GDPR Compliance Skill

Purpose

Ensure CIA platform complies with EU General Data Protection Regulation (GDPR) requirements for processing personal data of politicians and users.

When to Use

✅ Processing personal identifiable information (PII)
✅ Implementing user consent mechanisms
✅ Handling data subject requests
✅ International data transfers
✅ Privacy impact assessments

GDPR Principles

1. Lawfulness, Fairness, and Transparency

@Entity
public class DataProcessingRecord {
    private String purpose; // Why we process data
    private String legalBasis; // GDPR Article 6 basis
    private LocalDateTime consentDate;
    private boolean consentGiven;
    
    public enum LegalBasis {
        CONSENT,              // Article 6(1)(a)
        CONTRACT,             // Article 6(1)(b)
        LEGAL_OBLIGATION,     // Article 6(1)(c)
        VITAL_INTERESTS,      // Article 6(1)(d)
        PUBLIC_TASK,          // Article 6(1)(e) - Applicable for political monitoring
        LEGITIMATE_INTERESTS  // Article 6(1)(f)
    }
}

2. Purpose Limitation

@Service
public class DataProcessingService {
    public void processPersonalData(PersonalData data, String purpose) {
        // Verify purpose matches original consent
        if (!data.getConsentedPurposes().contains(purpose)) {
            throw new GDPRViolationException(
                "Processing not covered by original consent"
            );
        }
        
        // Log processing activity
        auditLogger.logDataProcessing(data, purpose);
        
        // Process data
        performProcessing(data, purpose);
    }
}

3. Data Minimization

@Entity
public class PoliticianPublicProfile {
    // Only collect necessary fields
    private String firstName;
    private String lastName;
    private String party;
    private String district;
    
    // DON'T collect unnecessary data:
    // ❌ private String homeAddress;
    // ❌ private String personalEmail;
    // ❌ private List<String> familyMembers;
}

4. Accuracy

@Service
public class DataAccuracyService {
    @Scheduled(cron = "0 0 0 * * *") // Daily
    public void verifyDataAccuracy() {
        List<Politician> politicians = politicianRepository.findAll();
        
        for (Politician p : politicians) {
            // Sync with authoritative source (Riksdagen)
            PoliticianDTO official = riksdagenClient.getPolitician(p.getId());
            
            if (!p.isAccurate(official)) {
                p.updateFrom(official);
                p.setLastVerified(LocalDateTime.now());
                politicianRepository.save(p);
            }
        }
    }
}

5. Storage Limitation

@Entity
public class UserAccount {
    private LocalDateTime createdAt;
    private LocalDateTime lastLoginAt;
    
    @Column(name = "data_retention_until")
    private LocalDateTime retentionUntil;
    
    public void setRetentionPeriod(int years) {
        this.retentionUntil = LocalDateTime.now().plusYears(years);
    }
}

@Service
public class DataRetentionService {
    @Scheduled(cron = "0 0 3 * * *") // Daily at 3 AM
    public void enforceRetentionPolicies() {
        // Delete data past retention period
        List<UserAccount> expired = userRepository.findByRetentionUntilBefore(LocalDateTime.now());
        
        for (UserAccount user : expired) {
            // Anonymize or delete
            anonymizationService.anonymize(user);
            auditLogger.log("Data deleted per retention policy: " + user.getId());
        }
    }
}

6. Integrity and Confidentiality

@Configuration
public class DataSecurityConfig {
    @Bean
    public BytesEncryptor piiEncryptor() {
        // Encrypt personal data at rest
        String key = System.getenv("PII_ENCRYPTION_KEY");
        String salt = System.getenv("PII_ENCRYPTION_SALT");
        return Encryptors.stronger(key, salt);
    }
}

Data Subject Rights Implementation

Right to Access (Article 15)

@RestController
@RequestMapping("/api/gdpr")
public class GDPRController {
    
    @GetMapping("/data-export")
    @PreAuthorize("isAuthenticated()")
    public ResponseEntity<DataExport> exportUserData(
            @AuthenticationPrincipal UserDetails user) {
        
        // Generate complete data export
        DataExport export = gdprService.generateDataExport(user.getUsername());
        
        // Log access request
        auditLogger.logDataSubjectRequest("ACCESS", user.getUsername());
        
        return ResponseEntity.ok(export);
    }
}

@Service
public class GDPRService {
    public DataExport generateDataExport(String userId) {
        DataExport export = new DataExport();
        
        // Collect all personal data
        export.setPersonalInfo(userRepository.findById(userId));
        export.setActivityLog(activityRepository.findByUserId(userId));
        export.setPreferences(preferencesRepository.findByUserId(userId));
        export.setProcessingRecords(processingRepository.findByUserId(userId));
        
        return export;
    }
}

Right to Erasure (Article 17)

@DeleteMapping("/data")
@PreAuthorize("isAuthenticated()")
public ResponseEntity<Void> deleteUserData(
        @AuthenticationPrincipal UserDetails user,
        @RequestBody DeletionRequest request) {
    
    // Verify deletion is permissible
    if (!gdprService.canDelete(user.getUsername(), request.getReason())) {
        return ResponseEntity.status(HttpStatus.FORBIDDEN).build();
    }
    
    // Perform deletion
    gdprService.eraseUserData(user.getUsername());
    
    // Log deletion
    auditLogger.logDataSubjectRequest("ERASURE", user.getUsername());
    
    return ResponseEntity.noContent().build();
}

Right to Data Portability (Article 20)

@GetMapping("/data-export/json")
public ResponseEntity<byte[]> exportDataPortable(
        @AuthenticationPrincipal UserDetails user) {
    
    // Export in machine-readable format (JSON)
    DataExport export = gdprService.generateDataExport(user.getUsername());
    String json = objectMapper.writeValueAsString(export);
    
    HttpHeaders headers = new HttpHeaders();
    headers.setContentType(MediaType.APPLICATION_JSON);
    headers.setContentDisposition(
        ContentDisposition.attachment()
            .filename("user-data-" + user.getUsername() + ".json")
            .build()
    );
    
    return ResponseEntity.ok()
        .headers(headers)
        .body(json.getBytes(StandardCharsets.UTF_8));
}

Right to Object (Article 21)

@PostMapping("/object-processing")
public ResponseEntity<Void> objectToProcessing(
        @AuthenticationPrincipal UserDetails user,
        @RequestBody ObjectionRequest request) {
    
    // Record objection
    gdprService.recordObjection(user.getUsername(), request.getProcessingType());
    
    // Stop processing if applicable
    if (request.getProcessingType() == ProcessingType.MARKETING) {
        marketingService.unsubscribe(user.getUsername());
    }
    
    return ResponseEntity.accepted().build();
}

Privacy by Design

@Service
public class PrivacyByDesignService {
    
    /**
     * Pseudonymization for analytics
     */
    public String pseudonymize(String userId) {
        return DigestUtils.sha256Hex(userId + SALT);
    }
    
    /**
     * Anonymization for deleted accounts
     */
    public void anonymize(User user) {
        user.setFirstName("DELETED");
        user.setLastName("USER");
        user.setEmail("deleted@" + UUID.randomUUID() + ".invalid");
        user.setPhone(null);
        user.setPersonalId(null);
        user.setAnonymized(true);
        user.setAnonymizedAt(LocalDateTime.now());
    }
}

Consent Management

@Entity
public class ConsentRecord {
    @Id
    private String id;
    
    private String userId;
    
    @Enumerated(EnumType.STRING)
    private ConsentPurpose purpose;
    
    private boolean granted;
    
    private LocalDateTime consentDate;
    
    private LocalDateTime withdrawnDate;
    
    private String consentText; // Exact text shown to user
}

@Service
public class ConsentService {
    public void recordConsent(String userId, ConsentPurpose purpose, boolean granted) {
        ConsentRecord consent = new ConsentRecord();
        consent.setUserId(userId);
        consent.setPurpose(purpose);
        consent.setGranted(granted);
        consent.setConsentDate(LocalDateTime.now());
        consent.setConsentText(getConsentText(purpose));
        
        consentRepository.save(consent);
        
        auditLogger.logConsent(userId, purpose, granted);
    }
    
    public boolean hasConsent(String userId, ConsentPurpose purpose) {
        return consentRepository.findByUserIdAndPurpose(userId, purpose)
            .filter(c -> c.isGranted() && c.getWithdrawnDate() == null)
            .isPresent();
    }
}

Data Protection Impact Assessment (DPIA)

Required when processing involves:

✅ Large-scale systematic monitoring
✅ Sensitive data processing
✅ High risk to rights and freedoms

# DPIA Template for CIA Platform

## Processing Description
- **Purpose**: Political activity monitoring and transparency
- **Data Types**: Names, party affiliation, voting records, financial declarations
- **Data Subjects**: Swedish politicians
- **Legal Basis**: Public task (Article 6(1)(e))

## Risk Assessment
| Risk | Likelihood | Impact | Mitigation |
|------|-----------|--------|------------|
| Data breach | Medium | High | Encryption, access controls |
| Unauthorized access | Medium | High | MFA, audit logging |
| Inaccurate data | Low | Medium | Regular verification |

## Compliance Measures
- ✅ Encryption at rest and in transit
- ✅ Access control and authentication
- ✅ Regular security audits
- ✅ Incident response plan
- ✅ Data retention policies

GDPR Compliance Checklist

✅ Privacy policy published
✅ Cookie consent implemented
✅ Data protection officer appointed
✅ DPIA completed for high-risk processing
✅ Data breach notification procedure
✅ International data transfer safeguards
✅ Regular compliance audits

Hack23 ISMS Policy References

GDPR Compliance Framework:

Privacy Policy - Transparency and lawful processing
Data Classification Policy - Data protection by classification
Information Security Policy - Security of processing (Art. 32)
Access Control Policy - Access to personal data (Art. 32)
Cryptography Policy - Pseudonymization and encryption (Art. 32)
Incident Response Plan - Data breach notification (Art. 33-34)
Backup Recovery Policy - Data availability (Art. 32)
Risk Assessment Methodology - Data protection impact assessment (Art. 35)
Third Party Management - Data processing agreements (Art. 28)
ISMS Transparency Plan - Public accountability

All Hack23 ISMS Policies: https://github.com/Hack23/ISMS-PUBLIC

CIA Platform Architecture References

Security Architecture: CIA SECURITY_ARCHITECTURE.md - GDPR technical measures
Data Model: CIA DATA_MODEL.md - Personal data processing

References

GDPR Full Text: https://gdpr-info.eu/
ICO GDPR Guidance: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/
EDPB Guidelines: https://edpb.europa.eu/our-work-tools/general-guidance_en
ISO 27001:2022: https://www.iso.org/standard/27001
ISO 27701:2019: https://www.iso.org/standard/71670.html (Privacy Information Management)

gdpr-compliance