By Kurt Wimmer, a Partner with Covington & Burling LLP in its Washington, DC office, where he chairs the Data Privacy and Cybersecurity Practice, and Ashden Fein, Catlin M. Meade, and Andrew Vaden, Associates with the firm. Foreword by David A. Heiner, Vice President and Deputy General Counsel of the Regulatory Affairs team at Microsoft Corporation.