refactor(admin-compliance): split 11 oversized files under 500 LOC hard cap (batch 2)
Barrel-split pattern: each original becomes a thin re-export barrel; logic moved to sibling files so no consumer imports need updating. Files split: - loeschfristen-profiling.ts → profiling-data.ts + profiling-generator.ts - vendor-compliance/catalog/vendor-templates.ts → vendor-country-profiles.ts - vendor-compliance/catalog/legal-basis.ts → legal-basis-retention.ts - dsfa/eu-legal-frameworks.ts → eu-legal-frameworks-national.ts - compliance-scope-types/document-scope-matrix-core.ts → core-part2.ts - compliance-scope-types/document-scope-matrix-extended.ts → extended-part2.ts - app/sdk/document-generator/contextBridge.ts → contextBridge-helpers.ts - app/api/sdk/drafting-engine/draft/route.ts → draft-helpers.ts + draft-helpers-v2.ts All files ≤ 500 LOC. Zero behavior changes. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Sharang Parnerkar
322
admin-compliance/lib/sdk/dsfa/eu-legal-frameworks-national.ts
Normal file
322
admin-compliance/lib/sdk/dsfa/eu-legal-frameworks-national.ts
Normal file
@@ -0,0 +1,322 @@
|
||||
/**
|
||||
* EU/EWR Rechtsgrundlagen — Nationale Ergaenzungsgesetze + Helpers
|
||||
*
|
||||
* Split from eu-legal-frameworks.ts for the 500 LOC hard cap.
|
||||
*/
|
||||
|
||||
import type { CountryCode, LegalDocumentType, LicenseType, LegalFramework, SupervisoryAuthority, DocumentTypeMatrix, RAGLayer, DocumentUniformity } from './eu-legal-frameworks'
|
||||
|
||||
export type { CountryCode, LegalDocumentType, LicenseType, DocumentUniformity }
|
||||
|
||||
// =============================================================================
|
||||
// Nationale Ergaenzungsgesetze (Phase 2 — modular pro Land)
|
||||
// =============================================================================
|
||||
|
||||
export const NATIONAL_FRAMEWORKS: LegalFramework[] = [
|
||||
// --- Deutschland ---
|
||||
{
|
||||
id: 'DE-BDSG',
|
||||
countryCode: 'DE',
|
||||
name: 'BDSG',
|
||||
fullName: 'Bundesdatenschutzgesetz (2018)',
|
||||
abbreviation: 'BDSG',
|
||||
type: 'national_law',
|
||||
description:
|
||||
'Nationales Begleitgesetz zur DSGVO. Ergaenzt u.a. Beschaeftigtendatenschutz (§26), ' +
|
||||
'Videoueberwachung (§4), Forschung/Statistik, Bussgeldpraxis.',
|
||||
sourceUrl: 'https://www.gesetze-im-internet.de/bdsg_2018/',
|
||||
license: 'PUBLIC_DOMAIN',
|
||||
licenseNote: 'Amtliches Werk, gemeinfrei (§5 UrhG)',
|
||||
gdprOpeningClauses: ['Art. 6 Abs. 2', 'Art. 9 Abs. 4', 'Art. 23', 'Art. 85', 'Art. 88'],
|
||||
specialProvisions: [
|
||||
'§26 BDSG — Beschaeftigtendatenschutz',
|
||||
'§4 BDSG — Videoueberwachung oeffentlich zugaenglicher Raeume',
|
||||
'§22 BDSG — Verarbeitung besonderer Kategorien',
|
||||
'§41-43 BDSG — Straf- und Bussgeldvorschriften',
|
||||
],
|
||||
supervisoryAuthorities: [
|
||||
{ name: 'Bundesbeauftragter fuer den Datenschutz', abbreviation: 'BfDI', url: 'https://www.bfdi.bund.de', country: 'DE' },
|
||||
],
|
||||
ragPhase: 2,
|
||||
},
|
||||
{
|
||||
id: 'DE-TTDSG',
|
||||
countryCode: 'DE',
|
||||
name: 'TTDSG',
|
||||
fullName: 'Telekommunikation-Telemedien-Datenschutz-Gesetz',
|
||||
abbreviation: 'TTDSG',
|
||||
type: 'national_law',
|
||||
description:
|
||||
'Deutsche Umsetzung der ePrivacy-Richtlinie. Regelt insbesondere Cookie-Consent (§25 TTDSG), ' +
|
||||
'Endgeraetezugriff und Telekommunikations-Datenschutz.',
|
||||
sourceUrl: 'https://www.gesetze-im-internet.de/ttdsg/',
|
||||
license: 'PUBLIC_DOMAIN',
|
||||
licenseNote: 'Amtliches Werk, gemeinfrei (§5 UrhG)',
|
||||
specialProvisions: [
|
||||
'§25 TTDSG — Einwilligung fuer Cookies/Tracking',
|
||||
'§26 TTDSG — Anerkannte Dienste zur Einwilligungsverwaltung',
|
||||
],
|
||||
ragPhase: 2,
|
||||
},
|
||||
{
|
||||
id: 'DE-TMG',
|
||||
countryCode: 'DE',
|
||||
name: 'TMG / DDG',
|
||||
fullName: 'Telemediengesetz / Digitale-Dienste-Gesetz',
|
||||
abbreviation: 'TMG',
|
||||
type: 'national_law',
|
||||
description:
|
||||
'Impressumspflicht (§5 TMG/DDG) und Anbieterkennzeichnung fuer Online-Dienste in Deutschland.',
|
||||
sourceUrl: 'https://www.gesetze-im-internet.de/tmg/',
|
||||
license: 'PUBLIC_DOMAIN',
|
||||
licenseNote: 'Amtliches Werk, gemeinfrei (§5 UrhG)',
|
||||
specialProvisions: [
|
||||
'§5 TMG — Impressumspflicht (Anbieterkennzeichnung)',
|
||||
'§7-10 TMG — Verantwortlichkeit von Diensteanbietern',
|
||||
],
|
||||
ragPhase: 3,
|
||||
},
|
||||
|
||||
// --- Oesterreich ---
|
||||
{
|
||||
id: 'AT-DSG',
|
||||
countryCode: 'AT',
|
||||
name: 'DSG (AT)',
|
||||
fullName: 'Datenschutzgesetz (Oesterreich, 2018)',
|
||||
abbreviation: 'DSG',
|
||||
type: 'national_law',
|
||||
description:
|
||||
'Oesterreichisches Begleitgesetz zur DSGVO. Enthält Besonderheiten fuer Behoerden, ' +
|
||||
'Strafverfolgung und teilweise andere Auslegungspraxis als Deutschland.',
|
||||
sourceUrl: 'https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10001597',
|
||||
license: 'PUBLIC_DOMAIN',
|
||||
licenseNote: 'Amtliches Werk, Rechtsinformationssystem des Bundes (RIS)',
|
||||
supervisoryAuthorities: [
|
||||
{ name: 'Oesterreichische Datenschutzbehoerde', abbreviation: 'DSB', url: 'https://www.dsb.gv.at', country: 'AT' },
|
||||
],
|
||||
ragPhase: 2,
|
||||
},
|
||||
|
||||
// --- Schweiz (NICHT EU — eigenes Recht) ---
|
||||
{
|
||||
id: 'CH-DSG',
|
||||
countryCode: 'CH',
|
||||
name: 'revDSG (CH)',
|
||||
fullName: 'Bundesgesetz ueber den Datenschutz (revidiertes DSG, seit 01.09.2023)',
|
||||
abbreviation: 'revDSG',
|
||||
type: 'national_law',
|
||||
description:
|
||||
'Die Schweiz ist nicht EU-Mitglied. Das revidierte DSG (2023) ist inhaltlich aehnlich der DSGVO, ' +
|
||||
'aber nicht identisch. Unterschiede: andere Sanktionslogik (Busse bis 250.000 CHF gegen ' +
|
||||
'natuerliche Personen), teils andere Begriffe, kein One-Stop-Shop.',
|
||||
sourceUrl: 'https://www.fedlex.admin.ch/eli/cc/2022/491/de',
|
||||
license: 'PUBLIC_DOMAIN',
|
||||
licenseNote: 'Amtliches Bundesrecht, Fedlex (Schweiz)',
|
||||
specialProvisions: [
|
||||
'Art. 60-66 revDSG — Strafbestimmungen (gegen natuerliche Personen)',
|
||||
'Art. 16-18 revDSG — Drittlandtransfer (eigene Laenderliste)',
|
||||
'Art. 22 revDSG — Datenschutz-Folgenabschaetzung',
|
||||
'Art. 12 revDSG — Verzeichnis der Bearbeitungstaetigkeiten',
|
||||
],
|
||||
supervisoryAuthorities: [
|
||||
{ name: 'Eidgenoessischer Datenschutzbeauftragter', abbreviation: 'EDOEB', url: 'https://www.edoeb.admin.ch', country: 'CH' },
|
||||
],
|
||||
ragPhase: 2,
|
||||
},
|
||||
|
||||
// --- Frankreich ---
|
||||
{
|
||||
id: 'FR-LIL',
|
||||
countryCode: 'FR',
|
||||
name: 'Loi Informatique et Libertés',
|
||||
fullName: 'Loi n° 78-17 du 6 janvier 1978 relative à l\'informatique, aux fichiers et aux libertés',
|
||||
abbreviation: 'LIL',
|
||||
type: 'national_law',
|
||||
description:
|
||||
'Franzoesisches Begleitgesetz zur DSGVO (aktualisiert 2018). Spezialregelungen u.a. ' +
|
||||
'zur Einwilligung Minderjaehriger (ab 15 Jahren), Forschungsdaten und Gesundheitsdaten.',
|
||||
sourceUrl: 'https://www.legifrance.gouv.fr/loda/id/JORFTEXT000000886460',
|
||||
license: 'PUBLIC_DOMAIN',
|
||||
licenseNote: 'Amtliches Gesetz, Légifrance (gemeinfrei)',
|
||||
supervisoryAuthorities: [
|
||||
{ name: 'Commission Nationale de l\'Informatique et des Libertés', abbreviation: 'CNIL', url: 'https://www.cnil.fr', country: 'FR' },
|
||||
],
|
||||
ragPhase: 2,
|
||||
},
|
||||
|
||||
// --- Spanien ---
|
||||
{
|
||||
id: 'ES-LOPDGDD',
|
||||
countryCode: 'ES',
|
||||
name: 'LOPDGDD',
|
||||
fullName: 'Ley Orgánica 3/2018 de Protección de Datos Personales y garantía de los derechos digitales',
|
||||
abbreviation: 'LOPDGDD',
|
||||
type: 'national_law',
|
||||
description:
|
||||
'Spanisches Datenschutzgesetz. Ergaenzt DSGVO u.a. mit Regelungen zu ' +
|
||||
'Kindereinwilligung, digitalem Testament und Rechten Verstorbener.',
|
||||
sourceUrl: 'https://www.boe.es/diario_boe/txt.php?id=BOE-A-2018-16673',
|
||||
license: 'PUBLIC_DOMAIN',
|
||||
licenseNote: 'Amtliches Gesetz, Boletín Oficial del Estado (gemeinfrei)',
|
||||
supervisoryAuthorities: [
|
||||
{ name: 'Agencia Española de Protección de Datos', abbreviation: 'AEPD', url: 'https://www.aepd.es', country: 'ES' },
|
||||
],
|
||||
ragPhase: 2,
|
||||
},
|
||||
|
||||
// --- Italien ---
|
||||
{
|
||||
id: 'IT-CODICE',
|
||||
countryCode: 'IT',
|
||||
name: 'Codice Privacy',
|
||||
fullName: 'Decreto Legislativo 30 giugno 2003, n. 196 (Codice in materia di protezione dei dati personali)',
|
||||
abbreviation: 'Codice Privacy',
|
||||
type: 'national_law',
|
||||
description:
|
||||
'Italienischer Datenschutzkodex, angepasst an die DSGVO (D.Lgs. 101/2018). ' +
|
||||
'Enthaelt Spezialregelungen fuer Gesundheitsdaten, Forschung und Journalismus.',
|
||||
sourceUrl: 'https://www.normattiva.it/uri-res/N2Ls?urn:nir:stato:decreto.legislativo:2003-06-30;196!vig=',
|
||||
license: 'PUBLIC_DOMAIN',
|
||||
licenseNote: 'Amtliches Gesetz, Normattiva (gemeinfrei)',
|
||||
supervisoryAuthorities: [
|
||||
{ name: 'Garante per la protezione dei dati personali', abbreviation: 'Garante', url: 'https://www.garanteprivacy.it', country: 'IT' },
|
||||
],
|
||||
ragPhase: 2,
|
||||
},
|
||||
|
||||
// --- Niederlande ---
|
||||
{
|
||||
id: 'NL-AVG',
|
||||
countryCode: 'NL',
|
||||
name: 'AVG / UAVG',
|
||||
fullName: 'Uitvoeringswet Algemene verordening gegevensbescherming (UAVG)',
|
||||
abbreviation: 'UAVG',
|
||||
type: 'national_law',
|
||||
description:
|
||||
'Niederlaendisches Ausfuehrungsgesetz zur DSGVO.',
|
||||
sourceUrl: 'https://wetten.overheid.nl/BWBR0040948/',
|
||||
license: 'PUBLIC_DOMAIN',
|
||||
licenseNote: 'Amtliches Gesetz, wetten.overheid.nl (gemeinfrei)',
|
||||
supervisoryAuthorities: [
|
||||
{ name: 'Autoriteit Persoonsgegevens', abbreviation: 'AP', url: 'https://www.autoriteitpersoonsgegevens.nl', country: 'NL' },
|
||||
],
|
||||
ragPhase: 2,
|
||||
},
|
||||
|
||||
// --- Grossbritannien (post-Brexit) ---
|
||||
{
|
||||
id: 'GB-DPA',
|
||||
countryCode: 'GB',
|
||||
name: 'UK DPA 2018 / UK GDPR',
|
||||
fullName: 'Data Protection Act 2018 + UK GDPR (retained EU law)',
|
||||
abbreviation: 'DPA 2018',
|
||||
type: 'national_law',
|
||||
description:
|
||||
'Nach Brexit: UK GDPR (inhaltlich weitgehend identisch mit EU-DSGVO) plus Data Protection Act 2018 ' +
|
||||
'als nationales Begleitgesetz. ICO als Aufsichtsbehoerde.',
|
||||
sourceUrl: 'https://www.legislation.gov.uk/ukpga/2018/12/contents',
|
||||
license: 'OGL-3.0',
|
||||
licenseNote: 'UK legislation, Open Government Licence v3.0',
|
||||
supervisoryAuthorities: [
|
||||
{ name: 'Information Commissioner\'s Office', abbreviation: 'ICO', url: 'https://ico.org.uk', country: 'GB' },
|
||||
],
|
||||
ragPhase: 2,
|
||||
},
|
||||
|
||||
// --- Norwegen (EWR) ---
|
||||
{
|
||||
id: 'NO-PERSONOPPL',
|
||||
countryCode: 'NO',
|
||||
name: 'Personopplysningsloven',
|
||||
fullName: 'Lov om behandling av personopplysninger (personopplysningsloven)',
|
||||
abbreviation: 'POL',
|
||||
type: 'national_law',
|
||||
description:
|
||||
'Norwegisches DSGVO-Ausfuehrungsgesetz (EWR-Mitglied, DSGVO gilt ueber EWR-Abkommen).',
|
||||
sourceUrl: 'https://lovdata.no/dokument/NL/lov/2018-06-15-38',
|
||||
license: 'PUBLIC_DOMAIN',
|
||||
licenseNote: 'Amtliches Gesetz, Lovdata (gemeinfrei)',
|
||||
supervisoryAuthorities: [
|
||||
{ name: 'Datatilsynet', abbreviation: 'DT', url: 'https://www.datatilsynet.no', country: 'NO' },
|
||||
],
|
||||
ragPhase: 2,
|
||||
},
|
||||
]
|
||||
|
||||
// =============================================================================
|
||||
// Helper Functions
|
||||
// =============================================================================
|
||||
|
||||
export function getAllSupervisoryAuthorities(
|
||||
allFrameworks: LegalFramework[]
|
||||
): SupervisoryAuthority[] {
|
||||
const authorities: SupervisoryAuthority[] = []
|
||||
for (const fw of allFrameworks) {
|
||||
if (fw.supervisoryAuthorities) {
|
||||
for (const sa of fw.supervisoryAuthorities) {
|
||||
if (!authorities.some(a => a.abbreviation === sa.abbreviation)) {
|
||||
authorities.push(sa)
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
return authorities
|
||||
}
|
||||
|
||||
export function getSupervisoryAuthority(
|
||||
country: CountryCode,
|
||||
allFrameworks: LegalFramework[]
|
||||
): SupervisoryAuthority[] {
|
||||
return getAllSupervisoryAuthorities(allFrameworks).filter(sa => sa.country === country)
|
||||
}
|
||||
|
||||
export function getCountrySpecificDocTypes(
|
||||
country: CountryCode,
|
||||
matrix: DocumentTypeMatrix[]
|
||||
): DocumentTypeMatrix[] {
|
||||
return matrix.filter(
|
||||
d => d.uniformity === 'country_specific' ||
|
||||
(d.uniformity === 'needs_national_supplement' && country !== 'EU')
|
||||
)
|
||||
}
|
||||
|
||||
export function getEUUniformDocTypes(matrix: DocumentTypeMatrix[]): DocumentTypeMatrix[] {
|
||||
return matrix.filter(d => d.uniformity === 'eu_uniform')
|
||||
}
|
||||
|
||||
export function isGDPRCountry(country: CountryCode): boolean {
|
||||
const gdprCountries: CountryCode[] = ['EU', 'DE', 'AT', 'FR', 'ES', 'IT', 'NL', 'NO', 'IS']
|
||||
return gdprCountries.includes(country)
|
||||
}
|
||||
|
||||
export function hasSeparateLegalFramework(country: CountryCode): boolean {
|
||||
return country === 'CH' || country === 'GB'
|
||||
}
|
||||
|
||||
export function getRAGSourcesForPhase(phase: 1 | 2 | 3, allFrameworks: LegalFramework[]): LegalFramework[] {
|
||||
return allFrameworks.filter(f => f.ragPhase === phase)
|
||||
}
|
||||
|
||||
export function getRequiredFrameworkSummary(
|
||||
country: CountryCode,
|
||||
allFrameworks: LegalFramework[]
|
||||
): {
|
||||
baseLaw: string
|
||||
nationalLaw: string | null
|
||||
supervisoryAuthority: string | null
|
||||
separateFramework: boolean
|
||||
} {
|
||||
const isGDPR = isGDPRCountry(country)
|
||||
const national = NATIONAL_FRAMEWORKS.filter(f => f.countryCode === country)
|
||||
const authorities = getSupervisoryAuthority(country, allFrameworks)
|
||||
|
||||
return {
|
||||
baseLaw: isGDPR ? 'DSGVO (EU 2016/679)' : (country === 'CH' ? 'revDSG (CH)' : 'UK GDPR'),
|
||||
nationalLaw: national.length > 0 ? national.map(n => n.abbreviation).join(', ') : null,
|
||||
supervisoryAuthority: authorities.length > 0 ? authorities.map(a => a.abbreviation).join(', ') : null,
|
||||
separateFramework: hasSeparateLegalFramework(country),
|
||||
}
|
||||
}
|
||||
|
||||
// Re-export RAGLayer type for barrel consumers
|
||||
export type { RAGLayer }
|
||||
Reference in New Issue
Block a user