Fair. I wonder how a combo of CFAA, HIPAA and GDPR could fare here. I couldn't find whether Windows Defender automatically uploads all executables it sees, but apparently[0] non-executables deemed "suspicious" can be uploaded too.
Worth noting Fair Use in Copyright is a USA thing.
In UK there have been some changes to Fair Dealing in the last couple of years that I'm not up to date on, but I don't know of anything that would make this allowed except having an explicit license from the copyright holder.
HIPAA would end up falling on your neck, not theirs. The users of windows are required to turn that setting off if you're in HIPAA land, among probably a hundred other things.
In UK there have been some changes to Fair Dealing in the last couple of years that I'm not up to date on, but I don't know of anything that would make this allowed except having an explicit license from the copyright holder.