Tomás Ellery-Vance

Profile

Tomás Ellery-Vance is a partner in the Washington, D.C. office of Corvane Ryle LLP and a member of the firm's Privacy & Cyber practice. He advises companies on privacy compliance, data security, regulatory investigations and the response to cyber incidents, with deep experience in retail and consumer and health data.

Tomás helps clients build privacy programs that hold up under scrutiny from the Federal Trade Commission, state attorneys general and the California Privacy Protection Agency. He guides companies through breach notification, regulator engagement and the litigation that often follows, and he advises on the privacy dimensions of acquisitions and new technology deployments.

He writes frequently on developments across the states. Recent pieces include US State Privacy Laws: The 2026 Compliance Map, After the Breach: Lessons From Recent Retail Security Incidents and Health Data Beyond HIPAA.

Experience

Tomás Ellery-Vance's representative matters include the following, many of which are confidential and described in general terms.

• Led the incident response and regulator engagement for Halvern Retail Group following a payment card security incident affecting customers in 40 states.
• Advised Arvelo Health on the design of a consumer health data program under Washington's My Health My Data Act and comparable state laws.
• Represented Quillon Payments in a multistate attorney general inquiry into data security and vendor oversight practices.
• Counseled Brightmoor Foods on the redesign of its loyalty program data practices and consent flows across 28 states.
• Advised a national grocery chain on the privacy and consumer protection implications of in-store biometric and computer vision pilots.
• Defended a specialty retailer in an investigation by a state regulator concerning the sale and sharing of personal information.
• Led privacy and cybersecurity diligence for Northwall Capital on its acquisition of an e-commerce platform.
• Advised a global software company on its program for universal opt-out signals and sensitive data under state privacy statutes.
• Represented a financial services group in a ransomware event, coordinating forensic vendors, law enforcement outreach and disclosure decisions.
• Advised a children's apparel retailer on compliance with the amended COPPA Rule across its mobile apps and email programs.
• Counseled a medical device manufacturer on its approach to the EU-US Data Privacy Framework and onward transfers.
• Advised a NYSE-listed company on board reporting and SEC cybersecurity incident disclosure procedures.
• Counseled Meridian Arc Therapeutics on data governance for clinical research data shared with academic partners.

Qualifications

Bar admissions

• District of Columbia Bar
• State Bar of New York
• US Court of Appeals for the District of Columbia Circuit

Education

• JD, Georgetown University Law Center
• BA, Political Science, Boston College