GDPR, HIPAA, and Global Privacy Laws

Privacy laws regulate how organizations collect, store, process, and transfer personal data. The SC-900 exam expects you to understand the *purpose* and *key provisions* of three major frameworks: GDPR (General Data Protection Regulation), HIPAA (Health Insurance Portability and Accountability Act), and other notable laws like CCPA (California Consumer Privacy Act) and LGPD (Lei Geral de Proteção de Dados). The exam does not test deep legal knowledge but rather the compliance landscape that Microsoft tools address.

What it is: The GDPR is a comprehensive data protection law enacted by the European Union, effective May 25, 2018. It applies to any organization that processes personal data of EU residents, regardless of where the organization is located. Its primary goal is to give individuals control over their personal data and harmonize data protection laws across EU member states.

Key Principles (Article 5): - Lawfulness, fairness, and transparency - Purpose limitation (data collected for specified, explicit, legitimate purposes) - Data minimization (adequate, relevant, and limited to what is necessary) - Accuracy (data must be accurate and kept up to date) - Storage limitation (kept no longer than necessary) - Integrity and confidentiality (security appropriate to the risk) - Accountability (controller must demonstrate compliance)

Rights of Data Subjects: - Right to be informed (privacy notices) - Right of access (subject access request, SAR) - Right to rectification - Right to erasure (right to be forgotten) - Right to restrict processing - Right to data portability - Right to object - Rights related to automated decision-making and profiling

Key Roles: - Data Controller: Entity that determines the purposes and means of processing personal data. - Data Processor: Entity that processes data on behalf of the controller. - Data Protection Officer (DPO): Required for public authorities or organizations that process large-scale sensitive data. The DPO must be independent and report to the highest management level.

Penalties: Up to €20 million or 4% of global annual turnover, whichever is higher. Fines are tiered: lower tier (up to €10M or 2% of turnover) for violations like not having a DPO or not conducting a DPIA; upper tier for violations of data subject rights or cross-border transfers.

Cross-border Data Transfers: Personal data can only be transferred to countries that the European Commission has deemed to have adequate data protection (adequacy decisions). For other countries, appropriate safeguards must be in place, such as Standard Contractual Clauses (SCCs) or Binding Corporate Rules (BCRs). The EU-US Data Privacy Framework (DPF) replaced the invalidated Privacy Shield.

Data Breach Notification: Controllers must notify the supervisory authority within 72 hours of becoming aware of a breach, unless the breach is unlikely to result in a risk to rights and freedoms. Data subjects must be notified if the breach poses a high risk.

What it is: The Health Insurance Portability and Accountability Act of 1996 is a US federal law that sets national standards for protecting sensitive patient health information (PHI). The SC-900 exam focuses on the Privacy Rule, Security Rule, and Breach Notification Rule.

Protected Health Information (PHI): Any individually identifiable health information held or transmitted by a covered entity or business associate, in any form (electronic, paper, oral). De-identified health information (removing 18 specific identifiers) is not PHI.

Covered Entities: Health plans, healthcare clearinghouses, and healthcare providers who transmit health information electronically.

Business Associates: Persons or entities that perform functions on behalf of a covered entity involving PHI (e.g., billing companies, cloud storage providers). Business associates must have a written contract (Business Associate Agreement, BAA) with the covered entity.

Privacy Rule: Governs use and disclosure of PHI. Generally, covered entities can use or disclose PHI for treatment, payment, or healthcare operations without authorization. Other uses require written authorization from the individual. Patients have rights to access, amend, and request an accounting of disclosures.

Security Rule: Requires administrative, physical, and technical safeguards to ensure the confidentiality, integrity, and availability of electronic PHI (ePHI). Key standards include:

Breach Notification Rule: Requires covered entities to notify affected individuals, the Secretary of HHS, and in some cases, the media following a breach of unsecured PHI. Notification must occur without unreasonable delay and no later than 60 days after discovery. Business associates must notify covered entities.

Penalties: Civil monetary penalties range from $100 to $50,000 per violation, up to $1.5 million per calendar year for identical violations. There are four tiers based on culpability: did not know, reasonable cause, willful neglect (corrected), willful neglect (not corrected). Criminal penalties can apply for knowingly obtaining or disclosing PHI.

CCPA (California Consumer Privacy Act): Effective January 1, 2020, it gives California residents rights to know what personal information is collected, to delete it, to opt out of its sale, and to non-discrimination for exercising rights. Applies to for-profit entities that collect personal information of California residents and meet thresholds (e.g., annual gross revenue >$25 million, or buys/sells personal info of 50,000+ consumers). Enforcement by California Privacy Protection Agency (CPPA).

LGPD (Brazil's Lei Geral de Proteção de Dados): Modeled after GDPR, effective August 2020. Applies to any organization processing personal data of individuals in Brazil, regardless of location. Creates the National Data Protection Authority (ANPD). Penalties up to 2% of revenue in Brazil, capped at R$50 million per violation.

PIPEDA (Canada's Personal Information Protection and Electronic Documents Act): Applies to private-sector organizations collecting personal information in the course of commercial activities. Based on 10 fair information principles (e.g., accountability, consent, limiting collection).

Microsoft 365 provides several tools to help organizations meet privacy law requirements: - Compliance Manager: Pre-built assessments for GDPR, HIPAA, CCPA, etc. It maps controls to specific regulatory requirements and provides implementation guidance. - Information Protection: Sensitivity labels, data classification, and encryption to protect data at rest and in transit. - Data Lifecycle Management: Retention policies and labels to meet storage limitation requirements (GDPR) and record retention (HIPAA). - Audit (Premium): Logging and monitoring for access to personal data, supporting accountability. - Subject Rights Requests: Built-in workflows for managing SARs under GDPR and CCPA. - Data Loss Prevention (DLP): Policies to detect and prevent unauthorized sharing of PHI or personal data.

The SC-900 exam does not ask you to recite legal statutes. Instead, it tests:

Common exam traps: - Confusing GDPR's 72-hour breach notification with HIPAA's 60-day notification. - Thinking HIPAA applies to all health data (it only applies to covered entities and business associates; an app developer not a business associate is not covered). - Assuming CCPA is a federal law (it's California state law). - Believing that GDPR requires consent for all processing (it also allows legitimate interest, contract necessity, etc.).

A US-based hospital network (covered entity under HIPAA) begins offering telemedicine services to EU citizens. This triggers GDPR compliance because the hospital processes personal data (including health data, a special category) of EU residents. The hospital must now comply with both HIPAA and GDPR simultaneously. In production, the compliance team uses Compliance Manager to run a GDPR assessment that overlaps with HIPAA controls. They discover that HIPAA's breach notification timeline (60 days) conflicts with GDPR's 72-hour requirement; they adopt the stricter GDPR timeline globally. They implement Microsoft Purview Data Lifecycle Management to enforce retention limits: health records kept for 6 years (HIPAA requirement) but patient consent records kept only as long as necessary (GDPR storage limitation). The hospital also signs Standard Contractual Clauses with their cloud provider (Azure) to legitimize cross-border data transfers. A common misconfiguration: the hospital initially applied the same access controls to all patient data, but GDPR requires that EU patients have the right to restrict processing—so they had to create a separate process to flag and restrict certain records. Performance-wise, compliance scanning can increase latency on data access, but using Azure Policy and sensitivity labels minimizes overhead.

A marketing analytics company based in Texas collects personal information from California residents for targeted advertising. They meet CCPA's threshold (buying/selling data of 50,000+ consumers). They deploy Microsoft 365 Compliance Manager to assess CCPA readiness. The main challenge is the 'right to opt out of sale of personal information'—the company must provide a clear 'Do Not Sell My Personal Information' link on their website and honor opt-outs within 15 business days. They use Microsoft Purview Data Loss Prevention (DLP) to detect when personal data is shared with third-party ad networks and block it for opted-out consumers. A common mistake: the company initially thought CCPA only applied if they had over $25 million revenue, but they actually triggered it via the 50,000 consumer threshold. They also learned that 'sale' includes sharing data for monetary or other valuable consideration—even if no money changes hands. Their DLP policies had to be tuned to catch data shared via APIs, not just email.

A fintech startup in London processes data of both EU and Brazilian customers. They must comply with both GDPR and LGPD. While both laws are similar, LGPD has its own nuances: the data subject can request review of automated decisions, and the penalty is up to 2% of revenue in Brazil. The firm uses Azure Policy to enforce data residency: EU data stays in West Europe, Brazilian data stays in Brazil South. They configure Compliance Manager with both GDPR and LGPD assessments. The biggest operational issue is managing consent withdrawal: under both laws, withdrawing consent does not affect prior lawful processing, but the firm must stop further processing. They created a custom Power Automate flow to sync consent status across systems. They also discovered that LGPD requires a DPO for large-scale processing, which they already had for GDPR. A common pitfall: they initially used the same data retention schedule for all customers, but LGPD requires data to be deleted after the purpose ends, so they had to implement a purge workflow for Brazilian customers after account closure.