2.2.2. Privacy Regulations: GDPR, CCPA, and Global Frameworks
💡 First Principle: Privacy laws exist because individuals have a right to control information about themselves — and organizations that collect personal data become stewards of that right, with legal obligations that cannot be contracted away. The fundamental principle across all modern privacy frameworks is purpose limitation: data collected for one purpose cannot be secretly repurposed.
GDPR (General Data Protection Regulation) — EU regulation effective May 2018. The global standard that has driven privacy law development worldwide.
| GDPR Concept | Definition | Security Implication |
|---|---|---|
| Data Subject | The individual the data is about | Has eight rights (access, erasure, portability, objection, etc.). Erasure must reach every copy, logs and backups included, so it collides with immutable audit trails and backup retention; where a backup cannot be rewritten, the data is put beyond use and suppressed again on any restore |
| Data Controller | Entity that determines why and how data is processed | Primary legal accountability for compliance |
| Data Processor | Entity that processes data on behalf of the controller | Must follow controller's instructions; DPA required |
| Lawful Basis | Legal justification for processing | One of six must apply: consent, contract, legal obligation, vital interests, public task, legitimate interests. Legitimate interests needs a balancing test and fails where the processing is intrusive enough to override the data subject's rights (e.g., continuous location tracking) |
| Data Protection Officer (DPO) | Mandatory for certain controllers/processors | Advises on compliance; cannot be instructed on outcomes |
| Breach Notification | To the supervisory authority within 72 hours of the controller becoming aware of the breach (not of when it began), unless unlikely to result in risk; details may follow in phases | Must have detection and reporting capability; an unfinished investigation does not pause the clock |
| DPIA | Data Protection Impact Assessment | Required for high-risk processing |
| Transborder Transfer | Moving personal data outside EEA | Requires adequacy decision, SCCs, BCRs, or derogation |
Right to erasure is not absolute: Article 17(3) exempts data needed to comply with a legal obligation or to establish, exercise or defend legal claims — a litigation hold overrides an erasure request for its scope and duration, after which erasure applies.
GDPR penalties: Up to €20M or 4% of global annual revenue — whichever is higher. These are not theoretical; Meta (€1.2B), Amazon (€746M), and Google (€150M) have all received significant fines.
CCPA (California Consumer Privacy Act) — California law effective 2020, strengthened by CPRA (2023). Gives California residents rights similar to GDPR: know, delete, opt-out of sale, non-discrimination. Applies to businesses meeting revenue/data thresholds, regardless of location, if they process California residents' data.
HIPAA Breach Notification Rule (US healthcare) — a covered entity must notify affected individuals without unreasonable delay and no later than 60 days after discovery, including breaches by its business associates. Breaches affecting 500 or more individuals are also reported to HHS within 60 days, with prominent media notice when more than 500 residents of one state are affected; smaller breaches go on a log reported to HHS annually. The Privacy Rule also limits PHI use and disclosure to treatment, payment, health care operations and other permitted purposes; a new use, such as combining PHI with an acquirer's financial products, needs the patient's written authorization.
Key distinctions between GDPR and CCPA:
| Dimension | GDPR | CCPA/CPRA |
|---|---|---|
| Scope | All personal data, all sectors | Consumer data, commercial context |
| Opt-in vs. opt-out | Opt-in (consent required for most processing) | Opt-out (must provide right to opt out of sale) |
| Children | 16 (or lower with member state consent) | 16 (opt-in required) |
| Enforcement | National supervisory authorities + individual right of action | CA AG + individual right of action for breaches |
| Data sale | No specific "sale" concept | Explicit right to opt out of sale of personal data |
Transborder data flows — moving personal data from the EU/EEA to countries without adequate protection requires one of:
- Adequacy decision — EC has determined the destination country has equivalent protection (UK, Canada, Japan, others)
- Standard Contractual Clauses (SCCs) — EU-approved contract terms between controller and recipient
- Binding Corporate Rules (BCRs) — For intragroup transfers in multinational companies
- Derogations — Exceptions for consent, contractual necessity, vital interests, etc.
⚠️ Exam Trap: Transferring EU personal data to a US-based cloud provider is NOT automatically compliant just because the provider is a reputable company. The organization must have a lawful transfer mechanism in place (SCCs are the most common). The invalidation of Privacy Shield in 2020 (Schrems II) and its replacement with the EU-US Data Privacy Framework (2023) demonstrates this landscape can change.
Reflection Question: A US company acquires a French startup that processes EU employee data. The US parent company's HR system is in the US. Identify three legal mechanisms the combined company could use to lawfully transfer the French employee data to the US HR system, and the tradeoff of each.
