Gdpr Privacy

Gdpr Privacy

Identity

Reference System Usage

You must ground your responses in the provided reference files, treating them as the source of truth for this domain:

• For Creation: Always consult `references/patterns.md`. This file dictates how things should be built. Ignore generic approaches if a specific pattern exists here.
• For Diagnosis: Always consult `references/sharp_edges.md`. This file lists the critical failures and "why" they happen. Use it to explain risks to the user.
• For Review: Always consult `references/validations.md`. This contains the strict rules and constraints. Use it to validate user inputs objectively.

Note: If a user's request conflicts with the guidance in these files, politely correct them using the information provided in the references.

GDPR Privacy Compliance

Patterns

Golden Rules

---

Rule

Lawful basis first

Reason

No processing without legal justification

---

Rule

Purpose limitation

Reason

Only use data for stated purposes

---

Rule

Data minimization

Reason

Collect only what's necessary

---

Rule

Privacy by design

Reason

Build compliance into systems

---

Rule

Document everything

Reason

Accountability requires records

Legal Bases

Consent

Requirements

• Freely given
• Specific
• Informed
• Unambiguous
• Easy to withdraw

Use When

No other basis applies, user has genuine choice

Contract

Requirements

• Processing necessary for contract
• Data subject is party to contract

Use When

Fulfilling contractual obligations

Legal Obligation

Requirements

• Required by EU or member state law
• Document the legal requirement

Use When

Tax records, employment law, AML

Vital Interests

Requirements

• Life or death situation
• No other basis available

Use When

Medical emergencies only

Public Task

Requirements

• Official authority or public interest
• Basis in law

Use When

Government functions

Legitimate Interests

Requirements

• Conduct LIA (Legitimate Interests Assessment)
• Balance against data subject rights
• Document the assessment

Use When

Business need, fraud prevention, security

Data Subject Rights

Access

Timeline

1 month

Response

Provide copy of data being processed

Rectification

Timeline

1 month

Response

Correct inaccurate data

Erasure

Timeline

1 month

Exceptions

• Legal obligation
• Public interest
• Legal claims

Portability

Timeline

1 month

Format

Machine-readable (JSON, CSV)

Objection

Timeline

Immediately stop processing

Exceptions

Compelling legitimate grounds

Restriction

Timeline

1 month

Effect

Store but don't process

Breach Response

Timeline

Detection

Immediately log and assess

Authority Notification

72 hours if risk to rights

Data Subject Notification

Without undue delay if high risk

Assessment Criteria

• Type of data affected
• Number of individuals
• Severity of consequences
• Likelihood of harm

Anti-Patterns

---

Pattern

Consent for everything

Problem

Often not freely given

Solution

Use appropriate legal basis

---

Pattern

Dark patterns for consent

Problem

Not freely given

Solution

Equal prominence for accept/reject

---

Pattern

Bundled consent

Problem

Not specific

Solution

Granular consent options

---

Pattern

Pre-ticked boxes

Problem

Not unambiguous

Solution

Require affirmative action

---

Pattern

Ignoring DSR deadlines

Problem

Regulatory violation

Solution

Automated tracking and alerts

---

Pattern

No data retention policy

Problem

Storage limitation violation

Solution

Define and enforce retention periods

Gdpr Privacy - Sharp Edges

Consent Not Freely Given

Id

consent-not-freely-given

Severity

critical

Summary

Consent is invalid if there's a power imbalance or no real choice

Symptoms

• Employee consent for employment data
• Service denied without consent
• No alternative to consenting

Why

GDPR requires consent to be freely given. If data subjects have no genuine choice or face negative consequences for refusing, consent is invalid. This is especially problematic in employment contexts where employees can't refuse employer requests.

Gotcha

"By accepting this job offer, you consent to processing of your health data for wellness program participation."

Employees can't freely refuse! Use different legal basis.

Solution

1. Use appropriate legal basis instead:

• Employment context: Contract or legal obligation
• Marketing: Legitimate interests with opt-out
• Essential processing: Contract performance

2. If consent is required:

• Ensure genuine choice exists
• No penalty for refusing
• Easy to withdraw

Missed 72-Hour Breach Notification

Id

missed-72-hour-breach

Severity

critical

Summary

Failure to notify supervisory authority within 72 hours

Symptoms

• Breach detected but not logged
• No clear breach assessment process
• Waiting for 'full investigation'

Why

GDPR requires notification to supervisory authority within 72 hours of becoming aware of a breach that poses risk to individuals. Waiting for complete investigation is not an excuse. Notification can be provided in phases.

Gotcha

Security team: "We detected unauthorized access 3 days ago but wanted to complete the forensic investigation before reporting."

Already past the 72-hour deadline!

Solution

1. Immediate breach logging:

• Timestamp of detection
• Initial assessment

2. 72-hour decision framework:

• Risk assessment within 24 hours
• Notification decision within 48 hours
• Submit notification or document why not required

3. Phased notification: "We are aware of a breach affecting approximately X users. Investigation ongoing. Updates to follow."

Inadequate or Missing DPIA

Id

inadequate-dpia

Severity

high

Summary

High-risk processing without proper Data Protection Impact Assessment

Symptoms

• New technology processing personal data
• Large-scale processing of sensitive data
• Systematic monitoring of public areas
• No DPIA documentation

Why

GDPR Article 35 requires DPIA before high-risk processing. Without it, you can't demonstrate compliance and may miss significant privacy risks. The EDPB has defined 9 criteria - meeting 2 or more triggers DPIA requirement.

Gotcha

"We're launching an AI-powered facial recognition for store security. It's just to prevent theft, so no DPIA needed."

Large-scale biometric monitoring = mandatory DPIA!

Solution

DPIA required when 2+ criteria met: 1. Evaluation/scoring 2. Automated decision-making with legal effects 3. Systematic monitoring 4. Sensitive data or vulnerable subjects 5. Large scale processing 6. Matching/combining datasets 7. Innovative technology 8. Preventing data subjects from exercising rights 9. Data transfers outside EU

Conduct DPIA before processing begins.

Invalid International Data Transfer

Id

international-transfer-invalid

Severity

high

Summary

Transferring data outside EU without valid mechanism

Symptoms

• Using US cloud providers
• Offshore development team access
• No SCCs or adequacy decision

Why

Post-Schrems II, transfers to countries without adequacy decisions require Standard Contractual Clauses plus supplementary measures. Simply using SCCs may not be enough if destination country law undermines protections.

Gotcha

"We use AWS US-East for storage but we signed their DPA, so we're compliant."

SCCs alone may not be sufficient. Need Transfer Impact Assessment.

Solution

1. Transfer Impact Assessment (TIA):

• Assess destination country law
• Document surveillance risks
• Identify supplementary measures

2. Supplementary measures:

• End-to-end encryption (customer-held keys)
• Pseudonymization before transfer
• Contractual commitments not to comply with access requests

3. Consider EU-based alternatives when possible

Gdpr Privacy - Validations

Hardcoded Consent Value

Id

hardcoded-consent

Severity

error

Type

regex

Pattern

• consent\s[:=]\strue
• hasConsent\s=\strue
• gdprConsent.*true

Message

Consent appears hardcoded. Must be explicit user action.

Fix Action

Implement proper consent collection with user action

Applies To

• */.js
• */.ts

Missing Consent Timestamp

Id

no-consent-timestamp

Severity

warning

Type

regex

Pattern

• consent(?!.timestamp|.date|.time|.when)

Message

Consent storage may lack timestamp for audit trail.

Fix Action

Record when consent was given with ISO timestamp

Applies To

• */.js
• */.ts

Pre-ticked Consent Checkbox

Id

preticked-checkbox

Severity

error

Type

regex

Pattern

• checked\s[:=]\strue.*consent
• defaultChecked.*consent
• consent.checked.default

Message

Pre-ticked consent boxes are invalid under GDPR.

Fix Action

Remove default checked state from consent checkboxes

Applies To

• */.jsx
• */.tsx
• */.html

No Consent Withdrawal Mechanism

Id

missing-withdrawal-mechanism

Severity

warning

Type

regex

Pattern

• setConsent.true(?!.withdraw|.revoke|.remove)

Message

Consent collection without corresponding withdrawal mechanism.

Fix Action

Implement equally easy consent withdrawal

Applies To

• */.js
• */.ts

Personal Data in Logs

Id

personal-data-logging

Severity

error

Type

regex

Pattern

• console\.log.*email
• logger.*personalData
• log.*\b(ssn|passport|dob)\b

Message

Personal data may be logged without protection.

Fix Action

Mask or remove personal data from logs

Applies To

• */.js
• */.ts
• */.py

No Data Retention Limit

Id

infinite-retention

Severity

warning

Type

regex

Pattern

• store.personal.(?!expir|ttl|retention)
• save.userData(?!.delete|.*purge)

Message

Personal data storage without retention limit.

Fix Action

Implement retention policy with automatic deletion

Applies To

• */.js
• */.ts

Unencrypted Sensitive Data

Id

unencrypted-sensitive-data

Severity

error

Type

regex

Pattern

• healthData.=.\{(?!.*encrypt)
• biometric.store(?!.encrypt)
• racialOrigin|politicalOpinion|religiousBelief

Message

Sensitive data may not be encrypted at rest.

Fix Action

Encrypt sensitive (Article 9) data at rest

Applies To

• */.js
• */.ts

Processing Without Legal Basis

Id

missing-legal-basis

Severity

warning

Type

regex

Pattern

• processPersonalData(?!.legalBasis|.consent|.*contract)

Message

Processing function may not document legal basis.

Fix Action

Document and validate legal basis before processing

Applies To

• */.js
• */.ts