Lab 32: Privacy Impact Assessment¶

"""
WorkSight AI -- Processing Activity Register Generator
Generates GDPR Article 30 compliant processing activity records.
All data is 100% synthetic for educational purposes.
"""

import json
from datetime import datetime, timedelta
from typing import Dict, List, Optional
from dataclasses import dataclass, field, asdict
from enum import Enum


class LegalBasis(Enum):
    """GDPR Article 6(1) legal bases for processing."""
    CONSENT = "6(1)(a) - Consent"
    CONTRACT = "6(1)(b) - Contract performance"
    LEGAL_OBLIGATION = "6(1)(c) - Legal obligation"
    VITAL_INTEREST = "6(1)(d) - Vital interests"
    PUBLIC_INTEREST = "6(1)(e) - Public interest"
    LEGITIMATE_INTEREST = "6(1)(f) - Legitimate interest"


class DataCategory(Enum):
    """Personal data categories under GDPR."""
    STANDARD = "Standard personal data"
    SPECIAL_ART9 = "Special category (Article 9)"
    CRIMINAL_ART10 = "Criminal conviction data (Article 10)"
    CHILDREN = "Children's data (Article 8)"


class SensitivityLevel(Enum):
    """Data sensitivity classification."""
    LOW = "Low"
    MEDIUM = "Medium"
    HIGH = "High"
    CRITICAL = "Critical"


@dataclass
class DataElement:
    """Individual data element within a processing activity."""
    name: str
    description: str
    category: DataCategory
    sensitivity: SensitivityLevel
    retention_days: int
    legal_basis: LegalBasis
    special_category_condition: Optional[str] = None
    pseudonymized: bool = False
    encrypted: bool = False


@dataclass
class ProcessingActivity:
    """GDPR Article 30 compliant processing activity record."""
    activity_id: str
    name: str
    purpose: str
    controller: str
    dpo_contact: str
    legal_basis: LegalBasis
    legitimate_interest_assessment: Optional[str] = None
    data_subjects: List[str] = field(default_factory=list)
    data_elements: List[DataElement] = field(default_factory=list)
    recipients: List[str] = field(default_factory=list)
    third_country_transfers: List[str] = field(default_factory=list)
    retention_period: str = ""
    security_measures: List[str] = field(default_factory=list)
    dpia_required: bool = False
    dpia_reference: Optional[str] = None
    automated_decision_making: bool = False
    profiling: bool = False
    date_created: str = field(
        default_factory=lambda: datetime.now().strftime("%Y-%m-%d")
    )
    last_reviewed: str = field(
        default_factory=lambda: datetime.now().strftime("%Y-%m-%d")
    )


def build_worksight_register() -> List[ProcessingActivity]:
    """Build the complete processing activity register for WorkSight AI."""

    activities = []

    # PA-001: Keystroke Pattern Analysis
    pa_001 = ProcessingActivity(
        activity_id="PA-001",
        name="Keystroke Pattern Analysis",
        purpose="Measure typing speed and application switching frequency "
                "to generate productivity metrics for team-level reporting",
        controller="Helios Analytics Corp, Friedrichstrasse 42, "
                   "10117 Berlin, Germany",
        dpo_contact="Dr. Elke Krause, dpo@helios-analytics.example.com",
        legal_basis=LegalBasis.LEGITIMATE_INTEREST,
        legitimate_interest_assessment=(
            "Legitimate interest: improving workforce productivity. "
            "Balanced against employee privacy rights. "
            "Works Council consulted per BetrVG Section 87(1)(6). "
            "Individual-level monitoring REJECTED as disproportionate -- "
            "only team-level aggregates permitted."
        ),
        data_subjects=["Employees (EU)", "Contractors (EU)"],
        data_elements=[
            DataElement(
                name="Keystroke timing patterns",
                description="Inter-key intervals and typing rhythm (NOT "
                            "actual keystrokes or content)",
                category=DataCategory.STANDARD,
                sensitivity=SensitivityLevel.HIGH,
                retention_days=90,
                legal_basis=LegalBasis.LEGITIMATE_INTEREST,
                pseudonymized=True,
                encrypted=True,
            ),
            DataElement(
                name="Application usage logs",
                description="Application names and window focus duration",
                category=DataCategory.STANDARD,
                sensitivity=SensitivityLevel.MEDIUM,
                retention_days=90,
                legal_basis=LegalBasis.LEGITIMATE_INTEREST,
                pseudonymized=True,
                encrypted=True,
            ),
            DataElement(
                name="Employee identifier (pseudonymized)",
                description="SHA-256 hash of employee ID, rotated monthly",
                category=DataCategory.STANDARD,
                sensitivity=SensitivityLevel.MEDIUM,
                retention_days=90,
                legal_basis=LegalBasis.LEGITIMATE_INTEREST,
                pseudonymized=True,
                encrypted=True,
            ),
        ],
        recipients=[
            "WorkSight AI Engine (internal processor)",
            "Team managers (aggregated reports only)",
            "HR Department (anonymized trend reports)",
        ],
        third_country_transfers=[],
        retention_period="90 days from collection, then irreversibly "
                         "aggregated to team-level statistics",
        security_measures=[
            "AES-256-GCM encryption at rest",
            "TLS 1.3 in transit",
            "Pseudonymization with rotating keys",
            "Role-based access control (RBAC)",
            "Audit logging of all access",
            "Network segmentation (VLAN 60)",
        ],
        dpia_required=True,
        dpia_reference="DPIA-WS-2026-001",
        automated_decision_making=False,
        profiling=True,
    )
    activities.append(pa_001)

    # PA-002: Email Metadata Analysis
    pa_002 = ProcessingActivity(
        activity_id="PA-002",
        name="Email Metadata Analysis",
        purpose="Analyze email send/receive frequency and response times "
                "to identify communication bottlenecks at team level",
        controller="Helios Analytics Corp, Friedrichstrasse 42, "
                   "10117 Berlin, Germany",
        dpo_contact="Dr. Elke Krause, dpo@helios-analytics.example.com",
        legal_basis=LegalBasis.LEGITIMATE_INTEREST,
        legitimate_interest_assessment=(
            "Legitimate interest: optimizing team communication workflows. "
            "Email CONTENT is never accessed -- metadata only. "
            "Works Council agreement obtained. "
            "Individual attribution removed before analysis."
        ),
        data_subjects=["Employees (EU)"],
        data_elements=[
            DataElement(
                name="Email send/receive timestamps",
                description="Date and time of email events (no content)",
                category=DataCategory.STANDARD,
                sensitivity=SensitivityLevel.MEDIUM,
                retention_days=60,
                legal_basis=LegalBasis.LEGITIMATE_INTEREST,
                pseudonymized=True,
                encrypted=True,
            ),
            DataElement(
                name="Response time metrics",
                description="Average reply latency per team (aggregated)",
                category=DataCategory.STANDARD,
                sensitivity=SensitivityLevel.LOW,
                retention_days=180,
                legal_basis=LegalBasis.LEGITIMATE_INTEREST,
                pseudonymized=True,
                encrypted=False,
            ),
            DataElement(
                name="Communication frequency counts",
                description="Number of emails per day per team",
                category=DataCategory.STANDARD,
                sensitivity=SensitivityLevel.LOW,
                retention_days=180,
                legal_basis=LegalBasis.LEGITIMATE_INTEREST,
                pseudonymized=True,
                encrypted=False,
            ),
        ],
        recipients=[
            "WorkSight AI Engine (internal processor)",
            "Team managers (aggregated reports only)",
        ],
        third_country_transfers=[],
        retention_period="60 days raw metadata, 180 days aggregated metrics",
        security_measures=[
            "AES-256-GCM encryption at rest for raw data",
            "TLS 1.3 in transit",
            "Pseudonymization before analysis",
            "No email content access (metadata only)",
            "Audit logging",
        ],
        dpia_required=True,
        dpia_reference="DPIA-WS-2026-001",
        automated_decision_making=False,
        profiling=True,
    )
    activities.append(pa_002)

    # PA-003: Badge Access & Physical Movement
    pa_003 = ProcessingActivity(
        activity_id="PA-003",
        name="Badge Access & Physical Movement Tracking",
        purpose="Monitor building entry/exit and floor movement patterns "
                "for space utilization analysis and security compliance",
        controller="Helios Analytics Corp, Friedrichstrasse 42, "
                   "10117 Berlin, Germany",
        dpo_contact="Dr. Elke Krause, dpo@helios-analytics.example.com",
        legal_basis=LegalBasis.LEGITIMATE_INTEREST,
        legitimate_interest_assessment=(
            "Dual basis: legitimate interest (facility management) and "
            "legal obligation (workplace safety regulations). "
            "Movement tracking limited to floor-level granularity -- "
            "no room-level or desk-level tracking permitted."
        ),
        data_subjects=["Employees (EU)", "Contractors (EU)", "Visitors"],
        data_elements=[
            DataElement(
                name="Badge swipe events",
                description="Entry/exit timestamps at building and floor "
                            "level access points",
                category=DataCategory.STANDARD,
                sensitivity=SensitivityLevel.MEDIUM,
                retention_days=365,
                legal_basis=LegalBasis.LEGITIMATE_INTEREST,
                pseudonymized=False,
                encrypted=True,
            ),
            DataElement(
                name="Floor presence duration",
                description="Time spent on each floor per day",
                category=DataCategory.STANDARD,
                sensitivity=SensitivityLevel.MEDIUM,
                retention_days=90,
                legal_basis=LegalBasis.LEGITIMATE_INTEREST,
                pseudonymized=True,
                encrypted=True,
            ),
            DataElement(
                name="Visitor badge records",
                description="Visitor name, host employee, entry/exit time",
                category=DataCategory.STANDARD,
                sensitivity=SensitivityLevel.LOW,
                retention_days=30,
                legal_basis=LegalBasis.LEGAL_OBLIGATION,
                pseudonymized=False,
                encrypted=True,
            ),
        ],
        recipients=[
            "Facilities Management",
            "Security Operations Center",
            "WorkSight AI Engine (aggregated patterns only)",
        ],
        third_country_transfers=[],
        retention_period="30-365 days depending on data element",
        security_measures=[
            "AES-256 encryption at rest",
            "TLS 1.3 in transit",
            "Physical security of badge readers",
            "Access limited to Facilities and Security teams",
            "Audit logging of all queries",
        ],
        dpia_required=True,
        dpia_reference="DPIA-WS-2026-001",
        automated_decision_making=False,
        profiling=False,
    )
    activities.append(pa_003)

    # PA-004: Screen Activity Capture
    pa_004 = ProcessingActivity(
        activity_id="PA-004",
        name="Screen Activity Capture",
        purpose="Capture blurred screen snapshots at 15-minute intervals "
                "to verify policy compliance and detect shadow IT usage",
        controller="Helios Analytics Corp, Friedrichstrasse 42, "
                   "10117 Berlin, Germany",
        dpo_contact="Dr. Elke Krause, dpo@helios-analytics.example.com",
        legal_basis=LegalBasis.LEGITIMATE_INTEREST,
        legitimate_interest_assessment=(
            "HIGH RISK: Screen captures inherently invasive. "
            "Gaussian blur (sigma=15) applied at capture time. "
            "Only application window titles are extracted in cleartext. "
            "Original unblurred images are NEVER stored. "
            "Works Council has CONDITIONAL approval pending DPIA outcome."
        ),
        data_subjects=["Employees (EU)"],
        data_elements=[
            DataElement(
                name="Blurred screen snapshots",
                description="15-minute interval screenshots with Gaussian "
                            "blur applied at capture -- content unreadable",
                category=DataCategory.STANDARD,
                sensitivity=SensitivityLevel.CRITICAL,
                retention_days=7,
                legal_basis=LegalBasis.LEGITIMATE_INTEREST,
                pseudonymized=True,
                encrypted=True,
            ),
            DataElement(
                name="Active window titles",
                description="Application name and window title text",
                category=DataCategory.STANDARD,
                sensitivity=SensitivityLevel.HIGH,
                retention_days=30,
                legal_basis=LegalBasis.LEGITIMATE_INTEREST,
                pseudonymized=True,
                encrypted=True,
            ),
        ],
        recipients=[
            "WorkSight AI Engine (automated classification only)",
            "Security team (only on policy violation alert)",
        ],
        third_country_transfers=[],
        retention_period="7 days snapshots, 30 days window titles",
        security_measures=[
            "Blur applied at capture (irreversible)",
            "AES-256-GCM encryption at rest",
            "TLS 1.3 in transit",
            "Strict RBAC -- security team only",
            "No bulk export capability",
            "Audit logging with tamper detection",
        ],
        dpia_required=True,
        dpia_reference="DPIA-WS-2026-001",
        automated_decision_making=True,
        profiling=True,
    )
    activities.append(pa_004)

    # PA-005: AI Productivity Scoring
    pa_005 = ProcessingActivity(
        activity_id="PA-005",
        name="AI Productivity Scoring",
        purpose="Generate team-level productivity scores using ML models "
                "trained on aggregated behavioral data from PA-001 through "
                "PA-004 to identify workflow optimization opportunities",
        controller="Helios Analytics Corp, Friedrichstrasse 42, "
                   "10117 Berlin, Germany",
        dpo_contact="Dr. Elke Krause, dpo@helios-analytics.example.com",
        legal_basis=LegalBasis.LEGITIMATE_INTEREST,
        legitimate_interest_assessment=(
            "CRITICAL RISK: ML-based scoring of employees. "
            "Individual scores PROHIBITED -- team-level only. "
            "No automated decisions affecting employment. "
            "Human review required for any management action. "
            "Bias audit conducted quarterly. "
            "Works Council has RIGHT TO OBJECT at any time."
        ),
        data_subjects=["Employees (EU)"],
        data_elements=[
            DataElement(
                name="Team productivity score",
                description="ML-generated 0-100 score per team per week",
                category=DataCategory.STANDARD,
                sensitivity=SensitivityLevel.HIGH,
                retention_days=180,
                legal_basis=LegalBasis.LEGITIMATE_INTEREST,
                pseudonymized=True,
                encrypted=True,
            ),
            DataElement(
                name="ML model features (aggregated)",
                description="Aggregated input features used for scoring -- "
                            "no individual-level data retained",
                category=DataCategory.STANDARD,
                sensitivity=SensitivityLevel.MEDIUM,
                retention_days=90,
                legal_basis=LegalBasis.LEGITIMATE_INTEREST,
                pseudonymized=True,
                encrypted=True,
            ),
            DataElement(
                name="Model bias audit results",
                description="Quarterly bias assessment across protected "
                            "characteristics (gender, age, nationality)",
                category=DataCategory.SPECIAL_ART9,
                sensitivity=SensitivityLevel.CRITICAL,
                retention_days=730,
                legal_basis=LegalBasis.LEGAL_OBLIGATION,
                special_category_condition="Article 9(2)(b) -- employment "
                                           "law obligation (bias monitoring)",
                pseudonymized=True,
                encrypted=True,
            ),
        ],
        recipients=[
            "Team managers (scores only, no underlying data)",
            "HR Department (trend analysis)",
            "Works Council (quarterly summary)",
        ],
        third_country_transfers=[],
        retention_period="90-730 days depending on element",
        security_measures=[
            "Model explainability (SHAP values)",
            "Quarterly bias audits",
            "No individual scoring",
            "Human-in-the-loop for any action",
            "AES-256-GCM encryption",
            "Strict RBAC",
        ],
        dpia_required=True,
        dpia_reference="DPIA-WS-2026-001",
        automated_decision_making=True,
        profiling=True,
    )
    activities.append(pa_005)

    return activities


def generate_register_report(activities: List[ProcessingActivity]) -> str:
    """Generate a human-readable processing activity report."""
    lines = []
    lines.append("=" * 72)
    lines.append("PROCESSING ACTIVITY REGISTER -- WorkSight AI")
    lines.append(f"Generated: {datetime.now().strftime('%Y-%m-%d %H:%M:%S')}")
    lines.append(f"Controller: Helios Analytics Corp")
    lines.append(f"DPO: Dr. Elke Krause (dpo@helios-analytics.example.com)")
    lines.append(f"Total Activities: {len(activities)}")
    lines.append("=" * 72)

    for pa in activities:
        lines.append("")
        lines.append("-" * 72)
        lines.append(f"[{pa.activity_id}] {pa.name}")
        lines.append("-" * 72)
        lines.append(f"  Purpose:      {pa.purpose}")
        lines.append(f"  Legal Basis:  {pa.legal_basis.value}")
        if pa.legitimate_interest_assessment:
            lines.append(f"  LIA:          {pa.legitimate_interest_assessment}")
        lines.append(f"  Subjects:     {', '.join(pa.data_subjects)}")
        lines.append(f"  Retention:    {pa.retention_period}")
        lines.append(f"  DPIA Req:     {'YES' if pa.dpia_required else 'No'}")
        lines.append(f"  Profiling:    {'YES' if pa.profiling else 'No'}")
        lines.append(f"  Auto-Decision:{' YES' if pa.automated_decision_making else ' No'}")
        lines.append(f"  Transfers:    {', '.join(pa.third_country_transfers) or 'None'}")
        lines.append(f"  Data Elements:")
        for de in pa.data_elements:
            lines.append(f"    - {de.name}")
            lines.append(f"      Category:    {de.category.value}")
            lines.append(f"      Sensitivity: {de.sensitivity.value}")
            lines.append(f"      Retention:   {de.retention_days} days")
            lines.append(f"      Pseudonym:   {'Yes' if de.pseudonymized else 'No'}")
            lines.append(f"      Encrypted:   {'Yes' if de.encrypted else 'No'}")
            if de.special_category_condition:
                lines.append(f"      Art 9 Cond:  {de.special_category_condition}")
        lines.append(f"  Recipients:")
        for r in pa.recipients:
            lines.append(f"    - {r}")
        lines.append(f"  Security Measures:")
        for sm in pa.security_measures:
            lines.append(f"    - {sm}")

    lines.append("")
    lines.append("=" * 72)
    lines.append("END OF REGISTER")
    lines.append("=" * 72)
    return "\n".join(lines)


if __name__ == "__main__":
    activities = build_worksight_register()
    report = generate_register_report(activities)
    print(report)

    # Export as JSON for downstream tools
    json_export = json.dumps(
        [
            {
                "activity_id": a.activity_id,
                "name": a.name,
                "purpose": a.purpose,
                "legal_basis": a.legal_basis.value,
                "data_subjects": a.data_subjects,
                "dpia_required": a.dpia_required,
                "profiling": a.profiling,
                "automated_decision_making": a.automated_decision_making,
                "data_elements": [
                    {
                        "name": d.name,
                        "category": d.category.value,
                        "sensitivity": d.sensitivity.value,
                        "retention_days": d.retention_days,
                        "pseudonymized": d.pseudonymized,
                        "encrypted": d.encrypted,
                    }
                    for d in a.data_elements
                ],
            }
            for a in activities
        ],
        indent=2,
    )
    with open("processing_activities.json", "w") as f:
        f.write(json_export)
    print(f"\nJSON export written to processing_activities.json")

"""
Legal Basis Analysis for WorkSight AI Processing Activities.
Evaluates GDPR Article 6(1) conditions for each activity.
"""

from dataclasses import dataclass
from typing import List, Optional


@dataclass
class LegalBasisAnalysis:
    """Structured legal basis evaluation."""
    activity_id: str
    activity_name: str
    proposed_basis: str
    lia_purpose: Optional[str] = None
    lia_necessity: Optional[str] = None
    lia_balancing: Optional[str] = None
    lia_safeguards: Optional[str] = None
    lia_conclusion: Optional[str] = None
    consent_feasibility: Optional[str] = None
    alternative_bases_considered: List[str] = None
    dpo_recommendation: str = ""
    risk_level: str = ""


def analyze_legal_bases() -> List[LegalBasisAnalysis]:
    """Perform legal basis analysis for all WorkSight activities."""

    analyses = []

    # PA-001: Keystroke Pattern Analysis
    analyses.append(LegalBasisAnalysis(
        activity_id="PA-001",
        activity_name="Keystroke Pattern Analysis",
        proposed_basis="Article 6(1)(f) -- Legitimate interest",
        lia_purpose=(
            "Helios has a legitimate interest in understanding team "
            "productivity patterns to optimize workflows and resource "
            "allocation. This is a genuine business need supported by "
            "the organization's operational objectives."
        ),
        lia_necessity=(
            "Keystroke timing patterns (NOT content) are necessary to "
            "measure active work time vs idle time at team level. "
            "Less invasive alternatives (self-reporting, project tracking) "
            "were evaluated but produce unreliable data."
        ),
        lia_balancing=(
            "AGAINST: Employees have reasonable expectation of privacy "
            "at workstations. Keystroke monitoring is inherently invasive. "
            "FOR: Only timing patterns collected (no content). Data "
            "pseudonymized immediately. Only team-level aggregates used. "
            "No individual performance decisions based on this data. "
            "Works Council consulted and conditionally approved."
        ),
        lia_safeguards=(
            "1. Pseudonymization at collection point. "
            "2. Aggregation to team level before any reporting. "
            "3. 90-day retention with automatic deletion. "
            "4. Works Council oversight with veto power. "
            "5. Employee right to object (Article 21). "
            "6. Quarterly proportionality reviews."
        ),
        lia_conclusion=(
            "CONDITIONALLY ACCEPTABLE. Legitimate interest applies IF "
            "all safeguards are implemented and maintained. The balancing "
            "test favors the controller only because of the extensive "
            "safeguards in place."
        ),
        consent_feasibility=(
            "Consent REJECTED as legal basis: employment relationship "
            "creates power imbalance (WP29 Guidelines, EDPB Opinion). "
            "Consent cannot be freely given in employer-employee context "
            "for monitoring activities."
        ),
        alternative_bases_considered=[
            "Consent -- rejected (power imbalance)",
            "Contract -- rejected (not necessary for employment contract)",
            "Legal obligation -- partially applicable for security only",
        ],
        dpo_recommendation=(
            "PROCEED WITH CAUTION. Implement all safeguards before "
            "going live. Schedule 90-day review with Works Council."
        ),
        risk_level="HIGH",
    ))

    # PA-004: Screen Activity Capture
    analyses.append(LegalBasisAnalysis(
        activity_id="PA-004",
        activity_name="Screen Activity Capture",
        proposed_basis="Article 6(1)(f) -- Legitimate interest",
        lia_purpose=(
            "Helios claims legitimate interest in detecting shadow IT "
            "and verifying compliance with acceptable use policies."
        ),
        lia_necessity=(
            "Screen captures -- even blurred -- represent the MOST "
            "invasive monitoring method proposed. Alternative methods "
            "exist: application allow-listing, network traffic analysis, "
            "endpoint detection tools. These are LESS invasive and "
            "achieve the same purpose."
        ),
        lia_balancing=(
            "AGAINST: Screen capture is extremely invasive. Even blurred, "
            "it captures the visual context of employee work. Window "
            "titles may reveal sensitive personal activities (medical "
            "searches, union activity, personal communications). "
            "FOR: Gaussian blur prevents content reading. Only titles "
            "extracted. Very short retention (7 days). "
            "CONCLUSION: Balance tips AGAINST the controller."
        ),
        lia_safeguards=(
            "Even with maximum safeguards, screen capture is "
            "disproportionate when less invasive alternatives exist."
        ),
        lia_conclusion=(
            "REJECTED. Screen capture fails the necessity test under "
            "Article 5(1)(c) data minimization. Less invasive "
            "alternatives (application inventory via endpoint agent, "
            "network traffic analysis) achieve the same purpose. "
            "DPO recommends REMOVING this processing activity."
        ),
        consent_feasibility=(
            "Consent rejected for same reasons as PA-001."
        ),
        alternative_bases_considered=[
            "Consent -- rejected (power imbalance)",
            "Contract -- rejected",
            "Legitimate interest -- FAILS balancing test",
        ],
        dpo_recommendation=(
            "REJECT THIS ACTIVITY. Replace with endpoint-based "
            "application inventory that collects installed software "
            "list only -- no screen capture of any kind."
        ),
        risk_level="CRITICAL -- RECOMMENDED REJECTION",
    ))

    # PA-005: AI Productivity Scoring
    analyses.append(LegalBasisAnalysis(
        activity_id="PA-005",
        activity_name="AI Productivity Scoring",
        proposed_basis="Article 6(1)(f) -- Legitimate interest",
        lia_purpose=(
            "Helios claims legitimate interest in using ML to identify "
            "workflow optimization opportunities at team level."
        ),
        lia_necessity=(
            "ML scoring provides pattern recognition beyond manual "
            "analysis. However, the GDPR imposes strict requirements "
            "on automated decision-making (Article 22). While this is "
            "team-level scoring with no individual decisions, the "
            "inputs are derived from individual behavior data."
        ),
        lia_balancing=(
            "AGAINST: ML scoring of employee behavior carries inherent "
            "risks of bias, function creep, and chilling effects. Even "
            "team-level scores may indirectly identify individuals in "
            "small teams (<5 members). "
            "FOR: Team-level only, human-in-the-loop, quarterly bias "
            "audits, Works Council oversight, no employment decisions."
        ),
        lia_safeguards=(
            "1. Minimum team size of 10 for scoring (prevents re-identification). "
            "2. SHAP values for model explainability. "
            "3. Quarterly bias audits across protected characteristics. "
            "4. Human review required before any management action. "
            "5. Works Council right to suspend scoring. "
            "6. Annual external audit of ML model."
        ),
        lia_conclusion=(
            "CONDITIONALLY ACCEPTABLE with minimum team size of 10 "
            "and all safeguards implemented. Must implement Article 22 "
            "safeguards even though team-level scoring may not trigger "
            "Article 22 directly -- precautionary approach."
        ),
        consent_feasibility="Consent rejected (power imbalance).",
        alternative_bases_considered=[
            "Consent -- rejected (power imbalance)",
            "Contract -- rejected",
        ],
        dpo_recommendation=(
            "PROCEED WITH STRICT CONDITIONS. Minimum team size 10. "
            "No individual scores under any circumstances. "
            "External bias audit within 6 months of launch."
        ),
        risk_level="HIGH",
    ))

    return analyses


def print_legal_analysis(analyses: List[LegalBasisAnalysis]) -> None:
    """Print formatted legal basis analysis."""
    for a in analyses:
        print(f"\n{'=' * 60}")
        print(f"LEGAL BASIS ANALYSIS: {a.activity_id} -- {a.activity_name}")
        print(f"{'=' * 60}")
        print(f"Proposed Basis: {a.proposed_basis}")
        print(f"Risk Level:     {a.risk_level}")
        print(f"\nLIA Purpose:    {a.lia_purpose}")
        print(f"\nLIA Necessity:  {a.lia_necessity}")
        print(f"\nLIA Balancing:  {a.lia_balancing}")
        print(f"\nLIA Safeguards: {a.lia_safeguards}")
        print(f"\nLIA Conclusion: {a.lia_conclusion}")
        print(f"\nConsent:        {a.consent_feasibility}")
        print(f"\nDPO Recomm.:    {a.dpo_recommendation}")
        print(f"{'=' * 60}")


if __name__ == "__main__":
    analyses = analyze_legal_bases()
    print_legal_analysis(analyses)

"""
Data Inventory & Classification Engine for WorkSight AI DPIA.
Identifies, classifies, and maps all personal data elements.
All data is 100% synthetic for educational purposes.
"""

import json
from dataclasses import dataclass, field
from typing import List, Dict, Optional, Tuple
from enum import Enum
from datetime import datetime


class GDPRCategory(Enum):
    """GDPR data categories."""
    STANDARD = "Standard personal data (Art. 6)"
    SPECIAL_HEALTH = "Health data (Art. 9(1))"
    SPECIAL_BIOMETRIC = "Biometric data (Art. 9(1))"
    SPECIAL_POLITICAL = "Political opinions (Art. 9(1))"
    SPECIAL_UNION = "Trade union membership (Art. 9(1))"
    SPECIAL_ETHNIC = "Racial/ethnic origin (Art. 9(1))"
    SPECIAL_RELIGIOUS = "Religious beliefs (Art. 9(1))"
    SPECIAL_SEXUAL = "Sexual orientation (Art. 9(1))"
    SPECIAL_GENETIC = "Genetic data (Art. 9(1))"
    CRIMINAL = "Criminal conviction data (Art. 10)"
    CHILDREN = "Children's data (Art. 8)"


class DataLifecyclePhase(Enum):
    """Data lifecycle phases."""
    COLLECTION = "Collection"
    TRANSMISSION = "Transmission"
    PROCESSING = "Processing"
    STORAGE = "Storage"
    USAGE = "Usage/Access"
    SHARING = "Sharing/Disclosure"
    ARCHIVAL = "Archival"
    DELETION = "Deletion"


class RiskIndicator(Enum):
    """Privacy risk indicators for data elements."""
    HIGH_VOLUME = "High volume (>1000 records/day)"
    SENSITIVE_CONTEXT = "Sensitive context (employment)"
    BEHAVIORAL = "Behavioral tracking"
    PROFILING = "Used for profiling"
    AUTOMATED = "Automated processing"
    VULNERABLE_SUBJECTS = "Vulnerable data subjects"
    CROSS_REFERENCE = "Cross-referenceable"
    BIOMETRIC_ADJACENT = "Biometric-adjacent data"


@dataclass
class DataInventoryItem:
    """Single data element in the inventory."""
    element_id: str
    name: str
    description: str
    source_system: str
    source_ip: str
    gdpr_category: GDPRCategory
    sensitivity_score: int  # 1-10
    volume_per_day: int
    retention_days: int
    lifecycle_phases: List[DataLifecyclePhase]
    risk_indicators: List[RiskIndicator]
    pseudonymized: bool
    encrypted_at_rest: bool
    encrypted_in_transit: bool
    access_roles: List[str]
    deletion_method: str
    legal_basis: str
    cross_border_transfer: bool = False
    third_party_access: bool = False
    automated_decision: bool = False
    notes: str = ""


def build_data_inventory() -> List[DataInventoryItem]:
    """Build complete data inventory for WorkSight AI."""

    inventory = []

    # Keystroke timing data
    inventory.append(DataInventoryItem(
        element_id="DI-001",
        name="Keystroke timing intervals",
        description="Time between successive keystrokes in milliseconds. "
                    "Does NOT capture actual key values or text content. "
                    "Used for typing pattern analysis only.",
        source_system="WorkSight Endpoint Agent",
        source_ip="10.60.2.0/24 (employee workstations)",
        gdpr_category=GDPRCategory.STANDARD,
        sensitivity_score=7,
        volume_per_day=2400000,  # ~1000 per employee per day
        retention_days=90,
        lifecycle_phases=[
            DataLifecyclePhase.COLLECTION,
            DataLifecyclePhase.TRANSMISSION,
            DataLifecyclePhase.PROCESSING,
            DataLifecyclePhase.STORAGE,
            DataLifecyclePhase.DELETION,
        ],
        risk_indicators=[
            RiskIndicator.HIGH_VOLUME,
            RiskIndicator.BEHAVIORAL,
            RiskIndicator.BIOMETRIC_ADJACENT,
            RiskIndicator.SENSITIVE_CONTEXT,
        ],
        pseudonymized=True,
        encrypted_at_rest=True,
        encrypted_in_transit=True,
        access_roles=["privacy-engineer", "ml-engineer"],
        deletion_method="Cryptographic erasure (key destruction)",
        legal_basis="Article 6(1)(f) -- Legitimate interest",
        notes="CRITICAL: Keystroke TIMING may constitute biometric data "
              "under GDPR Art 9(1) if used for identification. Current "
              "use (productivity patterns) is NOT identification, but "
              "this must be continuously monitored for function creep.",
    ))

    # Application usage data
    inventory.append(DataInventoryItem(
        element_id="DI-002",
        name="Application focus duration",
        description="Application name and time spent with that application "
                    "in foreground focus, measured in seconds.",
        source_system="WorkSight Endpoint Agent",
        source_ip="10.60.2.0/24 (employee workstations)",
        gdpr_category=GDPRCategory.STANDARD,
        sensitivity_score=6,
        volume_per_day=48000,  # ~20 per employee per day
        retention_days=90,
        lifecycle_phases=[
            DataLifecyclePhase.COLLECTION,
            DataLifecyclePhase.TRANSMISSION,
            DataLifecyclePhase.PROCESSING,
            DataLifecyclePhase.STORAGE,
            DataLifecyclePhase.USAGE,
            DataLifecyclePhase.DELETION,
        ],
        risk_indicators=[
            RiskIndicator.BEHAVIORAL,
            RiskIndicator.PROFILING,
            RiskIndicator.SENSITIVE_CONTEXT,
        ],
        pseudonymized=True,
        encrypted_at_rest=True,
        encrypted_in_transit=True,
        access_roles=["privacy-engineer", "ml-engineer", "team-manager"],
        deletion_method="Secure overwrite (3-pass)",
        legal_basis="Article 6(1)(f) -- Legitimate interest",
        notes="Application names may reveal sensitive information "
              "(e.g., health apps, union communication tools). "
              "Implement category-based filtering to exclude sensitive "
              "application categories.",
    ))

    # Email metadata
    inventory.append(DataInventoryItem(
        element_id="DI-003",
        name="Email metadata",
        description="Email send/receive timestamps, sender/recipient "
                    "pseudonymized IDs, message size. NO email content, "
                    "subject lines, or attachments.",
        source_system="Email Gateway",
        source_ip="10.60.1.130 (mail-gw.internal.example.com)",
        gdpr_category=GDPRCategory.STANDARD,
        sensitivity_score=5,
        volume_per_day=72000,  # ~30 per employee per day
        retention_days=60,
        lifecycle_phases=[
            DataLifecyclePhase.COLLECTION,
            DataLifecyclePhase.TRANSMISSION,
            DataLifecyclePhase.PROCESSING,
            DataLifecyclePhase.STORAGE,
            DataLifecyclePhase.USAGE,
            DataLifecyclePhase.DELETION,
        ],
        risk_indicators=[
            RiskIndicator.HIGH_VOLUME,
            RiskIndicator.BEHAVIORAL,
            RiskIndicator.CROSS_REFERENCE,
        ],
        pseudonymized=True,
        encrypted_at_rest=True,
        encrypted_in_transit=True,
        access_roles=["privacy-engineer"],
        deletion_method="Cryptographic erasure",
        legal_basis="Article 6(1)(f) -- Legitimate interest",
    ))

    # Badge access data
    inventory.append(DataInventoryItem(
        element_id="DI-004",
        name="Badge swipe events",
        description="Employee badge ID, reader location (building/floor), "
                    "timestamp, access granted/denied status.",
        source_system="Badge Access Controller",
        source_ip="10.60.1.120 (badge-ctrl.internal.example.com)",
        gdpr_category=GDPRCategory.STANDARD,
        sensitivity_score=5,
        volume_per_day=12000,  # ~5 per employee per day
        retention_days=365,
        lifecycle_phases=[
            DataLifecyclePhase.COLLECTION,
            DataLifecyclePhase.TRANSMISSION,
            DataLifecyclePhase.PROCESSING,
            DataLifecyclePhase.STORAGE,
            DataLifecyclePhase.USAGE,
            DataLifecyclePhase.SHARING,
            DataLifecyclePhase.DELETION,
        ],
        risk_indicators=[
            RiskIndicator.BEHAVIORAL,
            RiskIndicator.CROSS_REFERENCE,
        ],
        pseudonymized=False,  # badge ID is direct identifier
        encrypted_at_rest=True,
        encrypted_in_transit=True,
        access_roles=[
            "facilities-manager", "security-team", "privacy-engineer"
        ],
        deletion_method="Secure overwrite after retention expiry",
        legal_basis="Article 6(1)(f) -- Legitimate interest + "
                    "Article 6(1)(c) -- Legal obligation (safety)",
    ))

    # Screen capture data (flagged for rejection)
    inventory.append(DataInventoryItem(
        element_id="DI-005",
        name="Blurred screen snapshots",
        description="Screen captures with Gaussian blur (sigma=15) "
                    "applied at capture time. Content unreadable. "
                    "Captured every 15 minutes during active sessions.",
        source_system="WorkSight Screen Agent",
        source_ip="10.60.2.0/24 (employee workstations)",
        gdpr_category=GDPRCategory.STANDARD,
        sensitivity_score=9,
        volume_per_day=38400,  # ~16 per employee per 8-hour day
        retention_days=7,
        lifecycle_phases=[
            DataLifecyclePhase.COLLECTION,
            DataLifecyclePhase.TRANSMISSION,
            DataLifecyclePhase.PROCESSING,
            DataLifecyclePhase.STORAGE,
            DataLifecyclePhase.DELETION,
        ],
        risk_indicators=[
            RiskIndicator.HIGH_VOLUME,
            RiskIndicator.BEHAVIORAL,
            RiskIndicator.SENSITIVE_CONTEXT,
            RiskIndicator.AUTOMATED,
        ],
        pseudonymized=True,
        encrypted_at_rest=True,
        encrypted_in_transit=True,
        access_roles=["security-team"],
        deletion_method="Secure overwrite (7-pass DOD standard)",
        legal_basis="Article 6(1)(f) -- Legitimate interest (REJECTED BY DPO)",
        notes="DPO RECOMMENDATION: REJECT. Disproportionate. Replace with "
              "endpoint application inventory.",
    ))

    # Window title data (associated with screen capture)
    inventory.append(DataInventoryItem(
        element_id="DI-006",
        name="Active window titles",
        description="Text content of the active window title bar, "
                    "captured alongside screen snapshots.",
        source_system="WorkSight Screen Agent",
        source_ip="10.60.2.0/24 (employee workstations)",
        gdpr_category=GDPRCategory.STANDARD,
        sensitivity_score=8,
        volume_per_day=38400,
        retention_days=30,
        lifecycle_phases=[
            DataLifecyclePhase.COLLECTION,
            DataLifecyclePhase.TRANSMISSION,
            DataLifecyclePhase.PROCESSING,
            DataLifecyclePhase.STORAGE,
            DataLifecyclePhase.DELETION,
        ],
        risk_indicators=[
            RiskIndicator.BEHAVIORAL,
            RiskIndicator.SENSITIVE_CONTEXT,
            RiskIndicator.CROSS_REFERENCE,
        ],
        pseudonymized=True,
        encrypted_at_rest=True,
        encrypted_in_transit=True,
        access_roles=["security-team"],
        deletion_method="Cryptographic erasure",
        legal_basis="Article 6(1)(f) -- Legitimate interest (REJECTED BY DPO)",
        notes="Window titles may reveal: medical conditions (health app "
              "titles), union membership (union portal titles), political "
              "views (news site titles), personal relationships (messaging "
              "app titles). This is SPECIAL CATEGORY data by inference.",
    ))

    # ML productivity scores
    inventory.append(DataInventoryItem(
        element_id="DI-007",
        name="Team productivity scores",
        description="ML-generated productivity score (0-100) calculated "
                    "per team per week. No individual scores.",
        source_system="WorkSight AI Engine",
        source_ip="10.60.1.110 (worksight-ai.internal.example.com)",
        gdpr_category=GDPRCategory.STANDARD,
        sensitivity_score=6,
        volume_per_day=34,  # ~34 teams, once per week
        retention_days=180,
        lifecycle_phases=[
            DataLifecyclePhase.PROCESSING,
            DataLifecyclePhase.STORAGE,
            DataLifecyclePhase.USAGE,
            DataLifecyclePhase.SHARING,
            DataLifecyclePhase.DELETION,
        ],
        risk_indicators=[
            RiskIndicator.PROFILING,
            RiskIndicator.AUTOMATED,
        ],
        pseudonymized=True,
        encrypted_at_rest=True,
        encrypted_in_transit=True,
        access_roles=["team-manager", "hr-director", "works-council"],
        deletion_method="Secure overwrite",
        legal_basis="Article 6(1)(f) -- Legitimate interest",
        notes="Minimum team size of 10 required to prevent "
              "re-identification of individuals.",
    ))

    # Bias audit data
    inventory.append(DataInventoryItem(
        element_id="DI-008",
        name="ML bias audit results",
        description="Quarterly bias assessment results measuring model "
                    "performance variance across protected characteristics.",
        source_system="WorkSight AI Engine",
        source_ip="10.60.1.110 (worksight-ai.internal.example.com)",
        gdpr_category=GDPRCategory.SPECIAL_ETHNIC,
        sensitivity_score=10,
        volume_per_day=1,  # Quarterly
        retention_days=730,
        lifecycle_phases=[
            DataLifecyclePhase.PROCESSING,
            DataLifecyclePhase.STORAGE,
            DataLifecyclePhase.USAGE,
            DataLifecyclePhase.ARCHIVAL,
        ],
        risk_indicators=[
            RiskIndicator.SENSITIVE_CONTEXT,
            RiskIndicator.VULNERABLE_SUBJECTS,
        ],
        pseudonymized=True,
        encrypted_at_rest=True,
        encrypted_in_transit=True,
        access_roles=["dpo", "external-auditor"],
        deletion_method="Cryptographic erasure with audit trail",
        legal_basis="Article 9(2)(b) -- Employment law obligation",
        notes="Contains aggregated statistics across protected "
              "characteristics. Individual-level data NEVER stored. "
              "Access restricted to DPO and external auditor only.",
    ))

    return inventory


def classify_inventory(inventory: List[DataInventoryItem]) -> Dict:
    """Classify inventory by sensitivity and category."""
    classification = {
        "total_elements": len(inventory),
        "by_category": {},
        "by_sensitivity": {
            "critical": [],
            "high": [],
            "medium": [],
            "low": [],
        },
        "risk_summary": {},
        "rejected_elements": [],
        "special_category_elements": [],
    }

    for item in inventory:
        # Categorize
        cat = item.gdpr_category.value
        if cat not in classification["by_category"]:
            classification["by_category"][cat] = []
        classification["by_category"][cat].append(item.element_id)

        # Sensitivity classification
        if item.sensitivity_score >= 9:
            classification["by_sensitivity"]["critical"].append(
                item.element_id
            )
        elif item.sensitivity_score >= 7:
            classification["by_sensitivity"]["high"].append(item.element_id)
        elif item.sensitivity_score >= 4:
            classification["by_sensitivity"]["medium"].append(item.element_id)
        else:
            classification["by_sensitivity"]["low"].append(item.element_id)

        # Track risk indicators
        for ri in item.risk_indicators:
            ri_name = ri.value
            if ri_name not in classification["risk_summary"]:
                classification["risk_summary"][ri_name] = []
            classification["risk_summary"][ri_name].append(item.element_id)

        # Track rejected elements
        if "REJECTED" in item.legal_basis:
            classification["rejected_elements"].append(item.element_id)

        # Track special category
        if item.gdpr_category != GDPRCategory.STANDARD:
            classification["special_category_elements"].append(
                item.element_id
            )

    return classification


def print_classification_report(
    inventory: List[DataInventoryItem],
    classification: Dict,
) -> None:
    """Print classification report."""
    print("=" * 60)
    print("DATA INVENTORY CLASSIFICATION REPORT")
    print(f"Generated: {datetime.now().strftime('%Y-%m-%d %H:%M:%S')}")
    print(f"Total Data Elements: {classification['total_elements']}")
    print("=" * 60)

    print("\n--- Sensitivity Distribution ---")
    for level, items in classification["by_sensitivity"].items():
        print(f"  {level.upper():10s}: {len(items)} elements -- {items}")

    print("\n--- GDPR Category Distribution ---")
    for cat, items in classification["by_category"].items():
        print(f"  {cat}: {items}")

    print("\n--- Risk Indicator Coverage ---")
    for ri, items in classification["risk_summary"].items():
        print(f"  {ri}: {len(items)} elements")

    if classification["rejected_elements"]:
        print(f"\n--- REJECTED Elements ---")
        for eid in classification["rejected_elements"]:
            item = next(i for i in inventory if i.element_id == eid)
            print(f"  {eid}: {item.name}")
            print(f"    Reason: {item.notes}")

    if classification["special_category_elements"]:
        print(f"\n--- Special Category (Art. 9) Elements ---")
        for eid in classification["special_category_elements"]:
            item = next(i for i in inventory if i.element_id == eid)
            print(f"  {eid}: {item.name} -- {item.gdpr_category.value}")


if __name__ == "__main__":
    inventory = build_data_inventory()
    classification = classify_inventory(inventory)
    print_classification_report(inventory, classification)

"""
Automated PII Discovery Scanner for DPIA.
Scans synthetic datasets for personally identifiable information.
All data is 100% synthetic -- no real personal data.
"""

import re
import json
from dataclasses import dataclass
from typing import List, Dict, Tuple, Optional
from enum import Enum


class PIIType(Enum):
    """Types of personally identifiable information."""
    EMAIL = "Email Address"
    PHONE = "Phone Number"
    NAME = "Person Name"
    ADDRESS = "Physical Address"
    SSN = "Social Security / National ID"
    CREDIT_CARD = "Credit Card Number"
    IP_ADDRESS = "IP Address"
    DATE_OF_BIRTH = "Date of Birth"
    EMPLOYEE_ID = "Employee Identifier"
    IBAN = "Bank Account (IBAN)"
    PASSPORT = "Passport Number"
    HEALTH_DATA = "Health Information"
    BIOMETRIC = "Biometric Data"
    LOCATION = "Location Data"
    DEVICE_ID = "Device Identifier"


@dataclass
class PIIFinding:
    """A single PII discovery finding."""
    finding_id: str
    pii_type: PIIType
    field_name: str
    source_file: str
    sample_value: str  # redacted/masked
    confidence: float  # 0.0 to 1.0
    in_inventory: bool
    remediation: str


# PII detection patterns (simplified for educational purposes)
PII_PATTERNS = {
    PIIType.EMAIL: re.compile(
        r'\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b'
    ),
    PIIType.PHONE: re.compile(
        r'\b(?:\+\d{1,3}[-.\s]?)?\(?\d{3}\)?[-.\s]?\d{3}[-.\s]?\d{4}\b'
    ),
    PIIType.SSN: re.compile(
        r'\b\d{3}-\d{2}-\d{4}\b'
    ),
    PIIType.CREDIT_CARD: re.compile(
        r'\b(?:\d{4}[-\s]?){3}\d{4}\b'
    ),
    PIIType.IP_ADDRESS: re.compile(
        r'\b(?:\d{1,3}\.){3}\d{1,3}\b'
    ),
    PIIType.DATE_OF_BIRTH: re.compile(
        r'\b(?:19|20)\d{2}-(?:0[1-9]|1[0-2])-(?:0[1-9]|[12]\d|3[01])\b'
    ),
    PIIType.IBAN: re.compile(
        r'\b[A-Z]{2}\d{2}[A-Z0-9]{4}\d{7}([A-Z0-9]?){0,16}\b'
    ),
    PIIType.EMPLOYEE_ID: re.compile(
        r'\bEMP-\d{5,8}\b'
    ),
    PIIType.DEVICE_ID: re.compile(
        r'\b[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-'
        r'[0-9a-fA-F]{4}-[0-9a-fA-F]{12}\b'
    ),
}

# Synthetic test data (100% fictional)
SYNTHETIC_DATASETS = {
    "worksight_keystroke_log.csv": [
        "timestamp,employee_hash,interval_ms,app_name",
        "2026-04-13T10:00:00Z,a1b2c3d4e5f6,120,vscode",
        "2026-04-13T10:00:01Z,a1b2c3d4e5f6,95,vscode",
        "2026-04-13T10:05:00Z,f6e5d4c3b2a1,110,outlook",
    ],
    "worksight_email_metadata.csv": [
        "timestamp,sender_hash,recipient_hash,size_bytes",
        "2026-04-13T09:00:00Z,hash001,hash002,15234",
        "2026-04-13T09:05:00Z,hash002,hash001,8921",
        "# WARNING: developer left debug data below",
        "2026-04-13T09:10:00Z,jan.devries@helios-analytics.example.com,"
        "elke.krause@helios-analytics.example.com,22100",
    ],
    "worksight_badge_log.csv": [
        "timestamp,badge_id,reader_location,access_status",
        "2026-04-13T08:00:00Z,EMP-00142,BUILDING-A-FLOOR-3,GRANTED",
        "2026-04-13T08:01:00Z,EMP-00143,BUILDING-A-FLOOR-1,GRANTED",
        "2026-04-13T08:30:00Z,EMP-00142,BUILDING-A-FLOOR-5,DENIED",
    ],
    "worksight_hr_export.json": [
        '{"employee_id": "EMP-00142", "name": "Jan de Vries", '
        '"email": "jan.devries@helios-analytics.example.com", '
        '"department": "Engineering", "dob": "1985-03-15", '
        '"phone": "+49-30-555-0142", '
        '"address": "Musterstrasse 42, 10115 Berlin, Germany", '
        '"iban": "DE89370400440532013000"}',
    ],
    "worksight_debug_dump.log": [
        "2026-04-13T10:00:00Z [DEBUG] Processing employee EMP-00142",
        "2026-04-13T10:00:01Z [DEBUG] Source IP: 10.60.2.42",
        "2026-04-13T10:00:02Z [ERROR] Auth failed for testuser/REDACTED",
        "2026-04-13T10:00:03Z [DEBUG] SSN check: 123-45-6789 (SYNTHETIC)",
        "2026-04-13T10:00:04Z [DEBUG] Device: "
        "550e8400-e29b-41d4-a716-446655440000",
    ],
}


def scan_for_pii(datasets: Dict[str, List[str]]) -> List[PIIFinding]:
    """Scan synthetic datasets for PII."""
    findings = []
    finding_counter = 0

    # Known inventory items (already documented)
    known_fields = {
        "employee_hash", "sender_hash", "recipient_hash",
        "interval_ms", "app_name", "timestamp", "size_bytes",
        "reader_location", "access_status",
    }

    for filename, lines in datasets.items():
        full_text = "\n".join(lines)

        for pii_type, pattern in PII_PATTERNS.items():
            matches = pattern.findall(full_text)
            if matches:
                finding_counter += 1
                # Mask the sample value
                sample = matches[0]
                if len(sample) > 4:
                    masked = sample[:2] + "*" * (len(sample) - 4) + sample[-2:]
                else:
                    masked = "****"

                # Determine if this was in the inventory
                in_inv = False
                if pii_type == PIIType.EMPLOYEE_ID:
                    in_inv = True  # badge_id is documented
                elif pii_type == PIIType.IP_ADDRESS:
                    in_inv = True  # known infrastructure IPs

                # Determine remediation
                if pii_type in (PIIType.SSN, PIIType.CREDIT_CARD):
                    remediation = (
                        "CRITICAL: Remove immediately. This data should "
                        "never appear in monitoring logs. Investigate "
                        "how it entered the pipeline."
                    )
                elif pii_type == PIIType.EMAIL and "debug" not in filename:
                    remediation = (
                        "HIGH: Email addresses found in production data. "
                        "Replace with pseudonymized hashes. Update "
                        "collection pipeline to hash at source."
                    )
                elif pii_type == PIIType.EMAIL and "debug" in filename:
                    remediation = (
                        "HIGH: Email addresses in debug logs. Implement "
                        "PII scrubbing in logging framework. Add "
                        "pre-commit hook to scan for PII in logs."
                    )
                elif pii_type in (PIIType.DATE_OF_BIRTH, PIIType.IBAN):
                    remediation = (
                        "HIGH: Sensitive personal data in HR export. "
                        "Ensure encryption at rest and strict RBAC. "
                        "Remove from WorkSight data pipeline."
                    )
                else:
                    remediation = (
                        "MEDIUM: Review data element and ensure it is "
                        "documented in the data inventory."
                    )

                findings.append(PIIFinding(
                    finding_id=f"PII-{finding_counter:03d}",
                    pii_type=pii_type,
                    field_name=filename,
                    source_file=filename,
                    sample_value=masked,
                    confidence=0.85 if len(matches) > 1 else 0.70,
                    in_inventory=in_inv,
                    remediation=remediation,
                ))

    return findings


def print_pii_report(findings: List[PIIFinding]) -> None:
    """Print PII discovery report."""
    print("=" * 60)
    print("PII DISCOVERY SCAN REPORT")
    print(f"Datasets Scanned: {len(SYNTHETIC_DATASETS)}")
    print(f"Total Findings: {len(findings)}")
    print(f"Undocumented Findings: "
          f"{sum(1 for f in findings if not f.in_inventory)}")
    print("=" * 60)

    # Group by severity
    critical = [f for f in findings if "CRITICAL" in f.remediation]
    high = [f for f in findings if "HIGH" in f.remediation]
    medium = [f for f in findings
              if "CRITICAL" not in f.remediation
              and "HIGH" not in f.remediation]

    for severity, group in [
        ("CRITICAL", critical), ("HIGH", high), ("MEDIUM", medium)
    ]:
        if group:
            print(f"\n--- {severity} Findings ---")
            for f in group:
                print(f"\n  [{f.finding_id}] {f.pii_type.value}")
                print(f"    Source:      {f.source_file}")
                print(f"    Sample:      {f.sample_value}")
                print(f"    Confidence:  {f.confidence:.0%}")
                print(f"    In Inventory: {'Yes' if f.in_inventory else 'NO'}")
                print(f"    Remediation: {f.remediation}")


if __name__ == "__main__":
    findings = scan_for_pii(SYNTHETIC_DATASETS)
    print_pii_report(findings)