before accepting the engagement, we discuss the technology, disputed questions and experience required of the proposed expert.

Technical findings can describe data flows, retention behavior and differences between stated and observed operation. Counsel determines the legal significance. A clear report keeps those roles separate and identifies the sources behind each factual proposition, including uncertainty about past configurations or incomplete records.

A privacy notice describes intended practices. Technical evidence can help establish what a particular system actually collected, stored or transmitted under the conditions examined. We compare relevant configurations, application behavior and retained records without assuming that a notice proves implementation.

For example, a dispute about a third-party integration may require identifying the fields sent, the receiving service and the conditions that triggered a transfer. Present-day testing does not automatically establish historical behavior. Version records and configuration history matter when the relevant period predates the examination.

Biometric privacy matters raise additional questions about enrollment records, templates, matching, retention and recipients. BIPA provides the statutory context in Illinois; counsel determines its application and legal duties. GDF’s technical role is to explain the system and evidence, including what the available records cannot establish.

The Rogers v. BNSF Railway case study describes GDF’s work for plaintiffs’ counsel on identity-verification database evidence. Restoring the records, normalizing their structure and addressing duplicate entries helped explain the population represented in the data.

The privacy significance of such records depends on both technical interpretation and legal analysis. The linked case history separates the original judgment from the later damages decision and settlement, avoiding a misleading presentation of the outcome. Read the BNSF case study and linked case records.

• Illinois General Assembly: BIPA section 15 ↗

For privacy expert witness work, discuss the disputed questions and the experience needed before defining the engagement. Joseph Caruso is profiled in our expert directory. Meet the GDF team and discuss the technology, questions and availability with us. The expert selected for a matter depends on its scope and the required experience.