Sr. Counsel, Privacy, Technology & Data

Virtuoso, Ltd.•Fort Worth, TX

About The Position

Virtuoso is the leading global travel agency network specializing in luxury and experiential travel. This by-invitation-only organization comprises over 1,200 travel agency locations with more than 20,000 travel advisors in 58 countries throughout North America, Latin America, the Caribbean, Europe, Asia-Pacific, Africa and the Middle East. Drawing upon its preferred relationships with 2,800 of the world’s best hotels and resorts, cruise lines, airlines, tour companies and premier destinations, the network provides its upscale clientele with exclusive amenities, rare experiences and privileged access. Annual sales of (U.S.) $35 billion make Virtuoso a powerhouse in the luxury travel industry. For more information, visit www.virtuoso.com. The Senior Counsel, Privacy, Technology & Data owns Virtuoso’s legal program for privacy, data processing, technology transactions, Virtuoso’s own digital products, cybersecurity incidents, and AI across 54 countries. Technology owns security operations and technical incident response; this role owns their legal dimensions, including privilege, notification, regulatory exposure, and contractual remedies, and directs privacy compliance operations performed by Legal Operations.

Requirements

JD from an ABA accredited law school; active license in good standing in a U.S. jurisdiction, with State Bar of Texas membership or licensed in another U.S. jurisdiction with eligibility to provide legal services to a corporate employer in Texas
6 or more years of privacy and technology transactions experience, including in-house
Experience with GDPR, U.S. state privacy laws, and cross-border data transfers
Experience negotiating Technology agreements including but not limited to SaaS, API, and data processing agreements and supporting incident response activities
Experience with AI and with ad tech or marketing data practices

Nice To Haves

CIPP/E, CIPP/US, or CIPM certification, or completion within 12 months preferred
Technical fluency with technology platforms and data architecture preferred
Experience with Asia Pacific privacy regimes, particularly China preferred
Experience building AI governance programs preferred

Responsibilities

Own privacy compliance across all applicable data privacy laws including GDPR, UK GDPR, U.S. state privacy laws, Canadian law, China’s PIPL, and Asia Pacific regimes, including providing guidance and direction to business teams, technology, and operations regarding notices, records of processing, data protection impact assessments, and consent and marketing requirements.
Provide direction to the Technology team for proper DSAR handling, data map upkeep, and provide privacy training administered by Legal Operations, and manage regulatory reporting obligations as they arise.
Assess data protection officer and local representative requirements in each jurisdiction and recommend internal or external designation.
Build and maintain enterprise-wide materials to assist the business in data sharing activities including maintaining and improving upon the existing data privacy and data sharing framework with country and use case schedules and/or examples, and negotiate DPAs, subprocessor terms, and manage cross-border transfer mechanisms.
Support other legal department negotiations by providing data privacy expertise as related to other commercial agreements.
Draft and negotiate technology, SaaS, API integration, licensing, and development agreements, and advise on ad tech and marketing data practices.
Serve as product counsel for Virtuoso’s websites, apps, tools, and AI initiatives, and develop privacy resources for the member network.
Establish AI governance, including an internal AI use policy, review standards for AI tools and vendor AI features, and monitoring of AI legislation.
Serve as legal lead in cybersecurity incidents and fraud events, engaging cyber outside counsel to preserve privilege, and lead notification analysis and regulator, member, and partner communications.
Partner with Technology security leadership on vendor risk, security audits, and policy requirements, escalating enterprise level matters to legal department leadership.