cross-jurisdiction-class

Cross-Jurisdiction Data Classification Harmonisation

Overview

Multinational organisations must classify data under multiple regulatory frameworks simultaneously. GDPR special categories (Art. 9), CCPA sensitive personal information (Cal. Civ. Code §1798.140(ae)), HIPAA protected health information (45 CFR §160.103), and LGPD sensitive personal data (Art. 5-II) each define sensitive data differently with distinct requirements. This skill provides a cross-regulation mapping matrix enabling unified classification that satisfies all applicable jurisdictions, supporting Vanguard Financial Services' operations across the UK/EU, United States, and Brazil.

Jurisdictional Definitions Compared

GDPR Art. 9 — Special Categories (EU/UK)

Processing standard: General prohibition with ten exceptions (Art. 9(2)(a)-(j))

CCPA/CPRA — Sensitive Personal Information (California)

Cal. Civ. Code §1798.140(ae) defines sensitive personal information as:

Consumer right: Right to limit use and disclosure of sensitive PI (§1798.121)

HIPAA — Protected Health Information (United States)

45 CFR §160.103 defines PHI as individually identifiable health information held or transmitted by a covered entity or business associate, in any form, that relates to:

18 HIPAA Identifiers (45 CFR §164.514(b)): Names, geographic data (smaller than state), dates (except year), phone, fax, email, SSN, medical record number, health plan beneficiary number, account number, certificate/licence number, vehicle identifiers, device identifiers, web URLs, IP addresses, biometric identifiers, full-face photographs, any unique identifying number

Standard: Minimum necessary standard; use and disclosure limited to minimum necessary for purpose

LGPD Art. 5-II — Sensitive Personal Data (Brazil)

Processing standard: Consent must be specific and highlighted; other bases available under Art. 11(II)

Cross-Regulation Mapping Matrix

Harmonised Classification Approach

Principle: Apply the Highest Standard

When data falls under multiple jurisdictions, apply the most protective classification:

For each data element:
  1. Classify under GDPR (personal / special category / criminal)
  2. Classify under CCPA (personal information / sensitive PI)
  3. Classify under HIPAA (PHI / non-PHI) — if applicable
  4. Classify under LGPD (personal / sensitive) — if applicable
  5. Assign the unified tier = MAX(all jurisdictional classifications)

Unified Tier Assignment Rules

Implementation for Vanguard Financial Services

Jurisdictional Scope

Cross-Jurisdiction Handling Requirements

For data that falls under multiple jurisdictions:

Regulatory Precedents

• Meta Platforms Ireland (EDPB Binding Decision 01/2023): EUR 1.2 billion fine for EU-US data transfers — underscores the importance of jurisdictional mapping when data crosses borders
• Sephora (CCPA Enforcement, 2022): USD 1.2 million settlement with California AG for failure to honour opt-out of sale of personal information — demonstrated CCPA-specific classification obligations
• ANPD Brazil (2023): First LGPD administrative sanctions for inadequate security measures on sensitive personal data — confirmed LGPD enforcement trajectory

Integration Points

• personal-data-test: GDPR personal data test is the foundation; cross-jurisdiction classification layers additional requirements
• special-category-data: GDPR special categories map to sensitive data across other jurisdictions
• classification-policy: Unified tier from cross-jurisdiction mapping feeds the enterprise classification policy
• data-inventory-mapping: Data inventory must record applicable jurisdictions per data element