Overview
Multinational organisations must classify data under multiple regulatory frameworks simultaneously. GDPR special categories (Art. 9), CCPA sensitive personal information (Cal. Civ. Code §1798.140(ae)), HIPAA protected health information (45 CFR §160.103), and LGPD sensitive personal data (Art. 5-II) each define sensitive data differently with distinct requirements. This skill provides a cross-regulation mapping matrix enabling unified classification that satisfies all applicable jurisdictions, supporting Vanguard Financial Services' operations across the UK/EU, United States, and Brazil.
Jurisdictional Definitions Compared
GDPR Art. 9 — Special Categories (EU/UK)
| Category | Definition Summary |
|---|---|
| Racial or ethnic origin | Data revealing racial or ethnic background |
| Political opinions | Political views, party membership, voting |
| Religious or philosophical beliefs | Faith, atheism, philosophical convictions |
| Trade union membership | Union membership status or activities |
| Genetic data | Inherited/acquired genetic characteristics (Art. 4(13)) |
| Biometric data | Physical/behavioural characteristics for unique identification (Art. 4(14)) |
| Health data | Physical/mental health, healthcare provision (Recital 35) |
| Sex life or sexual orientation | Sexual behaviour, preferences, orientation |
Processing standard: General prohibition with ten exceptions (Art. 9(2)(a)-(j))
CCPA/CPRA — Sensitive Personal Information (California)
Cal. Civ. Code §1798.140(ae) defines sensitive personal information as:
| Category | Definition Summary |
|---|---|
| Social Security, driver's licence, state ID, passport | Government-issued identifiers |
| Account log-in with password/security credentials | Financial account access data |
| Debit/credit card combined with security code | Payment card data with authentication |
| Precise geolocation | Location within 1,850 feet (GPS-level) |
| Racial or ethnic origin | Same scope as GDPR |
| Religious or philosophical beliefs | Same scope as GDPR |
| Union membership | Same scope as GDPR |
| Personal communications (mail, email, text) | Content of non-public communications |
| Genetic data | DNA, genetic test results |
| Biometric data | Physiological, biological, behavioural characteristics for identification |
| Health information | Physical/mental health condition, diagnosis, treatment |
| Sex life or sexual orientation | Sexual activity, preferences |
Consumer right: Right to limit use and disclosure of sensitive PI (§1798.121)
HIPAA — Protected Health Information (United States)
45 CFR §160.103 defines PHI as individually identifiable health information held or transmitted by a covered entity or business associate, in any form, that relates to:
| Element | Description |
|---|---|
| Physical or mental health condition | Past, present, or future |
| Provision of health care | Treatment, services, payments |
| Payment for health care | Claims, billing, insurance |
| Identifiability | Information that identifies or could identify the individual |
18 HIPAA Identifiers (45 CFR §164.514(b)): Names, geographic data (smaller than state), dates (except year), phone, fax, email, SSN, medical record number, health plan beneficiary number, account number, certificate/licence number, vehicle identifiers, device identifiers, web URLs, IP addresses, biometric identifiers, full-face photographs, any unique identifying number
Standard: Minimum necessary standard; use and disclosure limited to minimum necessary for purpose
LGPD Art. 5-II — Sensitive Personal Data (Brazil)
| Category | Definition Summary |
|---|---|
| Racial or ethnic origin | Same scope as GDPR |
| Religious belief | Religious conviction or practice |
| Political opinion | Political views or affiliations |
| Trade union membership | Union affiliation |
| Religious, philosophical, or political organisation | Broader than GDPR — includes organisational membership |
| Health data | Physical/mental health |
| Sex life | Sexual activity |
| Genetic data | Genetic information |
| Biometric data | Biometric characteristics for identification |
Processing standard: Consent must be specific and highlighted; other bases available under Art. 11(II)
Cross-Regulation Mapping Matrix
| Data Category | GDPR Art. 9 | CCPA §1798.140(ae) | HIPAA PHI | LGPD Art. 5-II | Unified Tier |
|---|---|---|---|---|---|
| Racial/ethnic origin | Special category | Sensitive PI | N/A (unless health-related) | Sensitive | RESTRICTED |
| Political opinions | Special category | N/A | N/A | Sensitive | RESTRICTED |
| Religious beliefs | Special category | Sensitive PI | N/A | Sensitive | RESTRICTED |
| Trade union membership | Special category | Sensitive PI | N/A | Sensitive | RESTRICTED |
| Genetic data | Special category | Sensitive PI | PHI (if health-related) | Sensitive | RESTRICTED |
| Biometric data (for identification) | Special category | Sensitive PI | PHI (identifier) | Sensitive | RESTRICTED |
| Health data | Special category | Sensitive PI | PHI | Sensitive | RESTRICTED |
| Sex life/orientation | Special category | Sensitive PI | N/A (unless health-related) | Sensitive | RESTRICTED |
| Social Security Number | Personal (direct identifier) | Sensitive PI | PHI (identifier) | Personal (direct) | RESTRICTED |
| Precise geolocation | Personal (may be special if reveals religion/health) | Sensitive PI | PHI (if health-related) | Personal | CONFIDENTIAL+ |
| Financial account with credentials | Personal (financial) | Sensitive PI | N/A | Personal | RESTRICTED |
| Personal communications content | Personal | Sensitive PI | N/A | Personal | CONFIDENTIAL |
| Medical record number | Personal (indirect) | N/A (separate HIPAA regime) | PHI (identifier) | Personal | RESTRICTED (in healthcare context) |
| Health insurance ID | Personal (indirect) | N/A | PHI (identifier) | Personal | RESTRICTED (in healthcare context) |
Harmonised Classification Approach
Principle: Apply the Highest Standard
When data falls under multiple jurisdictions, apply the most protective classification:
For each data element:
1. Classify under GDPR (personal / special category / criminal)
2. Classify under CCPA (personal information / sensitive PI)
3. Classify under HIPAA (PHI / non-PHI) — if applicable
4. Classify under LGPD (personal / sensitive) — if applicable
5. Assign the unified tier = MAX(all jurisdictional classifications)
Unified Tier Assignment Rules
| Jurisdictional Classification | Unified Tier |
|---|---|
| Any regulation classifies as most-sensitive | RESTRICTED |
| GDPR special category OR CCPA sensitive PI OR LGPD sensitive | RESTRICTED |
| HIPAA PHI (any) | RESTRICTED |
| GDPR personal data AND CCPA personal information (not sensitive) | CONFIDENTIAL |
| Non-personal under all applicable regulations | PUBLIC or INTERNAL |
Implementation for Vanguard Financial Services
Jurisdictional Scope
| Jurisdiction | Applicable Law | Vanguard Operations |
|---|---|---|
| EU/EEA | GDPR | EU customer base, Frankfurt data centre |
| United Kingdom | UK GDPR + DPA 2018 | London headquarters, UK customer base |
| California, USA | CCPA/CPRA | US operations, California residents' data |
| Other US States | Various (VCDPA, CPA, CTDPA, etc.) | US operations |
| Brazil | LGPD | Brazilian customer base |
Cross-Jurisdiction Handling Requirements
For data that falls under multiple jurisdictions:
| Scenario | Jurisdictions | Handling |
|---|---|---|
| UK customer health data | UK GDPR + potentially HIPAA if shared with US health insurer | RESTRICTED; Art. 9(2) condition + HIPAA BAA if shared with US covered entity |
| California employee biometric data (fingerprint) | CCPA + Illinois BIPA + GDPR (if EU data subject) | RESTRICTED; CCPA consent + BIPA written consent + GDPR Art. 9(2)(a) |
| Brazilian customer financial data | LGPD + GDPR (if transferred from EU) | CONFIDENTIAL; LGPD lawful basis + GDPR Chapter V transfer safeguards |
| Cross-border employee HR data | UK GDPR + CCPA + LGPD | CONFIDENTIAL (RESTRICTED if contains health/diversity data); satisfy all three frameworks simultaneously |
Regulatory Precedents
- Meta Platforms Ireland (EDPB Binding Decision 01/2023): EUR 1.2 billion fine for EU-US data transfers — underscores the importance of jurisdictional mapping when data crosses borders
- Sephora (CCPA Enforcement, 2022): USD 1.2 million settlement with California AG for failure to honour opt-out of sale of personal information — demonstrated CCPA-specific classification obligations
- ANPD Brazil (2023): First LGPD administrative sanctions for inadequate security measures on sensitive personal data — confirmed LGPD enforcement trajectory
Integration Points
- personal-data-test: GDPR personal data test is the foundation; cross-jurisdiction classification layers additional requirements
- special-category-data: GDPR special categories map to sensitive data across other jurisdictions
- classification-policy: Unified tier from cross-jurisdiction mapping feeds the enterprise classification policy
- data-inventory-mapping: Data inventory must record applicable jurisdictions per data element