gdpr-compliance

# GDPR Compliance Skill ## Purpose Ensure CIA platform complies with EU General Data Protection Regulation (GDPR) requirements for processing personal data of politicians and users. ## When to Use - ✅ Processing personal identifiable information (PII) - ✅ Implementing user consent mechanisms - ✅ Handling data subject requests - ✅ International data transfers - ✅ Privacy impact assessments ## GDPR Principles ### 1. Lawfulness, Fairness, and Transparency ```java @Entity public class DataProcessingRecord { private String purpose; // Why we process data private String legalBasis; // GDPR Article 6 basis private LocalDateTime consentDate; private boolean consentGiven; public enum LegalBasis { CONSENT, // Article 6(1)(a) CONTRACT, // Article 6(1)(b) LEGAL_OBLIGATION, // Article 6(1)(c) VITAL_INTERESTS, // Article 6(1)(d) PUBLIC_TASK, // Article 6(1)(e) - Applicable for political monitoring LEGITIMATE_INTERESTS // Article 6(1)(f) } } ``` ### 2. Purpose Limitation ```java @Service public class DataProcessingService { public void processPersonalData(PersonalData data, String purpose) { // Verify purpose matches original consent if (!data.getConsentedPurposes().contains(purpose)) { throw new GDPRViolationException( "Processing not covered by original consent" ); } // Log processing activity auditLogger.logDataProcessing(data, purpose); // Process data performProcessing(data, purpose); } } ``` ### 3. Data Minimization ```java @Entity public class PoliticianPublicProfile { // Only collect necessary fields private String firstName; private String lastName; private String party; private String district; // DON'T collect unnecessary data: // ❌ private String homeAddress; // ❌ private String personalEmail; // ❌ private List<String> familyMembers; } ``` ### 4. Accuracy ```java @Service public class DataAccuracyService { @Scheduled(cron = "0 0 0 * * *") // Daily public void verifyDataAccuracy() { List<Politician> politicians = politicianRepository.findAll(); for (Politician p : politicians) { // Sync with authoritative source (Riksdagen) PoliticianDTO official = riksdagenClient.getPolitician(p.getId()); if (!p.isAccurate(official)) { p.updateFrom(official); p.setLastVerified(LocalDateTime.now()); politicianRepository.save(p); } } } } ``` ### 5. Storage Limitation ```java @Entity public class UserAccount { private LocalDateTime createdAt; private LocalDateTime lastLoginAt; @Column(name = "data_retention_until") private LocalDateTime retentionUntil; public void setRetentionPeriod(int years) { this.retentionUntil = LocalDateTime.now().plusYears(years); } } @Service public class DataRetentionService { @Scheduled(cron = "0 0 3 * * *") // Daily at 3 AM public void enforceRetentionPolicies() { // Delete data past retention period List<UserAccount> expired = userRepository.findByRetentionUntilBefore(LocalDateTime.now()); for (UserAccount user : expired) { // Anonymize or delete anonymizationService.anonymize(user); auditLogger.log("Data deleted per retention policy: " + user.getId()); } } } ``` ### 6. Integrity and Confidentiality ```java @Configuration public class DataSecurityConfig { @Bean public BytesEncryptor piiEncryptor() { // Encrypt personal data at rest String key = System.getenv("PII_ENCRYPTION_KEY"); String salt = System.getenv("PII_ENCRYPTION_SALT"); return Encryptors.stronger(key, salt); } } ``` ## Data Subject Rights Implementation ### Right to Access (Article 15) ```java @RestController @RequestMapping("/api/gdpr") public class GDPRController { @GetMapping("/data-export") @PreAuthorize("isAuthenticated()") public ResponseEntity<DataExport> exportUserData( @AuthenticationPrincipal UserDetails user) { // Generate complete data export DataExport export = gdprService.generateDataExport(user.getUsername()); // Log access request auditLogger.logDataSubjectRequest("ACCESS", user.getUsername()); return ResponseEntity.ok(export); } } @Service public class GDPRService { public DataExport generateDataExport(String userId) { DataExport export = new DataExport(); // Collect all personal data export.setPersonalInfo(userRepository.findById(userId)); export.setActivityLog(activityRepository.findByUserId(userId)); export.setPreferences(preferencesRepository.findByUserId(userId)); export.setProcessingRecords(processingRepository.findByUserId(userId)); return export; } } ``` ### Right to Erasure (Article 17) ```java @DeleteMapping("/data") @PreAuthorize("isAuthenticated()") public ResponseEntity<Void> deleteUserData( @AuthenticationPrincipal UserDetails user, @RequestBody DeletionRequest request) { // Verify deletion is permissible if (!gdprService.canDelete(user.getUsername(), request.getReason())) { return ResponseEntity.status(HttpStatus.FORBIDDEN).build(); } // Perform deletion gdprService.eraseUserData(user.getUsername()); // Log deletion auditLogger.logDataSubjectRequest("ERASURE", user.getUsername()); return ResponseEntity.noContent().build(); } ``` ### Right to Data Portability (Article 20) ```java @GetMapping("/data-export/json") public ResponseEntity<byte[]> exportDataPortable( @AuthenticationPrincipal UserDetails user) { // Export in machine-readable format (JSON) DataExport export = gdprService.generateDataExport(user.getUsername()); String json = objectMapper.writeValueAsString(export); HttpHeaders headers = new HttpHeaders(); headers.setContentType(MediaType.APPLICATION_JSON); headers.setContentDisposition( ContentDisposition.attachment() .filename("user-data-" + user.getUsername() + ".json") .build() ); return ResponseEntity.ok() .headers(headers) .body(json.getBytes(StandardCharsets.UTF_8)); } ``` ### Right to Object (Article 21) ```java @PostMapping("/object-processing") public ResponseEntity<Void> objectToProcessing( @AuthenticationPrincipal UserDetails user, @RequestBody ObjectionRequest request) { // Record objection gdprService.recordObjection(user.getUsername(), request.getProcessingType()); // Stop processing if applicable if (request.getProcessingType() == ProcessingType.MARKETING) { marketingService.unsubscribe(user.getUsername()); } return ResponseEntity.accepted().build(); } ``` ## Privacy by Design ```java @Service public class PrivacyByDesignService { /** * Pseudonymization for analytics */ public String pseudonymize(String userId) { return DigestUtils.sha256Hex(userId + SALT); } /** * Anonymization for deleted accounts */ public void anonymize(User user) { user.setFirstName("DELETED"); user.setLastName("USER"); user.setEmail("deleted@" + UUID.randomUUID() + ".invalid"); user.setPhone(null); user.setPersonalId(null); user.setAnonymized(true); user.setAnonymizedAt(LocalDateTime.now()); } } ``` ## Consent Management ```java @Entity public class ConsentRecord { @Id private String id; private String userId; @Enumerated(EnumType.STRING) private ConsentPurpose purpose; private boolean granted; private LocalDateTime consentDate; private LocalDateTime withdrawnDate; private String consentText; // Exact text shown to user } @Service public class ConsentService { public void recordConsent(String userId, ConsentPurpose purpose, boolean granted) { ConsentRecord consent = new ConsentRecord(); consent.setUserId(userId); consent.setPurpose(purpose); consent.setGranted(granted); consent.setConsentDate(LocalDateTime.now()); consent.setConsentText(getConsentText(purpose)); consentRepository.save(consent); auditLogger.logConsent(userId, purpose, granted); } public boolean hasConsent(String userId, ConsentPurpose purpose) { return consentRepository.findByUserIdAndPurpose(userId, purpose) .filter(c -> c.isGranted() && c.getWithdrawnDate() == null) .isPresent(); } } ``` ## Data Protection Impact Assessment (DPIA) Required when processing involves: - ✅ Large-scale systematic monitoring - ✅ Sensitive data processing - ✅ High risk to rights and freedoms ```markdown # DPIA Template for CIA Platform ## Processing Description - **Purpose**: Political activity monitoring and transparency - **Data Types**: Names, party affiliation, voting records, financial declarations - **Data Subjects**: Swedish politicians - **Legal Basis**: Public task (Article 6(1)(e)) ## Risk Assessment | Risk | Likelihood | Impact | Mitigation | |------|-----------|--------|------------| | Data breach | Medium | High | Encryption, access controls | | Unauthorized access | Medium | High | MFA, audit logging | | Inaccurate data | Low | Medium | Regular verification | ## Compliance Measures - ✅ Encryption at rest and in transit - ✅ Access control and authentication - ✅ Regular security audits - ✅ Incident response plan - ✅ Data retention policies ``` ## GDPR Compliance Checklist - ✅ Privacy policy published - ✅ Cookie consent implemented - ✅ Data protection officer appointed - ✅ DPIA completed for high-risk processing - ✅ Data breach notification procedure - ✅ International data transfer safeguards - ✅ Regular compliance audits ## Hack23 ISMS Policy References **GDPR Compliance Framework:** - [Privacy Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Privacy_Policy.md) - Transparency and lawful processing - [Data Classification Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Data_Classification_Policy.md) - Data protection by classification - [Information Security Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Information_Security_Policy.md) - Security of processing (Art. 32) - [Access Control Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Access_Control_Policy.md) - Access to personal data (Art. 32) - [Cryptography Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Cryptography_Policy.md) - Pseudonymization and encryption (Art. 32) - [Incident Response Plan](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Incident_Response_Plan.md) - Data breach notification (Art. 33-34) - [Backup Recovery Policy](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Backup_Recovery_Policy.md) - Data availability (Art. 32) - [Risk Assessment Methodology](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Risk_Assessment_Methodology.md) - Data protection impact assessment (Art. 35) - [Third Party Management](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Third_Party_Management.md) - Data processing agreements (Art. 28) - [ISMS Transparency Plan](https://github.com/Hack23/ISMS-PUBLIC/blob/main/ISMS_Transparency_Plan.md) - Public accountability **All Hack23 ISMS Policies**: https://github.com/Hack23/ISMS-PUBLIC ## CIA Platform Architecture References - **Security Architecture**: [CIA SECURITY_ARCHITECTURE.md](https://github.com/Hack23/cia/blob/master/SECURITY_ARCHITECTURE.md) - GDPR technical measures - **Data Model**: [CIA DATA_MODEL.md](https://github.com/Hack23/cia/blob/master/DATA_MODEL.md) - Personal data processing ## References - **GDPR Full Text**: https://gdpr-info.eu/ - **ICO GDPR Guidance**: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/ - **EDPB Guidelines**: https://edpb.europa.eu/our-work-tools/general-guidance_en - **ISO 27001:2022**: https://www.iso.org/standard/27001 - **ISO 27701:2019**: https://www.iso.org/standard/71670.html (Privacy Information Management)