I represent organisations before regulators, and build governance across the digital rulebook.

I represent organisations before data protection authorities, including in contested regulatory proceedings.

• Represented Yahoo in contested proceedings before the CNIL’s restricted committee concerning cookie compliance, in which the committee imposed a sanction materially below the rapporteur’s recommendation, and subsequently before the Conseil d’État on appeal.
• Lead technically complex regulatory investigations end to end, drafting Yahoo’s formal submissions in Data Protection Commission inquiries and appearing in person before regulators in Ireland, France and Italy.
• Represented both Yahoo entities before data protection authorities following the 2025 separation of the EMEA business, addressing how data was managed and how data subject rights were protected through the restructuring.

With public policy teams, I shape the positions organisations take on digital regulation.

• Serve as the subject-matter lead Yahoo’s global public policy team relies on when forming the company’s position on EU digital regulation, across platform regulation, competition, ePrivacy and online safety instruments.
• Represented Yahoo in the European Commission's data sharing consultation under the Digital Markets Act, and before the UK Competition and Markets Authority.
• Represented Yahoo at an Ibec Technology Ireland industry roundtable on the Irish regulatory landscape, including implementation timelines for instruments such as the e-Evidence package, ahead of Ireland’s 2026 Presidency of the Council of the European Union.

I build privacy and AI governance programmes that stand up to audit, regulatory examination and board scrutiny.

• Led the privacy workstream on the 2025 separation of Yahoo’s EMEA business, building the governance structure for the newly established entity from the ground up and putting it into operation.
• Built Yahoo’s privacy and AI governance programme, including committee structures, business-line accountability and mapped controls, and scaled it from Europe into the global template used across all regions including the United States. Designed the governance structure evidencing that key data protection decisions are taken in Ireland, supporting the Irish Data Protection Commission as lead supervisory authority under the GDPR one-stop-shop, and secured formal approval from the Yahoo EMEA Board. Regulatory response time fell by 60 per cent.
• Led the GDPR compliance programme at Hertz International across global IT systems: discovery and classification of the systems estate, gap analysis, remediation, and a quarterly second-line testing cycle. The programme passed independent audit by Cognizant, retained by the audit committee of the Hertz board in the United States, against plan in December 2017 and against delivery in April 2018. Hertz then expanded the scope of its annual audit to include privacy compliance, conducted by PwC.

On AI governance and automated decision-making, I advise product and engineering teams, and research the regulation at doctoral level.

• Led the privacy assessment for a global contactless vehicle rental implementation using facial recognition to authenticate customers and unlock vehicles: evaluated competing identity verification providers, authored the data protection impact assessment, and set the conditions on which deployment proceeded.
• Advise product and engineering teams on recommender systems, automated processing and emerging model architectures under the EU AI Act and GDPR.
• Research the regulation of algorithmic credit scoring at doctoral level at UCD Sutherland School of Law, examining how EU law protects individuals against algorithmic discrimination where protected characteristics are inferred rather than processed directly.

The privacy and regulatory brief for online safety, content moderation and law enforcement response sits with me.

• Act as in-region privacy partner for the Global Trust and Safety team.
• Led Yahoo’s Digital Services Act transparency reporting, covering law enforcement disclosure practices and right to be forgotten requests, and established the CSAM reporting format.
• Led the privacy and regulatory workstream for Yahoo’s CSAM detection implementation, authoring the data protection impact assessment, consulting the Data Protection Commission on the approach, and establishing the safeguards and conditions for deployment.

I lead the legal and regulatory side of information security, from governance and risk through incident response and regulatory engagement.

• Led the regulatory response to a cyber attack and resulting personal data breach at a Hertz UK subsidiary, drafting the full breach reporting documentation and conducting the engagement with the Information Commissioner’s Office. The ICO concluded the matter without enforcement action. Also handled the civil claims that followed.
• Took on Yahoo’s information security governance programme as one of the first business-critical workstreams on joining, establishing the EMEA decision-making framework through which security risk is governed: reporting and escalation routes, documented allocation of responsibilities, and the controller-side governance of Yahoo Inc as processor.
• Lead the privacy aspects of security incident response across EMEA, owning regulatory assessment and submissions, reporting ahead of deadline and engaging the Data Protection Commission on the substance.