refactor(admin-compliance): split 11 oversized files under 500 LOC hard cap (batch 2)
Barrel-split pattern: each original becomes a thin re-export barrel; logic moved to sibling files so no consumer imports need updating. Files split: - loeschfristen-profiling.ts → profiling-data.ts + profiling-generator.ts - vendor-compliance/catalog/vendor-templates.ts → vendor-country-profiles.ts - vendor-compliance/catalog/legal-basis.ts → legal-basis-retention.ts - dsfa/eu-legal-frameworks.ts → eu-legal-frameworks-national.ts - compliance-scope-types/document-scope-matrix-core.ts → core-part2.ts - compliance-scope-types/document-scope-matrix-extended.ts → extended-part2.ts - app/sdk/document-generator/contextBridge.ts → contextBridge-helpers.ts - app/api/sdk/drafting-engine/draft/route.ts → draft-helpers.ts + draft-helpers-v2.ts All files ≤ 500 LOC. Zero behavior changes. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Sharang Parnerkar
322
admin-compliance/lib/sdk/dsfa/eu-legal-frameworks-national.ts
Normal file
322
admin-compliance/lib/sdk/dsfa/eu-legal-frameworks-national.ts
Normal file
@@ -0,0 +1,322 @@
|
||||
/**
|
||||
* EU/EWR Rechtsgrundlagen — Nationale Ergaenzungsgesetze + Helpers
|
||||
*
|
||||
* Split from eu-legal-frameworks.ts for the 500 LOC hard cap.
|
||||
*/
|
||||
|
||||
import type { CountryCode, LegalDocumentType, LicenseType, LegalFramework, SupervisoryAuthority, DocumentTypeMatrix, RAGLayer, DocumentUniformity } from './eu-legal-frameworks'
|
||||
|
||||
export type { CountryCode, LegalDocumentType, LicenseType, DocumentUniformity }
|
||||
|
||||
// =============================================================================
|
||||
// Nationale Ergaenzungsgesetze (Phase 2 — modular pro Land)
|
||||
// =============================================================================
|
||||
|
||||
export const NATIONAL_FRAMEWORKS: LegalFramework[] = [
|
||||
// --- Deutschland ---
|
||||
{
|
||||
id: 'DE-BDSG',
|
||||
countryCode: 'DE',
|
||||
name: 'BDSG',
|
||||
fullName: 'Bundesdatenschutzgesetz (2018)',
|
||||
abbreviation: 'BDSG',
|
||||
type: 'national_law',
|
||||
description:
|
||||
'Nationales Begleitgesetz zur DSGVO. Ergaenzt u.a. Beschaeftigtendatenschutz (§26), ' +
|
||||
'Videoueberwachung (§4), Forschung/Statistik, Bussgeldpraxis.',
|
||||
sourceUrl: 'https://www.gesetze-im-internet.de/bdsg_2018/',
|
||||
license: 'PUBLIC_DOMAIN',
|
||||
licenseNote: 'Amtliches Werk, gemeinfrei (§5 UrhG)',
|
||||
gdprOpeningClauses: ['Art. 6 Abs. 2', 'Art. 9 Abs. 4', 'Art. 23', 'Art. 85', 'Art. 88'],
|
||||
specialProvisions: [
|
||||
'§26 BDSG — Beschaeftigtendatenschutz',
|
||||
'§4 BDSG — Videoueberwachung oeffentlich zugaenglicher Raeume',
|
||||
'§22 BDSG — Verarbeitung besonderer Kategorien',
|
||||
'§41-43 BDSG — Straf- und Bussgeldvorschriften',
|
||||
],
|
||||
supervisoryAuthorities: [
|
||||
{ name: 'Bundesbeauftragter fuer den Datenschutz', abbreviation: 'BfDI', url: 'https://www.bfdi.bund.de', country: 'DE' },
|
||||
],
|
||||
ragPhase: 2,
|
||||
},
|
||||
{
|
||||
id: 'DE-TTDSG',
|
||||
countryCode: 'DE',
|
||||
name: 'TTDSG',
|
||||
fullName: 'Telekommunikation-Telemedien-Datenschutz-Gesetz',
|
||||
abbreviation: 'TTDSG',
|
||||
type: 'national_law',
|
||||
description:
|
||||
'Deutsche Umsetzung der ePrivacy-Richtlinie. Regelt insbesondere Cookie-Consent (§25 TTDSG), ' +
|
||||
'Endgeraetezugriff und Telekommunikations-Datenschutz.',
|
||||
sourceUrl: 'https://www.gesetze-im-internet.de/ttdsg/',
|
||||
license: 'PUBLIC_DOMAIN',
|
||||
licenseNote: 'Amtliches Werk, gemeinfrei (§5 UrhG)',
|
||||
specialProvisions: [
|
||||
'§25 TTDSG — Einwilligung fuer Cookies/Tracking',
|
||||
'§26 TTDSG — Anerkannte Dienste zur Einwilligungsverwaltung',
|
||||
],
|
||||
ragPhase: 2,
|
||||
},
|
||||
{
|
||||
id: 'DE-TMG',
|
||||
countryCode: 'DE',
|
||||
name: 'TMG / DDG',
|
||||
fullName: 'Telemediengesetz / Digitale-Dienste-Gesetz',
|
||||
abbreviation: 'TMG',
|
||||
type: 'national_law',
|
||||
description:
|
||||
'Impressumspflicht (§5 TMG/DDG) und Anbieterkennzeichnung fuer Online-Dienste in Deutschland.',
|
||||
sourceUrl: 'https://www.gesetze-im-internet.de/tmg/',
|
||||
license: 'PUBLIC_DOMAIN',
|
||||
licenseNote: 'Amtliches Werk, gemeinfrei (§5 UrhG)',
|
||||
specialProvisions: [
|
||||
'§5 TMG — Impressumspflicht (Anbieterkennzeichnung)',
|
||||
'§7-10 TMG — Verantwortlichkeit von Diensteanbietern',
|
||||
],
|
||||
ragPhase: 3,
|
||||
},
|
||||
|
||||
// --- Oesterreich ---
|
||||
{
|
||||
id: 'AT-DSG',
|
||||
countryCode: 'AT',
|
||||
name: 'DSG (AT)',
|
||||
fullName: 'Datenschutzgesetz (Oesterreich, 2018)',
|
||||
abbreviation: 'DSG',
|
||||
type: 'national_law',
|
||||
description:
|
||||
'Oesterreichisches Begleitgesetz zur DSGVO. Enthält Besonderheiten fuer Behoerden, ' +
|
||||
'Strafverfolgung und teilweise andere Auslegungspraxis als Deutschland.',
|
||||
sourceUrl: 'https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10001597',
|
||||
license: 'PUBLIC_DOMAIN',
|
||||
licenseNote: 'Amtliches Werk, Rechtsinformationssystem des Bundes (RIS)',
|
||||
supervisoryAuthorities: [
|
||||
{ name: 'Oesterreichische Datenschutzbehoerde', abbreviation: 'DSB', url: 'https://www.dsb.gv.at', country: 'AT' },
|
||||
],
|
||||
ragPhase: 2,
|
||||
},
|
||||
|
||||
// --- Schweiz (NICHT EU — eigenes Recht) ---
|
||||
{
|
||||
id: 'CH-DSG',
|
||||
countryCode: 'CH',
|
||||
name: 'revDSG (CH)',
|
||||
fullName: 'Bundesgesetz ueber den Datenschutz (revidiertes DSG, seit 01.09.2023)',
|
||||
abbreviation: 'revDSG',
|
||||
type: 'national_law',
|
||||
description:
|
||||
'Die Schweiz ist nicht EU-Mitglied. Das revidierte DSG (2023) ist inhaltlich aehnlich der DSGVO, ' +
|
||||
'aber nicht identisch. Unterschiede: andere Sanktionslogik (Busse bis 250.000 CHF gegen ' +
|
||||
'natuerliche Personen), teils andere Begriffe, kein One-Stop-Shop.',
|
||||
sourceUrl: 'https://www.fedlex.admin.ch/eli/cc/2022/491/de',
|
||||
license: 'PUBLIC_DOMAIN',
|
||||
licenseNote: 'Amtliches Bundesrecht, Fedlex (Schweiz)',
|
||||
specialProvisions: [
|
||||
'Art. 60-66 revDSG — Strafbestimmungen (gegen natuerliche Personen)',
|
||||
'Art. 16-18 revDSG — Drittlandtransfer (eigene Laenderliste)',
|
||||
'Art. 22 revDSG — Datenschutz-Folgenabschaetzung',
|
||||
'Art. 12 revDSG — Verzeichnis der Bearbeitungstaetigkeiten',
|
||||
],
|
||||
supervisoryAuthorities: [
|
||||
{ name: 'Eidgenoessischer Datenschutzbeauftragter', abbreviation: 'EDOEB', url: 'https://www.edoeb.admin.ch', country: 'CH' },
|
||||
],
|
||||
ragPhase: 2,
|
||||
},
|
||||
|
||||
// --- Frankreich ---
|
||||
{
|
||||
id: 'FR-LIL',
|
||||
countryCode: 'FR',
|
||||
name: 'Loi Informatique et Libertés',
|
||||
fullName: 'Loi n° 78-17 du 6 janvier 1978 relative à l\'informatique, aux fichiers et aux libertés',
|
||||
abbreviation: 'LIL',
|
||||
type: 'national_law',
|
||||
description:
|
||||
'Franzoesisches Begleitgesetz zur DSGVO (aktualisiert 2018). Spezialregelungen u.a. ' +
|
||||
'zur Einwilligung Minderjaehriger (ab 15 Jahren), Forschungsdaten und Gesundheitsdaten.',
|
||||
sourceUrl: 'https://www.legifrance.gouv.fr/loda/id/JORFTEXT000000886460',
|
||||
license: 'PUBLIC_DOMAIN',
|
||||
licenseNote: 'Amtliches Gesetz, Légifrance (gemeinfrei)',
|
||||
supervisoryAuthorities: [
|
||||
{ name: 'Commission Nationale de l\'Informatique et des Libertés', abbreviation: 'CNIL', url: 'https://www.cnil.fr', country: 'FR' },
|
||||
],
|
||||
ragPhase: 2,
|
||||
},
|
||||
|
||||
// --- Spanien ---
|
||||
{
|
||||
id: 'ES-LOPDGDD',
|
||||
countryCode: 'ES',
|
||||
name: 'LOPDGDD',
|
||||
fullName: 'Ley Orgánica 3/2018 de Protección de Datos Personales y garantía de los derechos digitales',
|
||||
abbreviation: 'LOPDGDD',
|
||||
type: 'national_law',
|
||||
description:
|
||||
'Spanisches Datenschutzgesetz. Ergaenzt DSGVO u.a. mit Regelungen zu ' +
|
||||
'Kindereinwilligung, digitalem Testament und Rechten Verstorbener.',
|
||||
sourceUrl: 'https://www.boe.es/diario_boe/txt.php?id=BOE-A-2018-16673',
|
||||
license: 'PUBLIC_DOMAIN',
|
||||
licenseNote: 'Amtliches Gesetz, Boletín Oficial del Estado (gemeinfrei)',
|
||||
supervisoryAuthorities: [
|
||||
{ name: 'Agencia Española de Protección de Datos', abbreviation: 'AEPD', url: 'https://www.aepd.es', country: 'ES' },
|
||||
],
|
||||
ragPhase: 2,
|
||||
},
|
||||
|
||||
// --- Italien ---
|
||||
{
|
||||
id: 'IT-CODICE',
|
||||
countryCode: 'IT',
|
||||
name: 'Codice Privacy',
|
||||
fullName: 'Decreto Legislativo 30 giugno 2003, n. 196 (Codice in materia di protezione dei dati personali)',
|
||||
abbreviation: 'Codice Privacy',
|
||||
type: 'national_law',
|
||||
description:
|
||||
'Italienischer Datenschutzkodex, angepasst an die DSGVO (D.Lgs. 101/2018). ' +
|
||||
'Enthaelt Spezialregelungen fuer Gesundheitsdaten, Forschung und Journalismus.',
|
||||
sourceUrl: 'https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:decreto.legislativo:2003-06-30;196!vig=',
|
||||
license: 'PUBLIC_DOMAIN',
|
||||
licenseNote: 'Amtliches Gesetz, Normattiva (gemeinfrei)',
|
||||
supervisoryAuthorities: [
|
||||
{ name: 'Garante per la protezione dei dati personali', abbreviation: 'Garante', url: 'https://www.garanteprivacy.it', country: 'IT' },
|
||||
],
|
||||
ragPhase: 2,
|
||||
},
|
||||
|
||||
// --- Niederlande ---
|
||||
{
|
||||
id: 'NL-AVG',
|
||||
countryCode: 'NL',
|
||||
name: 'AVG / UAVG',
|
||||
fullName: 'Uitvoeringswet Algemene verordening gegevensbescherming (UAVG)',
|
||||
abbreviation: 'UAVG',
|
||||
type: 'national_law',
|
||||
description:
|
||||
'Niederlaendisches Ausfuehrungsgesetz zur DSGVO.',
|
||||
sourceUrl: 'https://wetten.overheid.nl/BWBR0040948/',
|
||||
license: 'PUBLIC_DOMAIN',
|
||||
licenseNote: 'Amtliches Gesetz, wetten.overheid.nl (gemeinfrei)',
|
||||
supervisoryAuthorities: [
|
||||
{ name: 'Autoriteit Persoonsgegevens', abbreviation: 'AP', url: 'https://www.autoriteitpersoonsgegevens.nl', country: 'NL' },
|
||||
],
|
||||
ragPhase: 2,
|
||||
},
|
||||
|
||||
// --- Grossbritannien (post-Brexit) ---
|
||||
{
|
||||
id: 'GB-DPA',
|
||||
countryCode: 'GB',
|
||||
name: 'UK DPA 2018 / UK GDPR',
|
||||
fullName: 'Data Protection Act 2018 + UK GDPR (retained EU law)',
|
||||
abbreviation: 'DPA 2018',
|
||||
type: 'national_law',
|
||||
description:
|
||||
'Nach Brexit: UK GDPR (inhaltlich weitgehend identisch mit EU-DSGVO) plus Data Protection Act 2018 ' +
|
||||
'als nationales Begleitgesetz. ICO als Aufsichtsbehoerde.',
|
||||
sourceUrl: 'https://www.legislation.gov.uk/ukpga/2018/12/contents',
|
||||
license: 'OGL-3.0',
|
||||
licenseNote: 'UK legislation, Open Government Licence v3.0',
|
||||
supervisoryAuthorities: [
|
||||
{ name: 'Information Commissioner\'s Office', abbreviation: 'ICO', url: 'https://ico.org.uk', country: 'GB' },
|
||||
],
|
||||
ragPhase: 2,
|
||||
},
|
||||
|
||||
// --- Norwegen (EWR) ---
|
||||
{
|
||||
id: 'NO-PERSONOPPL',
|
||||
countryCode: 'NO',
|
||||
name: 'Personopplysningsloven',
|
||||
fullName: 'Lov om behandling av personopplysninger (personopplysningsloven)',
|
||||
abbreviation: 'POL',
|
||||
type: 'national_law',
|
||||
description:
|
||||
'Norwegisches DSGVO-Ausfuehrungsgesetz (EWR-Mitglied, DSGVO gilt ueber EWR-Abkommen).',
|
||||
sourceUrl: 'https://lovdata.no/dokument/NL/lov/2018-06-15-38',
|
||||
license: 'PUBLIC_DOMAIN',
|
||||
licenseNote: 'Amtliches Gesetz, Lovdata (gemeinfrei)',
|
||||
supervisoryAuthorities: [
|
||||
{ name: 'Datatilsynet', abbreviation: 'DT', url: 'https://www.datatilsynet.no', country: 'NO' },
|
||||
],
|
||||
ragPhase: 2,
|
||||
},
|
||||
]
|
||||
|
||||
// =============================================================================
|
||||
// Helper Functions
|
||||
// =============================================================================
|
||||
|
||||
export function getAllSupervisoryAuthorities(
|
||||
allFrameworks: LegalFramework[]
|
||||
): SupervisoryAuthority[] {
|
||||
const authorities: SupervisoryAuthority[] = []
|
||||
for (const fw of allFrameworks) {
|
||||
if (fw.supervisoryAuthorities) {
|
||||
for (const sa of fw.supervisoryAuthorities) {
|
||||
if (!authorities.some(a => a.abbreviation === sa.abbreviation)) {
|
||||
authorities.push(sa)
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
return authorities
|
||||
}
|
||||
|
||||
export function getSupervisoryAuthority(
|
||||
country: CountryCode,
|
||||
allFrameworks: LegalFramework[]
|
||||
): SupervisoryAuthority[] {
|
||||
return getAllSupervisoryAuthorities(allFrameworks).filter(sa => sa.country === country)
|
||||
}
|
||||
|
||||
export function getCountrySpecificDocTypes(
|
||||
country: CountryCode,
|
||||
matrix: DocumentTypeMatrix[]
|
||||
): DocumentTypeMatrix[] {
|
||||
return matrix.filter(
|
||||
d => d.uniformity === 'country_specific' ||
|
||||
(d.uniformity === 'needs_national_supplement' && country !== 'EU')
|
||||
)
|
||||
}
|
||||
|
||||
export function getEUUniformDocTypes(matrix: DocumentTypeMatrix[]): DocumentTypeMatrix[] {
|
||||
return matrix.filter(d => d.uniformity === 'eu_uniform')
|
||||
}
|
||||
|
||||
export function isGDPRCountry(country: CountryCode): boolean {
|
||||
const gdprCountries: CountryCode[] = ['EU', 'DE', 'AT', 'FR', 'ES', 'IT', 'NL', 'NO', 'IS']
|
||||
return gdprCountries.includes(country)
|
||||
}
|
||||
|
||||
export function hasSeparateLegalFramework(country: CountryCode): boolean {
|
||||
return country === 'CH' || country === 'GB'
|
||||
}
|
||||
|
||||
export function getRAGSourcesForPhase(phase: 1 | 2 | 3, allFrameworks: LegalFramework[]): LegalFramework[] {
|
||||
return allFrameworks.filter(f => f.ragPhase === phase)
|
||||
}
|
||||
|
||||
export function getRequiredFrameworkSummary(
|
||||
country: CountryCode,
|
||||
allFrameworks: LegalFramework[]
|
||||
): {
|
||||
baseLaw: string
|
||||
nationalLaw: string | null
|
||||
supervisoryAuthority: string | null
|
||||
separateFramework: boolean
|
||||
} {
|
||||
const isGDPR = isGDPRCountry(country)
|
||||
const national = NATIONAL_FRAMEWORKS.filter(f => f.countryCode === country)
|
||||
const authorities = getSupervisoryAuthority(country, allFrameworks)
|
||||
|
||||
return {
|
||||
baseLaw: isGDPR ? 'DSGVO (EU 2016/679)' : (country === 'CH' ? 'revDSG (CH)' : 'UK GDPR'),
|
||||
nationalLaw: national.length > 0 ? national.map(n => n.abbreviation).join(', ') : null,
|
||||
supervisoryAuthority: authorities.length > 0 ? authorities.map(a => a.abbreviation).join(', ') : null,
|
||||
separateFramework: hasSeparateLegalFramework(country),
|
||||
}
|
||||
}
|
||||
|
||||
// Re-export RAGLayer type for barrel consumers
|
||||
export type { RAGLayer }
|
||||
@@ -150,294 +150,19 @@ export const EU_BASE_FRAMEWORKS: LegalFramework[] = [
|
||||
},
|
||||
]
|
||||
|
||||
// =============================================================================
|
||||
// Nationale Ergaenzungsgesetze (Phase 2 — modular pro Land)
|
||||
// =============================================================================
|
||||
|
||||
export const NATIONAL_FRAMEWORKS: LegalFramework[] = [
|
||||
// --- Deutschland ---
|
||||
{
|
||||
id: 'DE-BDSG',
|
||||
countryCode: 'DE',
|
||||
name: 'BDSG',
|
||||
fullName: 'Bundesdatenschutzgesetz (2018)',
|
||||
abbreviation: 'BDSG',
|
||||
type: 'national_law',
|
||||
description:
|
||||
'Nationales Begleitgesetz zur DSGVO. Ergaenzt u.a. Beschaeftigtendatenschutz (§26), ' +
|
||||
'Videoueberwachung (§4), Forschung/Statistik, Bussgeldpraxis.',
|
||||
sourceUrl: 'https://www.gesetze-im-internet.de/bdsg_2018/',
|
||||
license: 'PUBLIC_DOMAIN',
|
||||
licenseNote: 'Amtliches Werk, gemeinfrei (§5 UrhG)',
|
||||
gdprOpeningClauses: ['Art. 6 Abs. 2', 'Art. 9 Abs. 4', 'Art. 23', 'Art. 85', 'Art. 88'],
|
||||
specialProvisions: [
|
||||
'§26 BDSG — Beschaeftigtendatenschutz',
|
||||
'§4 BDSG — Videoueberwachung oeffentlich zugaenglicher Raeume',
|
||||
'§22 BDSG — Verarbeitung besonderer Kategorien',
|
||||
'§41-43 BDSG — Straf- und Bussgeldvorschriften',
|
||||
],
|
||||
supervisoryAuthorities: [
|
||||
{ name: 'Bundesbeauftragter fuer den Datenschutz', abbreviation: 'BfDI', url: 'https://www.bfdi.bund.de', country: 'DE' },
|
||||
],
|
||||
ragPhase: 2,
|
||||
},
|
||||
{
|
||||
id: 'DE-TTDSG',
|
||||
countryCode: 'DE',
|
||||
name: 'TTDSG',
|
||||
fullName: 'Telekommunikation-Telemedien-Datenschutz-Gesetz',
|
||||
abbreviation: 'TTDSG',
|
||||
type: 'national_law',
|
||||
description:
|
||||
'Deutsche Umsetzung der ePrivacy-Richtlinie. Regelt insbesondere Cookie-Consent (§25 TTDSG), ' +
|
||||
'Endgeraetezugriff und Telekommunikations-Datenschutz.',
|
||||
sourceUrl: 'https://www.gesetze-im-internet.de/ttdsg/',
|
||||
license: 'PUBLIC_DOMAIN',
|
||||
licenseNote: 'Amtliches Werk, gemeinfrei (§5 UrhG)',
|
||||
specialProvisions: [
|
||||
'§25 TTDSG — Einwilligung fuer Cookies/Tracking',
|
||||
'§26 TTDSG — Anerkannte Dienste zur Einwilligungsverwaltung',
|
||||
],
|
||||
ragPhase: 2,
|
||||
},
|
||||
{
|
||||
id: 'DE-TMG',
|
||||
countryCode: 'DE',
|
||||
name: 'TMG / DDG',
|
||||
fullName: 'Telemediengesetz / Digitale-Dienste-Gesetz',
|
||||
abbreviation: 'TMG',
|
||||
type: 'national_law',
|
||||
description:
|
||||
'Impressumspflicht (§5 TMG/DDG) und Anbieterkennzeichnung fuer Online-Dienste in Deutschland.',
|
||||
sourceUrl: 'https://www.gesetze-im-internet.de/tmg/',
|
||||
license: 'PUBLIC_DOMAIN',
|
||||
licenseNote: 'Amtliches Werk, gemeinfrei (§5 UrhG)',
|
||||
specialProvisions: [
|
||||
'§5 TMG — Impressumspflicht (Anbieterkennzeichnung)',
|
||||
'§7-10 TMG — Verantwortlichkeit von Diensteanbietern',
|
||||
],
|
||||
ragPhase: 3,
|
||||
},
|
||||
|
||||
// --- Oesterreich ---
|
||||
{
|
||||
id: 'AT-DSG',
|
||||
countryCode: 'AT',
|
||||
name: 'DSG (AT)',
|
||||
fullName: 'Datenschutzgesetz (Oesterreich, 2018)',
|
||||
abbreviation: 'DSG',
|
||||
type: 'national_law',
|
||||
description:
|
||||
'Oesterreichisches Begleitgesetz zur DSGVO. Enthält Besonderheiten fuer Behoerden, ' +
|
||||
'Strafverfolgung und teilweise andere Auslegungspraxis als Deutschland.',
|
||||
sourceUrl: 'https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10001597',
|
||||
license: 'PUBLIC_DOMAIN',
|
||||
licenseNote: 'Amtliches Werk, Rechtsinformationssystem des Bundes (RIS)',
|
||||
supervisoryAuthorities: [
|
||||
{ name: 'Oesterreichische Datenschutzbehoerde', abbreviation: 'DSB', url: 'https://www.dsb.gv.at', country: 'AT' },
|
||||
],
|
||||
ragPhase: 2,
|
||||
},
|
||||
|
||||
// --- Schweiz (NICHT EU — eigenes Recht) ---
|
||||
{
|
||||
id: 'CH-DSG',
|
||||
countryCode: 'CH',
|
||||
name: 'revDSG (CH)',
|
||||
fullName: 'Bundesgesetz ueber den Datenschutz (revidiertes DSG, seit 01.09.2023)',
|
||||
abbreviation: 'revDSG',
|
||||
type: 'national_law',
|
||||
description:
|
||||
'Die Schweiz ist nicht EU-Mitglied. Das revidierte DSG (2023) ist inhaltlich aehnlich der DSGVO, ' +
|
||||
'aber nicht identisch. Unterschiede: andere Sanktionslogik (Busse bis 250.000 CHF gegen ' +
|
||||
'natuerliche Personen), teils andere Begriffe, kein One-Stop-Shop.',
|
||||
sourceUrl: 'https://www.fedlex.admin.ch/eli/cc/2022/491/de',
|
||||
license: 'PUBLIC_DOMAIN',
|
||||
licenseNote: 'Amtliches Bundesrecht, Fedlex (Schweiz)',
|
||||
specialProvisions: [
|
||||
'Art. 60-66 revDSG — Strafbestimmungen (gegen natuerliche Personen)',
|
||||
'Art. 16-18 revDSG — Drittlandtransfer (eigene Laenderliste)',
|
||||
'Art. 22 revDSG — Datenschutz-Folgenabschaetzung',
|
||||
'Art. 12 revDSG — Verzeichnis der Bearbeitungstaetigkeiten',
|
||||
],
|
||||
supervisoryAuthorities: [
|
||||
{ name: 'Eidgenoessischer Datenschutzbeauftragter', abbreviation: 'EDOEB', url: 'https://www.edoeb.admin.ch', country: 'CH' },
|
||||
],
|
||||
ragPhase: 2,
|
||||
},
|
||||
|
||||
// --- Frankreich ---
|
||||
{
|
||||
id: 'FR-LIL',
|
||||
countryCode: 'FR',
|
||||
name: 'Loi Informatique et Libertés',
|
||||
fullName: 'Loi n° 78-17 du 6 janvier 1978 relative à l\'informatique, aux fichiers et aux libertés',
|
||||
abbreviation: 'LIL',
|
||||
type: 'national_law',
|
||||
description:
|
||||
'Franzoesisches Begleitgesetz zur DSGVO (aktualisiert 2018). Spezialregelungen u.a. ' +
|
||||
'zur Einwilligung Minderjaehriger (ab 15 Jahren), Forschungsdaten und Gesundheitsdaten.',
|
||||
sourceUrl: 'https://www.legifrance.gouv.fr/loda/id/JORFTEXT000000886460',
|
||||
license: 'PUBLIC_DOMAIN',
|
||||
licenseNote: 'Amtliches Gesetz, Légifrance (gemeinfrei)',
|
||||
supervisoryAuthorities: [
|
||||
{ name: 'Commission Nationale de l\'Informatique et des Libertés', abbreviation: 'CNIL', url: 'https://www.cnil.fr', country: 'FR' },
|
||||
],
|
||||
ragPhase: 2,
|
||||
},
|
||||
|
||||
// --- Spanien ---
|
||||
{
|
||||
id: 'ES-LOPDGDD',
|
||||
countryCode: 'ES',
|
||||
name: 'LOPDGDD',
|
||||
fullName: 'Ley Orgánica 3/2018 de Protección de Datos Personales y garantía de los derechos digitales',
|
||||
abbreviation: 'LOPDGDD',
|
||||
type: 'national_law',
|
||||
description:
|
||||
'Spanisches Datenschutzgesetz. Ergaenzt DSGVO u.a. mit Regelungen zu ' +
|
||||
'Kindereinwilligung, digitalem Testament und Rechten Verstorbener.',
|
||||
sourceUrl: 'https://www.boe.es/diario_boe/txt.php?id=BOE-A-2018-16673',
|
||||
license: 'PUBLIC_DOMAIN',
|
||||
licenseNote: 'Amtliches Gesetz, Boletín Oficial del Estado (gemeinfrei)',
|
||||
supervisoryAuthorities: [
|
||||
{ name: 'Agencia Española de Protección de Datos', abbreviation: 'AEPD', url: 'https://www.aepd.es', country: 'ES' },
|
||||
],
|
||||
ragPhase: 2,
|
||||
},
|
||||
|
||||
// --- Italien ---
|
||||
{
|
||||
id: 'IT-CODICE',
|
||||
countryCode: 'IT',
|
||||
name: 'Codice Privacy',
|
||||
fullName: 'Decreto Legislativo 30 giugno 2003, n. 196 (Codice in materia di protezione dei dati personali)',
|
||||
abbreviation: 'Codice Privacy',
|
||||
type: 'national_law',
|
||||
description:
|
||||
'Italienischer Datenschutzkodex, angepasst an die DSGVO (D.Lgs. 101/2018). ' +
|
||||
'Enthaelt Spezialregelungen fuer Gesundheitsdaten, Forschung und Journalismus.',
|
||||
sourceUrl: 'https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:decreto.legislativo:2003-06-30;196!vig=',
|
||||
license: 'PUBLIC_DOMAIN',
|
||||
licenseNote: 'Amtliches Gesetz, Normattiva (gemeinfrei)',
|
||||
supervisoryAuthorities: [
|
||||
{ name: 'Garante per la protezione dei dati personali', abbreviation: 'Garante', url: 'https://www.garanteprivacy.it', country: 'IT' },
|
||||
],
|
||||
ragPhase: 2,
|
||||
},
|
||||
|
||||
// --- Niederlande ---
|
||||
{
|
||||
id: 'NL-AVG',
|
||||
countryCode: 'NL',
|
||||
name: 'AVG / UAVG',
|
||||
fullName: 'Uitvoeringswet Algemene verordening gegevensbescherming (UAVG)',
|
||||
abbreviation: 'UAVG',
|
||||
type: 'national_law',
|
||||
description:
|
||||
'Niederlaendisches Ausfuehrungsgesetz zur DSGVO.',
|
||||
sourceUrl: 'https://wetten.overheid.nl/BWBR0040948/',
|
||||
license: 'PUBLIC_DOMAIN',
|
||||
licenseNote: 'Amtliches Gesetz, wetten.overheid.nl (gemeinfrei)',
|
||||
supervisoryAuthorities: [
|
||||
{ name: 'Autoriteit Persoonsgegevens', abbreviation: 'AP', url: 'https://www.autoriteitpersoonsgegevens.nl', country: 'NL' },
|
||||
],
|
||||
ragPhase: 2,
|
||||
},
|
||||
|
||||
// --- Grossbritannien (post-Brexit) ---
|
||||
{
|
||||
id: 'GB-DPA',
|
||||
countryCode: 'GB',
|
||||
name: 'UK DPA 2018 / UK GDPR',
|
||||
fullName: 'Data Protection Act 2018 + UK GDPR (retained EU law)',
|
||||
abbreviation: 'DPA 2018',
|
||||
type: 'national_law',
|
||||
description:
|
||||
'Nach Brexit: UK GDPR (inhaltlich weitgehend identisch mit EU-DSGVO) plus Data Protection Act 2018 ' +
|
||||
'als nationales Begleitgesetz. ICO als Aufsichtsbehoerde.',
|
||||
sourceUrl: 'https://www.legislation.gov.uk/ukpga/2018/12/contents',
|
||||
license: 'OGL-3.0',
|
||||
licenseNote: 'UK legislation, Open Government Licence v3.0',
|
||||
supervisoryAuthorities: [
|
||||
{ name: 'Information Commissioner\'s Office', abbreviation: 'ICO', url: 'https://ico.org.uk', country: 'GB' },
|
||||
],
|
||||
ragPhase: 2,
|
||||
},
|
||||
|
||||
// --- Norwegen (EWR) ---
|
||||
{
|
||||
id: 'NO-PERSONOPPL',
|
||||
countryCode: 'NO',
|
||||
name: 'Personopplysningsloven',
|
||||
fullName: 'Lov om behandling av personopplysninger (personopplysningsloven)',
|
||||
abbreviation: 'POL',
|
||||
type: 'national_law',
|
||||
description:
|
||||
'Norwegisches DSGVO-Ausfuehrungsgesetz (EWR-Mitglied, DSGVO gilt ueber EWR-Abkommen).',
|
||||
sourceUrl: 'https://lovdata.no/dokument/NL/lov/2018-06-15-38',
|
||||
license: 'PUBLIC_DOMAIN',
|
||||
licenseNote: 'Amtliches Gesetz, Lovdata (gemeinfrei)',
|
||||
supervisoryAuthorities: [
|
||||
{ name: 'Datatilsynet', abbreviation: 'DT', url: 'https://www.datatilsynet.no', country: 'NO' },
|
||||
],
|
||||
ragPhase: 2,
|
||||
},
|
||||
]
|
||||
|
||||
// =============================================================================
|
||||
// Dokumenttyp-Matrix: EU-einheitlich vs. laenderspezifisch
|
||||
// =============================================================================
|
||||
|
||||
export const DOCUMENT_TYPE_MATRIX: DocumentTypeMatrix[] = [
|
||||
{
|
||||
documentType: 'privacy_policy',
|
||||
label: 'Datenschutzerklaerung',
|
||||
uniformity: 'needs_national_supplement',
|
||||
description: 'DSGVO-Kern EU-weit gleich. Nationale Ergaenzungen fuer ePrivacy-Umsetzung, Behoerden-Praxis.',
|
||||
},
|
||||
{
|
||||
documentType: 'ropa',
|
||||
label: 'Verarbeitungsverzeichnis (VVT)',
|
||||
uniformity: 'eu_uniform',
|
||||
description: 'Art. 30 DSGVO — EU-weit identische Anforderungen.',
|
||||
},
|
||||
{
|
||||
documentType: 'tom',
|
||||
label: 'Technisch-Organisatorische Massnahmen',
|
||||
uniformity: 'eu_uniform',
|
||||
description: 'Art. 32 DSGVO — EU-weit identische Anforderungen.',
|
||||
},
|
||||
{
|
||||
documentType: 'dpia',
|
||||
label: 'Datenschutz-Folgenabschaetzung (DSFA)',
|
||||
uniformity: 'eu_uniform',
|
||||
description: 'Art. 35 DSGVO — EU-weit identisch. Muss-Listen variieren je Aufsichtsbehoerde.',
|
||||
},
|
||||
{
|
||||
documentType: 'dpa',
|
||||
label: 'Auftragsverarbeitungsvertrag (AVV)',
|
||||
uniformity: 'eu_uniform',
|
||||
description: 'Art. 28 DSGVO — EU-weit identische Anforderungen.',
|
||||
},
|
||||
{
|
||||
documentType: 'deletion_concept',
|
||||
label: 'Loeschkonzept',
|
||||
uniformity: 'eu_uniform',
|
||||
description: 'Art. 5(1)(e), Art. 17 DSGVO — EU-weit einheitlich.',
|
||||
},
|
||||
{
|
||||
documentType: 'breach_process',
|
||||
label: 'Data Breach / Incident Response',
|
||||
uniformity: 'eu_uniform',
|
||||
description: 'Art. 33-34 DSGVO — EU-weit identische 72-Stunden-Frist.',
|
||||
},
|
||||
{
|
||||
documentType: 'dsar_process',
|
||||
label: 'Betroffenenrechte-Prozess (DSAR)',
|
||||
uniformity: 'eu_uniform',
|
||||
description: 'Art. 12-22 DSGVO — EU-weit identische Rechte und Fristen.',
|
||||
},
|
||||
{ documentType: 'privacy_policy', label: 'Datenschutzerklaerung', uniformity: 'needs_national_supplement', description: 'DSGVO-Kern EU-weit gleich. Nationale Ergaenzungen fuer ePrivacy-Umsetzung, Behoerden-Praxis.' },
|
||||
{ documentType: 'ropa', label: 'Verarbeitungsverzeichnis (VVT)', uniformity: 'eu_uniform', description: 'Art. 30 DSGVO — EU-weit identische Anforderungen.' },
|
||||
{ documentType: 'tom', label: 'Technisch-Organisatorische Massnahmen', uniformity: 'eu_uniform', description: 'Art. 32 DSGVO — EU-weit identische Anforderungen.' },
|
||||
{ documentType: 'dpia', label: 'Datenschutz-Folgenabschaetzung (DSFA)', uniformity: 'eu_uniform', description: 'Art. 35 DSGVO — EU-weit identisch. Muss-Listen variieren je Aufsichtsbehoerde.' },
|
||||
{ documentType: 'dpa', label: 'Auftragsverarbeitungsvertrag (AVV)', uniformity: 'eu_uniform', description: 'Art. 28 DSGVO — EU-weit identische Anforderungen.' },
|
||||
{ documentType: 'deletion_concept', label: 'Loeschkonzept', uniformity: 'eu_uniform', description: 'Art. 5(1)(e), Art. 17 DSGVO — EU-weit einheitlich.' },
|
||||
{ documentType: 'breach_process', label: 'Data Breach / Incident Response', uniformity: 'eu_uniform', description: 'Art. 33-34 DSGVO — EU-weit identische 72-Stunden-Frist.' },
|
||||
{ documentType: 'dsar_process', label: 'Betroffenenrechte-Prozess (DSAR)', uniformity: 'eu_uniform', description: 'Art. 12-22 DSGVO — EU-weit identische Rechte und Fristen.' },
|
||||
{
|
||||
documentType: 'imprint',
|
||||
label: 'Impressum',
|
||||
@@ -457,24 +182,9 @@ export const DOCUMENT_TYPE_MATRIX: DocumentTypeMatrix[] = [
|
||||
'IS': 'Rafraeðislög',
|
||||
},
|
||||
},
|
||||
{
|
||||
documentType: 'terms_of_service',
|
||||
label: 'AGB / Nutzungsbedingungen',
|
||||
uniformity: 'country_specific',
|
||||
description: 'Nationales Vertragsrecht (BGB, ABGB, OR). Verbraucherrecht teils EU-harmonisiert, aber national umgesetzt.',
|
||||
},
|
||||
{
|
||||
documentType: 'withdrawal_notice',
|
||||
label: 'Widerrufsbelehrung',
|
||||
uniformity: 'country_specific',
|
||||
description: 'EU-Verbraucherrechterichtlinie national umgesetzt. DE/AT: Muster-Widerrufsbelehrung. CH: eigene Logik.',
|
||||
},
|
||||
{
|
||||
documentType: 'cookie_banner',
|
||||
label: 'Cookie-Banner / Consent',
|
||||
uniformity: 'needs_national_supplement',
|
||||
description: 'ePrivacy + DSGVO EU-weit aehnlich, aber Aufsichtspraxis variiert (CNIL vs. DSK vs. DPC etc.).',
|
||||
},
|
||||
{ documentType: 'terms_of_service', label: 'AGB / Nutzungsbedingungen', uniformity: 'country_specific', description: 'Nationales Vertragsrecht (BGB, ABGB, OR). Verbraucherrecht teils EU-harmonisiert, aber national umgesetzt.' },
|
||||
{ documentType: 'withdrawal_notice', label: 'Widerrufsbelehrung', uniformity: 'country_specific', description: 'EU-Verbraucherrechterichtlinie national umgesetzt. DE/AT: Muster-Widerrufsbelehrung. CH: eigene Logik.' },
|
||||
{ documentType: 'cookie_banner', label: 'Cookie-Banner / Consent', uniformity: 'needs_national_supplement', description: 'ePrivacy + DSGVO EU-weit aehnlich, aber Aufsichtspraxis variiert (CNIL vs. DSK vs. DPC etc.).' },
|
||||
]
|
||||
|
||||
// =============================================================================
|
||||
@@ -533,9 +243,27 @@ export const RAG_LAYERS: RAGLayer[] = [
|
||||
]
|
||||
|
||||
// =============================================================================
|
||||
// Helper Functions
|
||||
// Re-exports from national sibling (backward compat — no consumer import changes)
|
||||
// =============================================================================
|
||||
|
||||
export {
|
||||
NATIONAL_FRAMEWORKS,
|
||||
getAllSupervisoryAuthorities,
|
||||
getSupervisoryAuthority,
|
||||
getCountrySpecificDocTypes,
|
||||
getEUUniformDocTypes,
|
||||
isGDPRCountry,
|
||||
hasSeparateLegalFramework,
|
||||
getRAGSourcesForPhase,
|
||||
getRequiredFrameworkSummary,
|
||||
} from './eu-legal-frameworks-national'
|
||||
|
||||
// =============================================================================
|
||||
// Helper Functions (EU-level)
|
||||
// =============================================================================
|
||||
|
||||
import { NATIONAL_FRAMEWORKS } from './eu-legal-frameworks-national'
|
||||
|
||||
/** Alle Rechtsgrundlagen zusammen (EU-Basis + National) */
|
||||
export function getAllFrameworks(): LegalFramework[] {
|
||||
return [...EU_BASE_FRAMEWORKS, ...NATIONAL_FRAMEWORKS]
|
||||
@@ -552,71 +280,3 @@ export function getFrameworksForCountry(country: CountryCode): LegalFramework[]
|
||||
export function getNationalFrameworks(country: CountryCode): LegalFramework[] {
|
||||
return NATIONAL_FRAMEWORKS.filter(f => f.countryCode === country)
|
||||
}
|
||||
|
||||
/** Alle Aufsichtsbehoerden */
|
||||
export function getAllSupervisoryAuthorities(): SupervisoryAuthority[] {
|
||||
const authorities: SupervisoryAuthority[] = []
|
||||
for (const fw of getAllFrameworks()) {
|
||||
if (fw.supervisoryAuthorities) {
|
||||
for (const sa of fw.supervisoryAuthorities) {
|
||||
if (!authorities.some(a => a.abbreviation === sa.abbreviation)) {
|
||||
authorities.push(sa)
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
return authorities
|
||||
}
|
||||
|
||||
/** Aufsichtsbehoerde(n) fuer ein Land */
|
||||
export function getSupervisoryAuthority(country: CountryCode): SupervisoryAuthority[] {
|
||||
return getAllSupervisoryAuthorities().filter(sa => sa.country === country)
|
||||
}
|
||||
|
||||
/** Dokumenttypen, die fuer ein Land spezifische Logik brauchen */
|
||||
export function getCountrySpecificDocTypes(country: CountryCode): DocumentTypeMatrix[] {
|
||||
return DOCUMENT_TYPE_MATRIX.filter(
|
||||
d => d.uniformity === 'country_specific' ||
|
||||
(d.uniformity === 'needs_national_supplement' && country !== 'EU')
|
||||
)
|
||||
}
|
||||
|
||||
/** Dokumenttypen, die EU-weit einheitlich generiert werden koennen */
|
||||
export function getEUUniformDocTypes(): DocumentTypeMatrix[] {
|
||||
return DOCUMENT_TYPE_MATRIX.filter(d => d.uniformity === 'eu_uniform')
|
||||
}
|
||||
|
||||
/** Pruefen ob ein Land EU/EWR-Mitglied ist (DSGVO direkt anwendbar) */
|
||||
export function isGDPRCountry(country: CountryCode): boolean {
|
||||
const gdprCountries: CountryCode[] = ['EU', 'DE', 'AT', 'FR', 'ES', 'IT', 'NL', 'NO', 'IS']
|
||||
return gdprCountries.includes(country)
|
||||
}
|
||||
|
||||
/** Pruefen ob ein Land einen separaten Rechtsrahmen hat (nicht DSGVO) */
|
||||
export function hasSeparateLegalFramework(country: CountryCode): boolean {
|
||||
return country === 'CH' || country === 'GB'
|
||||
}
|
||||
|
||||
/** RAG-Quellen fuer eine bestimmte Phase */
|
||||
export function getRAGSourcesForPhase(phase: 1 | 2 | 3): LegalFramework[] {
|
||||
return getAllFrameworks().filter(f => f.ragPhase === phase)
|
||||
}
|
||||
|
||||
/** Zusammenfassung: Was braucht ein Unternehmen in Land X? */
|
||||
export function getRequiredFrameworkSummary(country: CountryCode): {
|
||||
baseLaw: string
|
||||
nationalLaw: string | null
|
||||
supervisoryAuthority: string | null
|
||||
separateFramework: boolean
|
||||
} {
|
||||
const isGDPR = isGDPRCountry(country)
|
||||
const national = getNationalFrameworks(country)
|
||||
const authorities = getSupervisoryAuthority(country)
|
||||
|
||||
return {
|
||||
baseLaw: isGDPR ? 'DSGVO (EU 2016/679)' : (country === 'CH' ? 'revDSG (CH)' : 'UK GDPR'),
|
||||
nationalLaw: national.length > 0 ? national.map(n => n.abbreviation).join(', ') : null,
|
||||
supervisoryAuthority: authorities.length > 0 ? authorities.map(a => a.abbreviation).join(', ') : null,
|
||||
separateFramework: hasSeparateLegalFramework(country),
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user