Q: You’ve had an extraordinary career spanning the private sector, government, academia, and now the arts. Could you walk us through your professional journey — from law firm partner to DHS Chief Privacy Officer, Fortune 500 leader, and General Counsel at the Lucas Museum of Narrative Art? What have been the key inflection points that shaped your path?
A: I have been fortunate to have an incredibly diverse career. Some of those opportunities are sheer luck and good timing. Others came about by taking chances on seemingly novel opportunities where my previous skill sets could be utilized. Regardless of the moment, I evaluated each possibility by applying a three-part test:
Each one of my career choices had these I-O-I elements in it. Sometimes the weights of I-O-I fluctuate (for example, it is harder to find a job that is novel or innovative as a young attorney, even though I was fortunate to do so at an early age). Furthermore, my calculations on I-O-I also evolved over the years. Each career move was a way to evaluate what skills I wanted to develop, whether the purpose and mission aligned, and whether I could add value to the organization.
Through this process, I realized that I really love working with clients to develop products and services. Ex ante legal counseling and then operationalizing with my clients is my favorite part of practicing law. I loved my clients at Hogan and Jenner; they challenged me and inspired me every day. With that said, after working “in-house” as the Chief Privacy Officer at DHS, I realized that in-depth and consistent client interaction and engagement (and collective problem solving) was my preferred environment. Thus, when my client, The Walt Disney Company, offered me to come in-house to be a leader of what I consider one of the best privacy teams in the world, the I-O-I analysis made the decision obvious.
Similarly, when I decided I wanted to broaden my skill sets beyond privacy and cybersecurity, the I-O-I analysis led me to return to DHS to be first the Chief of Staff to Deputy Secretary John Tien, and then Assistant Secretary for Countering Weapons of Mass Destruction.
Q: What originally drew you to law, and how did those early choices influence your later focus on privacy, cybersecurity, and data governance? You began your career working on privacy, cybersecurity, and data protection before those disciplines were mainstream in the way they are today. How did you first get your start, and what drew you to those issues?
A: My luckiest career opportunity was because of timing and a good interpersonal relationship. I became one of the first privacy lawyers by happenstance. I was a young lawyer at Hogan [and Hartson], working on a seminal First Amendment challenge to the 1996 Telecommunications Act, Playboy v. United States (where we won in the Supreme Court). At the same time, Congress started questioning whether there should be additional laws governing the Internet (beyond the then-nascent Section 230 of the CDA).
Christine Varney had recently returned to the firm after a successful stint as a Federal Trade Commissioner, where she first identified online privacy as a consumer protection issue. She was well-positioned to educate the Hill and the public about online privacy as well as the opportunity of self-regulation. Because of my experience at the Congressional Research Service before law school and the recent litigation on the Telecommunications Act, Christine invited me to join her on some Hill briefings. And from there, a career was born.
Christine and I partnered well together through our decade-long work relationship. Honestly, when evaluating opportunities as part of the I-O-I analysis, I fundamentally believe that factoring in colleagues and work environment is important when considering job opportunities. Each person is going to have different standards for what they want in a work environment. I fold these considerations into INTEREST; if you don’t like your colleagues or environment, you are not going to thrive, nor have the impact you want.
Christine was starting to develop an amazingly diverse set of clients, including representing Netscape in the U.S. v. Microsoft antitrust litigation. Supporting that work (to the extent a second-year associate can support!) was an amazing introduction into antitrust analysis as well as internet technology. Learning about how cookies work in internet browsers was the beginning of my education in online technology and, thus, online privacy.
Shortly thereafter, Christine and I helped found the Network Advertising Initiative. We represented multitudes of ad servers, online companies, and online privacy coalitions. It was a heady time to work on these burgeoning issues.
Q: You’ve held leadership positions in government, private practice, a Fortune 500 company, academia, and now the arts. What motivated your transition to the Lucas Museum, and how did you prepare for such a shift in industry and mission?
A: I obviously knew my tenure as a Presidentially-appointed Assistant Secretary was going to come to an end on January 20, 2025. I wanted to be very intentional about my next move, weighing the impact, opportunity, and interest for a wide range of options.
In the meantime, in Spring 2025, I was a part-time Professor of Practice at the Georgia Tech School of Cybersecurity and Privacy. What a fun and different experience for me to teach classes and mentor students. It was a great respite from the overall job hunt. I developed additional skills, and the faculty and students at SCP are amazing!
While I was weighing opportunities, the General Counsel of the Lucas Museum of Narrative Art position came open again (I had considered it 3 years earlier). Analyzing the impact that the museum will have in Los Angeles and around the world, identifying the opportunities for me to utilize my existing skill sets and to learn new ones, coupled with my ongoing interest in arts and culture, I decided that my next inflection point was going to be to return to Los Angeles. I was general counsel from 2025-2026, recently deciding that, given current world events and the many important policy issues involved, I want to return to working on issues related to national security and technology. I don’t know what that next move or portfolio of moves looks like, but I just know I will apply the I-O-I test!
It was inspiring to work to implement George Lucas’s vision about how storytelling creates community. The museum will open to the public in September 2026, and it will be an important addition to the cultural life of Los Angeles.
Q: You’ve navigated four very different environments – AmLaw 100, Fortune 500, federal government, and a museum. What’s been most different about these roles? What’s been constant?
A: As the youngest of seven children, I think I am drawn to complex environments where connections and inter-relationships impact the way the organizations work together. Notably, both DHS and Disney are complex, international organizations with multiple (and sometimes competing) missions, each with over 200,000 employees! When I started working at Disney, my new colleagues were surprised at how quickly I navigated the byzantine infrastructure; it reminded me of DHS.
One of the things that I relished at both DHS and Disney was working with disparate groups to find a common approach that could accomplish each organization’s missions while also providing a framework to apply privacy and cybersecurity principles. Both DHS and Disney had relatively small centralized infrastructure; you had to rely on norms, best practices, and influence to accomplish your goals in the field.
When I was DHS CPO, the Department required that all Components (e.g., Coast Guard, CBP, FEMA, ICE, Secret Service, TSA, USCIS) have a dedicated Privacy Officer reporting to the Component head. In this way, the Component privacy officer developed their own relationships and connections, and had visibility into the early projects that were being considered that could have created privacy concerns.
The Component Privacy Officers were crucial, raising and addressing issues early, thus avoiding public blowback and a reduction in public trust. As DHS CPO, we could look across the Components to make sure that mission needs were addressed while having a consistent, proactive privacy approach across the Department.
This decentralized and multi-layered privacy strategy made the DHS Privacy Team the Crown Jewel of federal privacy programs until 2025, when the current CPO abandoned the autonomous Component Privacy Officer approach, as well as rescinding every DHS-wide privacy policy that provided that consistency.
Working as a General Counsel for a start-up museum, the size of the team was smaller, although the issues were wide and varied. I was able to bring my expertise to support the museum (including privacy, cybersecurity, and physical security) while learning new areas, including art collection management and provenance research.
The constant factor in my career is relationships. I love working with disparate teams to achieve goals. I also love to mentor younger colleagues; one of my core values is to share knowledge and experience to help those following us.
Q: How has your leadership approach evolved across these sectors – from managing legal and policy teams at DHS to guiding a smaller, mission-driven institution like the Lucas Museum?
A: As noted above, I really value working with teams to accomplish missions.
When I was Chief of Staff to the Deputy Secretary, I not only had to manage the Deputy’s staff, but I also managed a large group of detailees from every component in the Department. Furthermore, I was the point person on several inter-agency policy issues for the Deputy, so I had to coordinate closely with other Departments. Keeping all those work streams moving forward seamlessly was a challenge -- and exhilarating.
When I became the Assistant Secretary at DHS CWMD, I was overseeing my largest team (250 federal employees and 500 contractors). The workforce composition was also different from what I was used to, particularly from my private sector work. I had incredibly knowledgeable subject matter experts on really complex topics related to chemical, biological, radiological, and nuclear threats and risks. My team included 40 PhDs in topics as diverse as nuclear engineering, chemical weapons, and biomedical engineering! In addition, over 50% of the team were military veterans.
I tried to allow these experts to do their work while looking for ways to make the office work more efficiently. I started working groups to address inter-agency work, strengthened state and local partnerships, and created policies and procedures to prioritize our outreach. It was challenging and rewarding to leverage my legal and policy skills to systematize the great work that the teams were doing.
Learning to work with experts with skills different from mine (from nuclear physics to narrative art) has been inspiring, and I continue to try to develop in this area every day.
Q: At DHS and in private practice, influence came from expertise and process. In the museum world, influence often depends on narrative and mission. How have you adapted your approach to stakeholder engagement?
A: I think influence is a combination of multiple factors. Knowledge and expertise are of course factors, as are finding common ground and ways to cooperate collectively. When I was at DHS Privacy and Disney Privacy, it was important to find the highest common denominator of compliance without impacting the mission. That requires inquiry, communications, teamwork, and strategy to work with a panoply of stakeholders. In such an environment, it is very important to identify allies, non-privacy experts who would support the privacy mission. At DHS, two of my biggest allies in leadership were the Undersecretary for Intelligence and Analysis and the Secret Service Director. They brought gravitas and experience to the privacy decisions made for the Department. At Disney, my closest clients were the cybersecurity team (again, one of the best in the business). During COVID, I had to work across all aspects of the Company to get movie and TV productions working safely, including working with labor and employment, health and safety, procurement, and security in multiple countries. It was exhilarating to get these productions working again by working with allies.
When working as outside counsel, you are often brought in on the more difficult issues, which is why listening and finding solutions are crucial. Sometimes, not all the stakeholders are your clients; you may need to be well-versed in the other stakeholder arguments to provide a comprehensive recommendation to your client.
Influence has a similar meaning for museums; yes, narrative and mission are factors, just like they are in for-profit organizations. Museums and government have additional stakeholders – the public, it is important to understand how the goals of your organization intersect with communities.
Q: The privacy and cyber landscape has transformed dramatically since you led those early programs at DHS. What are the biggest shifts you’ve seen – in technology, regulation, and expectations of leadership?
A: When I started advising clients on privacy, the data collection and use were relatively confined, even for websites. Each year, the data collected has increased, and so have the desired uses. I used to successfully challenge clients to not collect data for which they did not have a direct need. Now, data is collected, stored, and reused to inform data models, even if the initial collection may not have been necessary. I worry that we may not be able to identify sources and the quality of data as we try to make sure the data uses are appropriate.
With regard to regulation, it is clear that legislation, particularly with regard to technology, is reactive and cannot anticipate future innovation. I do think self-regulation and industry best practices can be very useful frameworks, as long as there is not a race to the bottom.
Q: You’ve led compliance and risk frameworks across highly regulated environments. How do you measure success when the organization’s mission is artistic and educational rather than commercial or national security–oriented?
A: As in-house lawyers, the client and the mission of the organization are paramount. There is a series of different laws and regulations that govern non-profit art museums, so I had to learn how to navigate them and support my client. As with many environments, the lawyers may need to balance various legal obligations.
For artistic institutions, having the proper intellectual property rights for their collection is really important. I supervised the Rights and Reproductions team at the Lucas Museum; even though I thought I knew a lot about intellectual property because of my earlier data governance and entertainment work, my team gave me more insight, so I now understand that licensing display rights for works of art the museum owns is integral and can be complicated.
Q: For attorneys and privacy professionals hoping to move across sectors – from government to private industry, or from corporate to nonprofit – what tactical advice would you offer?
A: Your career is long and unpredictable. Coming out of law school, we were encouraged to follow a very linear career path. Not being linear is the beauty of my career. I am an expert in a field (privacy and cybersecurity law) that did not exist when I graduated. I am one of the longest-serving political appointees at a federal department that was not created until I was almost a partner at Hogan (DHS). I worked to open a museum that has been a 50-year dream for one of the most important filmmakers of all time. None of these jobs would have been imaginable to me when I graduated from law school. And each of my jobs has built upon the previous ones to give me a panoply of skills and opportunities, hopefully inuring to the benefit of each subsequent client.
Q: What early habits or career decisions most helped you stay relevant across so many evolving disciplines?
A: My most effective skills are not legal. Before Law School, I was a conference coordinator for a parliamentary development program in Central and Eastern Europe, sponsored by the U.S. Congress and implemented by the Library of Congress/CRS. In that job, I learned to juggle priorities, to create programs that followed a logical progression, and to work to make content digestible to a wide range of skill sets. My organizational skills have helped me in every job.
Q: As museums increasingly become digital storytellers – through virtual exhibits, data collection, and interactive experiences – how do you see privacy and cybersecurity principles informing cultural institutions?
A: When the Lucas Museum of Narrative Art opens, it will be the most technologically advanced museum in the world. This is true both for several novel exhibits as well as the multi-layered security approach, partially through technology. My background in privacy and security was valuable for the team to make sure to provide a state-of-art user experience while also adhering to bedrock privacy principles.
Technology use will continue to grow in our cultural institutions, just like it is expanding in all parts of our lives.
Q: Looking back, what moments have most reinforced your belief in the value of public service – even when you’ve been in private or nonprofit roles?
A: Mission matters most to me. I think my I-O-I approach to my career demonstrates that we can serve the public and missions in many different ways. I also think that serving as outside counsel, advising on a complex and developing practice of law, such as privacy and cybersecurity, is itself a form of public service. Engagement in our communities are ways that lawyers can enhance our own environments.
I am a 1988 Truman Scholar, a national award for people planning a career in public service, so I guess this desire has been with me for a long time. What I have learned through my continuing work on the Truman Council is that public service can look different for everyone, and at different times in your career.
Q: Looking ahead, how do you see the role of General Counsel evolving in mission-driven or creative organizations?
A: General Counsels in all organizations need to be nimble and creative, to advise how to achieve mission-driven compliance. Understanding the strategic direction of the organization is incredibly important; it is crucial to be part of the organization’s strategic development, to understand the C-Suite vision, including its risk appetite. I previously had multiple clients in the same sector, and I needed to understand what that company’s risk tolerance was when giving advice. With that said, I think it is crucial for counsel to provide legal advice and options, not just defaulting to the client’s desires. We as lawyers have an independent obligation to our clients to inform them of the impact of their decisions.
Q: What are you working on that worries you?
A: I am not working on it right now, although I did last year. Using Artificial Intelligence to develop chemical and biological weapons concerns me greatly. My former office released a report on how to mitigate those threats, and there have been several steps by the AI companies to put in safety and security controls in their products. I hope those trends continue.
Q: Any other closing thoughts you’d like to share?
A: Answering these questions has been a lot of fun and humbling. I was reminded of all the great work my colleagues and I have been able to accomplish during my career. It also emphasized that our careers are a culmination of a wide variety of experiences, opportunities, and chances. Life is unpredictable and more wonderful than I could have imagined.
Career Path & Transitions Q: You’ve built a remarkable career that spans private pr...
Read More
David Sclar is a seasoned in-house counsel and Harvard Law School graduate who has spent ...
Read More
We’re pleased to share our 2025 Privacy (Legal) Market Compensation Guide, offering a c...
Read More