Nevada Appoints Casey Quinn as First State Chief Privacy Officer and General Counsel

Nevada's Governor's Technology Office (GTO) has named Casey Quinn its first State Chief Privacy Officer and General Counsel. He will lead privacy and data protection work across state agencies and serve as the GTO's top legal adviser. The office announced the appointment on November 9, 2026, with two other leadership hires.

The GTO's press release names the other two as Megan Franklin, Communications and Policy Officer, and Jared Wilkin, Chief IT Manager of the Client Services Division.

What the role covers

GovTech reported that Quinn's duties include advising agency leaders on contracts and purchasing, state rules, legislative matters and policies on emerging technology. GovTech also reported that he has nearly 20 years of legal experience in private practice and government, including as a senior deputy attorney general for Nevada. He holds the Certified Information Privacy Professional credential and is licensed in Nevada, Arizona and New York.

The job posting for the position, as described by GovTech in July, placed the hire on the GTO executive leadership team, reporting directly to state CIO Timothy Galluzi. The role advises him, the governor's office, executive branch leaders and statewide governance bodies on technology-related legal and policy matters. The posting said responsibilities include privacy and enterprise risk guidance across cybersecurity, AI governance, digital government, data sharing and information management.

Why Nevada created it

Galluzi said privacy gained urgency after the state's cyber incident. He said protecting state and constituent data had "always been a priority" but "rose to the top of the list," which led the office to create a dedicated executive role. He also pointed to AI. Galluzi said expanding AI adoption and more data sharing between agencies create opportunities but require stronger privacy safeguards.

On combining the two jobs, Galluzi said it was intentional. The CIO confirmed that the person hired would also provide legal advice to the GTO.

The appointment follows a February policy from the Governor's Technology Office. StateScoop reported that the policy replaces inconsistent practices across agencies. Data falls into one of four categories: public, sensitive, confidential or restricted, and StateScoop reported that agencies can add subtiers. StateScoop also reported that Social Security numbers and financial information are "confidential," while encryption keys and criminal history records are "restricted." Officials said the policy was in the works before the cyberattack, which StateScoop reported was discovered in August 2025.

A wider trend among states

GovTech cited a 2026 report from the National Association of State Chief Information Officers. It found 31 states now have a chief privacy officer, up from 17 in 2020. More than half of states are still building privacy programs, and many privacy leaders say they lack funding, staff or expertise.

Separately, in July 2026, Oregon CIO Terrence Woods selected Michael Hanna-Butros Meyering, previously chief communications and policy officer at Nevada's GTO, as Oregon's chief privacy and communications officer.

What this means for in-house counsel

Lawyers who contract with Nevada agencies, or who hold Nevada residents' data on the state's behalf, now have a named privacy and legal contact at the GTO. Quinn's remit includes contracts and purchasing, so counsel may want to prepare for closer scrutiny of data protection terms, security addenda and AI-related provisions. Check whether your current Nevada agreements map to the state's four data classification tiers. Check also whether your data handling practices match the tier the state would assign to the information you process.

The dual role is a model worth watching. Nevada has joined the two functions in one position. Companies weighing whether privacy should sit inside the legal department or in a separate function can use the NASCIO figures as a benchmark, with the caveat that state government resourcing differs from corporate practice.

Finally, the AI link matters. Galluzi tied the new role to agency AI use and data sharing. Vendors selling AI tools or analytics to Nevada agencies may want to be ready for questions on where data goes, how it is classified and who can access it. Reviewing vendor diligence responses and breach notification commitments before the next procurement cycle is a sensible step.