Grace Tang
Overview
Grace Tang is an associate in Crowell & Moring’s Privacy and Cybersecurity Group, advising clients across a range of industries on technology and privacy-related legal matters. She combines her experience in technology with a strong foundation in privacy as clients often face an overlapping and increasingly complex regulatory landscape – particularly in areas such as online safety and artificial intelligence.
Career & Education
- University of Law, LPC, 2021
- London School of Economics and Political Science (LSE), LLB Law, 2018
- Solicitor, England and Wales, 2023
Grace's Insights
Client Alert | 7 min read | 03.23.26
In a significant ruling on the application of data protection law in the United Kingdom, on 19 February 2026, the UK’s Court of Appeal (CA) ruled in favour of the UK Information Commissioner (ICO) in its appeal against the decision of the Upper Tribunal (UT) in the case of DSG Retail Ltd v The Information Commissioner [2026] EWCA Civ 140. This ruling clarifies the scope of data controllers’ security obligations with pseudonymised personal data and confirms that a controller’s duty to safeguard personal data is not diminished merely because a cyber attacker who exfiltrates that data would be unable to re-identify the individuals concerned.
Publication | 12.15.25
International Comparative Legal Guide - Telecoms, Media & Internet 2026
Client Alert | 10 min read | 12.01.25
Client Alert | 5 min read | 11.18.25
Insights
Grace's Insights
Client Alert | 7 min read | 03.23.26
In a significant ruling on the application of data protection law in the United Kingdom, on 19 February 2026, the UK’s Court of Appeal (CA) ruled in favour of the UK Information Commissioner (ICO) in its appeal against the decision of the Upper Tribunal (UT) in the case of DSG Retail Ltd v The Information Commissioner [2026] EWCA Civ 140. This ruling clarifies the scope of data controllers’ security obligations with pseudonymised personal data and confirms that a controller’s duty to safeguard personal data is not diminished merely because a cyber attacker who exfiltrates that data would be unable to re-identify the individuals concerned.
Publication | 12.15.25
International Comparative Legal Guide - Telecoms, Media & Internet 2026
Client Alert | 10 min read | 12.01.25
Client Alert | 5 min read | 11.18.25
