@connexum/ai-governance 1.0.0-beta.11

package/dist/esm/packs/de-bdsg.js

@@ -0,0 +1,413 @@
+/**
+ * German BDSG (Federal Data Protection Act) Compliance Pack
+ *
+ * Regulation: Bundesdatenschutzgesetz (BDSG) -- German Federal Data Protection Act
+ *             (as amended by the Data Protection Adjustment and Implementation Act
+ *             of July 2017, BGBI. I S. 2097; and subsequent amendments)
+ *             Betriebsverfassungsgesetz (BetrVG) -- Works Constitution Act (§87)
+ *             for works council codetermination on employee-monitoring AI
+ *             Beschäftigtendatenschutzgesetz (BDSG §26 -- employee data provisions)
+ *
+ * Jurisdiction: DE (Germany)
+ * Regulator: BfDI (Bundesbeauftragte(r) für den Datenschutz und die
+ *             Informationsfreiheit -- Federal Commissioner for Data Protection
+ *             and Freedom of Information)
+ *             + 16 Landesdatenschutzbeauftragte (state data protection authorities)
+ *
+ * Important context:
+ *   BDSG complements GDPR with German-specific provisions. This pack encodes the
+ *   German OVERLAY only -- do NOT activate instead of GDPR; activate alongside
+ *   GDPR. Key German overlays:
+ *
+ * DEPENDENCY NOTICE (F-NEW-VERA-PACK-C3-05a):
+ *   This pack REQUIRES gdpr.ts to be active simultaneously. A client activating
+ *   de-bdsg alone will miss the GDPR Art. 6 lawful-basis gate, the Art. 17/18/20
+ *   data-subject-rights enforcement, and the Art. 33 72-hour breach clock that
+ *   BDSG presupposes. The CompliancePack schema does not currently have a
+ *   requiredAlongside field; enforcement is contractual and documented here.
+ *   Recommended: validate at pack-load time that 'gdpr' is present in the
+ *   active pack set whenever 'de-bdsg' is loaded.
+ *   - BDSG §26: strict purpose limitation for employee personal data
+ *   - Works council codetermination (BetrVG §87(1) No. 6): MANDATORY before
+ *     deploying any technical measure that could monitor employee behavior
+ *     (including AI-powered tools). Failure is a labor law violation.
+ *   - BDSG §25: video surveillance of publicly accessible spaces
+ *   - BDSG §4: video surveillance disclosure requirements
+ *   - Mandatory DPO from 10+ employees regularly processing personal data
+ *
+ * Critical: works council codetermination is a HARD GATE.
+ *   Deploying employee-monitoring AI without works council agreement is a labor
+ *   law violation under BetrVG §87(1) No. 6, not just a privacy violation.
+ *   Any action (AI deployment, software update, monitoring feature rollout) that
+ *   could technically enable monitoring of employee behavior requires:
+ *   (1) works council consultation and agreement (Betriebsvereinbarung), or
+ *   (2) documented exhaustion of dispute resolution under BetrVG §76-76a.
+ *
+ * Retention:
+ *   Per GDPR + German overlay requirements:
+ *   - Employment records: typically 6-10 years (BGB §195 + AO §147)
+ *   - Tax records: 10 years (AO §147)
+ *   - Payroll/HR records: 6 years (HGB §257)
+ *   - Video surveillance: typically 72 hours maximum unless evidence preservation needed
+ *
+ * Incident:
+ *   Per GDPR 72-hour notification to competent supervisory authority.
+ *   Additional notification to works council for employment-data incidents.
+ *   Notification to local (state-level) supervisory authority (Landesbehörde).
+ *
+ * @connexum/ai-governance
+ */
+export const DE_BDSG_CATEGORY_CLASSIFIERS = {
+    EMPLOYMENT_PERSONAL_DATA_GERMANY: {
+        references: ['BDSG §26 -- processing employee personal data; BetrVG §87(1) No. 6 -- codetermination for monitoring measures'],
+        classifier: (input) => {
+            if (/\b(?:mitarbeiter(?:daten)?|arbeitnehmer(?:daten)?|beschäftigten(?:daten)?|personalakte\b|arbeitsverhältnis)\b/i.test(input))
+                return true;
+            if (/\b(?:employee\s+personal\s+data\s+germany|arbeitnehmer\s+datenschutz|bdsg\s+§26|bdsg\s+beschäftigte|beschäftigtendatenschutz)\b/i.test(input))
+                return true;
+            if (/\b(?:employment\s+data\s+germany|german\s+employee\s+data|hr\s+data\s+germany\s+bdsg|german\s+worker\s+data)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    SPECIAL_CATEGORY_DATA_GERMAN_OVERLAY: {
+        references: ['BDSG §26(3) -- special category employee data; GDPR Art. 9 + BDSG §22 -- sensitive data German overlay'],
+        classifier: (input) => {
+            if (/\b(?:besondere\s+kategorien|gewerkschaftszugehörigkeit\s+arbeitnehmer|gesundheitsdaten\s+arbeitnehmer|bdsg\s+§22)\b/i.test(input))
+                return true;
+            if (/\b(?:special\s+category\s+data\s+germany|sensitive\s+employee\s+data\s+germany|bdsg\s+sensitive|trade\s+union\s+membership\s+germany)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    VIDEO_SURVEILLANCE_GERMANY: {
+        references: ['BDSG §4 -- video surveillance of publicly accessible spaces; BDSG §25 -- video surveillance requirements'],
+        classifier: (input) => {
+            if (/\b(?:videoüberwachung|kameraüberwachung|bdsg\s+§4|bdsg\s+video|öffentlich\s+zugänglich\s+kamera)\b/i.test(input))
+                return true;
+            if (/\b(?:video\s+surveillance\s+germany|cctv\s+germany\s+bdsg|workplace\s+surveillance\s+germany\s+bdsg|kameraüberwachung\s+arbeitsplatz)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    EMPLOYEE_MONITORING_RECORD: {
+        references: ['BetrVG §87(1) No. 6 -- codetermination for technical employee monitoring; BDSG §26 -- purpose limitation'],
+        classifier: (input) => {
+            if (/\b(?:mitarbeiterüberwachung|verhaltensüberwachung\s+arbeitnehmer|leistungsüberwachung\s+mitarbeiter|betriebsrat\s+überwachung)\b/i.test(input))
+                return true;
+            if (/\b(?:employee\s+monitoring\s+germany|ai\s+monitoring\s+employees\s+germany|verhaltenskontrolle\s+arbeitnehmer|betrVG\s+§87)\b/i.test(input))
+                return true;
+            if (/\b(?:performance\s+monitoring\s+germany\s+ai|keystroke\s+logging\s+germany|screen\s+monitoring\s+germany\s+works\s+council)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    WORKS_COUNCIL_CONSULTATION_RECORD: {
+        references: ['BetrVG §87(1) No. 6 -- codetermination right; BetrVG §76-76a -- dispute resolution; Betriebsvereinbarung (works agreement)'],
+        classifier: (input) => {
+            if (/\b(?:betriebsrat|betriebsvereinbarung|betrVG\s+§87|mitbestimmung|einigungsstelle)\b/i.test(input))
+                return true;
+            if (/\b(?:works\s+council\s+germany|betriebsrat\s+consultation|works\s+agreement\s+germany|codetermination\s+germany|mitbestimmungsrecht)\b/i.test(input))
+                return true;
+            if (/\b(?:works\s+council\s+consent\s+ai|betriebsrat\s+ai|betrVG\s+ai\s+deployment|german\s+works\s+council\s+monitoring)\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    /**
+     * F-NEW-VERA-PACK-C3-05b: BDSG §26 secondary use prohibition for employee data.
+     * Employers training AI models on HR data or scoring productivity from hiring
+     * data violates the Zweckbindung (purpose-binding) principle in BDSG §26(1).
+     * Bilingual: German + English patterns.
+     */
+    EMPLOYMENT_SECONDARY_USE_GERMANY: {
+        references: ['BDSG §26(1) -- employee data purpose limitation (Zweckbindung); GDPR Art. 5(1)(b) -- purpose limitation'],
+        classifier: (input) => {
+            // English patterns
+            if (/\bsecondary\s+use\s+(?:of\s+)?employee\s+data\b/i.test(input))
+                return true;
+            if (/\btrain\s+(?:a\s+)?(?:model|AI|algorithm)\s+(?:on\s+|using\s+)?(?:HR|hiring|recruitment|employee)\s+data\b/i.test(input))
+                return true;
+            if (/\bproductivity\s+scoring\s+(?:from|using)\s+(?:hiring|recruitment|HR)\s+data\b/i.test(input))
+                return true;
+            if (/\breuse\s+(?:of\s+)?(?:HR|employee|personnel)\s+data\s+(?:for|to\s+train)\b/i.test(input))
+                return true;
+            // German patterns
+            if (/\bZweckbindung\s+Mitarbeiter\b/i.test(input))
+                return true;
+            if (/\bBDSG\s+§26\s+Zweckänderung\b/i.test(input))
+                return true;
+            if (/\bSekundärnutzung\s+(?:von\s+)?Mitarbeiterdaten\b/i.test(input))
+                return true;
+            if (/\bPersonaldaten\s+(?:für\s+)?(?:KI|Modell)\s+(?:trainieren|nutzen)\b/i.test(input))
+                return true;
+            if (/\bLeistungsscoring\s+(?:aus|mit)\s+(?:Einstellungs|Bewerbungs)daten\b/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    PII: {
+        references: ['GDPR Art. 4(1) -- personal data (applies via BDSG); BfDI guidance on personal data'],
+        classifier: (input) => {
+            if (/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b/.test(input))
+                return true;
+            // German ID / Steueridentifikationsnummer (11 digits)
+            if (/\b\d{11}\b/.test(input) && /\b(?:steuer(?:id|identifikationsnummer)?|idnr|tin\s+germany)\b/i.test(input))
+                return true;
+            if (/\b(?:personalausweis|reisepass|sozialversicherungsnummer|rentenversicherungsnummer)\b/i.test(input))
+                return true;
+            if (/\b(?:name|vorname|nachname|adresse|postleitzahl)\s*:/i.test(input))
+                return true;
+            return false;
+        },
+    },
+    CREDENTIALS: {
+        references: ['GDPR Art. 32 -- security; BDSG §64 -- security requirements for processing; BfDI guidance'],
+        classifier: (input) => {
+            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(input))
+                return true;
+            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(input))
+                return true;
+            if (/\bAKIA[A-Z0-9]{16}\b/.test(input))
+                return true;
+            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(input))
+                return true;
+            return false;
+        },
+    },
+};
+export const DE_BDSG_PACK = {
+    categoryClassifiers: DE_BDSG_CATEGORY_CLASSIFIERS,
+    id: 'de-bdsg',
+    aliases: [],
+    name: 'German BDSG (Federal Data Protection Act)',
+    version: '1.0.0',
+    description: 'German Federal Data Protection Act (Bundesdatenschutzgesetz -- BDSG) overlay pack. Complements GDPR (activate alongside gdpr.ts) with German-specific provisions: BDSG §26 strict purpose limitation for employee data; BetrVG §87(1) No. 6 works council codetermination (hard gate before deploying any AI-powered employee monitoring -- failure is a labor law violation); mandatory DPO from 10+ employees regularly processing personal data; BDSG §4 video surveillance disclosure; special-category employee data conditions (§26(3)); German supervisory authority (BfDI + state Landesdatenschutzbeauftragte) notification. Do not activate as a standalone GDPR replacement.',
+    authority: 'BfDI (Bundesbeauftragter für den Datenschutz und die Informationsfreiheit) + 16 Landesdatenschutzbeauftragte (state supervisory authorities)',
+    industries: ['all', 'manufacturing', 'financial-services', 'healthcare', 'technology', 'retail', 'public-sector', 'automotive'],
+    requiredModules: [
+        {
+            name: 'governance-runtime',
+            required: true,
+            reason: 'Enforce BDSG §26 strict purpose limitation for employee data processing; BetrVG §87(1) No. 6 works council codetermination hard gate before AI monitoring deployment; mandatory DPO designation check (10+ employees threshold).',
+            reference: 'BDSG §26 -- employee data purpose limitation; BetrVG §87(1) No. 6 -- codetermination (monitoring measures); BDSG §38 -- DPO mandatory designation threshold',
+        },
+        {
+            name: 'approval-queue',
+            required: true,
+            reason: 'Works council codetermination hard gate: any AI deployment that could monitor employee behavior MUST be held in approval queue pending documented Betriebsvereinbarung (works agreement) or exhaustion of BetrVG §76-76a dispute resolution.',
+            reference: 'BetrVG §87(1) No. 6 -- mandatory works council consultation before technical monitoring measures; BetrVG §76-76a -- Einigungsstelle (conciliation board) procedure',
+        },
+        {
+            name: 'data-classifier',
+            required: true,
+            reason: 'Classify German employment personal data (BDSG §26), special-category employee data (§26(3)), video surveillance data (§4/§25), and works council consultation records for appropriate handling.',
+            reference: 'BDSG §26 -- employee data classification; BDSG §22 -- special category data overlay; GDPR Art. 9 + BDSG §26(3) -- sensitive employee data conditions',
+        },
+        {
+            name: 'audit-integrity',
+            required: true,
+            reason: 'Tamper-evident audit trail for BDSG §26 purpose limitation decisions, works council consultation records, DPO engagement logs, and video surveillance disclosure records; required for BfDI supervisory audit.',
+            reference: 'GDPR Art. 5(2) -- accountability (applies via BDSG); BfDI audit requirements; BetrVG §87(1) No. 6 -- documentation of works council process',
+        },
+        {
+            name: 'attestation-manager',
+            required: true,
+            reason: 'DPO designation documentation; Betriebsvereinbarung (works council agreement) record lifecycle; video surveillance disclosure notices; ROPA (Records of Processing Activities) including German employment data entries.',
+            reference: 'GDPR Art. 30 -- ROPA (German overlay: employment data entries); BDSG §38 -- DPO designation; BDSG §4 -- video surveillance disclosure documentation',
+        },
+        {
+            name: 'encryption-layer',
+            required: true,
+            reason: 'Employment personal data and special-category employee data encrypted at rest and in transit per GDPR Art. 32 + BDSG §64 security requirements; works council consultation records encrypted separately.',
+            reference: 'GDPR Art. 32(1)(a) -- encryption; BDSG §64 -- security of processing; BfDI technical-organisational measures guidance',
+        },
+        {
+            name: 'event-bus',
+            required: true,
+            reason: 'GDPR 72-hour breach notification workflow (applies via BDSG); additional works council notification trigger for employment-data breaches; Landesbehörde (state authority) notification event routing.',
+            reference: 'GDPR Art. 33 -- 72-hour supervisory authority notification; BetrVG §80(1) No. 1 -- works council information on data breaches affecting employees; BfDI / Landesdatenschutz routing',
+        },
+        {
+            name: 'supply-chain',
+            required: true,
+            reason: 'GDPR Art. 28 processor contracts (German law requires same); BDSG §26 purpose limitation flows through to processors; AI vendor works council documentation chain for employee-monitoring deployments.',
+            reference: 'GDPR Art. 28 -- processor contracts; BDSG §26 -- purpose limitation applicable to processors; BetrVG §87(1) No. 6 -- third-party AI vendor obligation in works council process',
+        },
+        {
+            name: 'session-persistence',
+            required: true,
+            reason: 'Enforce German retention overlay: employment records 6-10 years; payroll/HR records 6 years (HGB §257); tax records 10 years (AO §147); video surveillance maximum 72-hour window (unless evidence preservation needed).',
+            reference: 'AO §147 -- 10-year tax retention; HGB §257 -- 6-year commercial records retention; BDSG §4 / §25 -- video surveillance brief retention; German employment law retention requirements',
+        },
+        {
+            name: 'bias-monitor',
+            required: true,
+            reason: 'BDSG §26(1) -- employee data processed for lawful purposes without discriminatory effect; monitor AI outputs for discriminatory treatment based on AGG (General Equal Treatment Act -- Allgemeines Gleichbehandlungsgesetz) protected characteristics.',
+            reference: 'BDSG §26(1) -- purpose limitation and non-discriminatory processing; AGG (Allgemeines Gleichbehandlungsgesetz) -- General Equal Treatment Act anti-discrimination; GDPR Art. 22 profiling',
+        },
+    ],
+    moduleConfig: {
+        'governance-runtime': {
+            bdsg26PurposeLimitationRequired: true,
+            worksCouncilCodeterminationGateRequired: true,
+            dpoMandatoryThresholdEmployees: 10,
+            germanDpoDesignationCheckRequired: true,
+        },
+        'approval-queue': {
+            worksCouncilConsultationGateRequired: true,
+            betriebsvereinbarungDocumentationRequired: true,
+            employeeMonitoringAiDeploymentHold: true,
+        },
+        'data-classifier': {
+            enabledCategories: ['EMPLOYMENT_PERSONAL_DATA_GERMANY', 'SPECIAL_CATEGORY_DATA_GERMAN_OVERLAY', 'VIDEO_SURVEILLANCE_GERMANY', 'EMPLOYEE_MONITORING_RECORD', 'WORKS_COUNCIL_CONSULTATION_RECORD', 'EMPLOYMENT_SECONDARY_USE_GERMANY', 'PII', 'CREDENTIALS'],
+            employmentDataAction: 'WARN',
+            specialCategoryEmployeeDataAction: 'BLOCK',
+            videoSurveillanceAction: 'WARN',
+            // F-NEW-VERA-PACK-C3-05b: secondary use of employee data is prohibited by BDSG §26 Zweckbindung.
+            employmentSecondaryUseGermanyAction: 'BLOCK',
+            credentialsAction: 'BLOCK',
+        },
+        'attestation-manager': {
+            dpoDesignationRequired: true,
+            ropaGermanEmploymentEntriesRequired: true,
+            betriebsvereinbarungLifecycleManaged: true,
+            videoSurveillanceDisclosureRequired: true,
+        },
+        'event-bus': {
+            gdprBreachNotificationHours: 72,
+            worksCouncilBreachNotificationRequired: true,
+            landesDatenschutzRoutingRequired: true,
+        },
+        'session-persistence': {
+            employmentRecordRetentionDays: 2190, // 6 years HGB §257 baseline
+            taxRecordRetentionDays: 3650, // 10 years AO §147
+            videoSurveillanceMaxRetentionHours: 72,
+            storageLimitationEnforced: true,
+        },
+        'bias-monitor': {
+            aggProtectedCharacteristicsRequired: true,
+            germanNonDiscriminationMonitoringRequired: true,
+        },
+    },
+    providerPolicy: {
+        blockedProviders: ['deepseek', 'baidu', 'alibaba'],
+        requiredCapabilities: ['DATA-RESIDENCY-EU', 'PROCESSOR-CONTRACT-GDPR-ART28', 'BDSG-TECHNICAL-ORGANISATIONAL-MEASURES'],
+        blockReasons: {
+            deepseek: 'PRC National Intelligence Law incompatible with GDPR Art. 46 / BDSG transfer requirements for German employee personal data. German supervisory authorities (BfDI) have issued strong warnings against PRC transfers.',
+            baidu: 'PRC jurisdiction. No EU adequacy decision. Transfer of German employee personal data to PRC violates GDPR Art. 44 and BDSG. German DPAs have issued enforcement guidance against such transfers.',
+            alibaba: 'PRC jurisdiction. No EU adequacy decision. Transfer of German employment data and special-category employee data to PRC violates GDPR Art. 44 and BDSG §26 purpose limitation requirements.',
+        },
+    },
+    dataPolicy: {
+        scanCategories: ['EMPLOYMENT_PERSONAL_DATA_GERMANY', 'SPECIAL_CATEGORY_DATA_GERMAN_OVERLAY', 'VIDEO_SURVEILLANCE_GERMANY', 'EMPLOYEE_MONITORING_RECORD', 'WORKS_COUNCIL_CONSULTATION_RECORD', 'EMPLOYMENT_SECONDARY_USE_GERMANY', 'PII', 'CREDENTIALS'],
+        categoryActions: {
+            EMPLOYMENT_PERSONAL_DATA_GERMANY: 'WARN',
+            SPECIAL_CATEGORY_DATA_GERMAN_OVERLAY: 'BLOCK',
+            VIDEO_SURVEILLANCE_GERMANY: 'WARN',
+            EMPLOYEE_MONITORING_RECORD: 'WARN',
+            WORKS_COUNCIL_CONSULTATION_RECORD: 'WARN',
+            // F-NEW-VERA-PACK-C3-05b: BDSG §26 Zweckbindung -- secondary use of employee data blocked.
+            EMPLOYMENT_SECONDARY_USE_GERMANY: 'BLOCK',
+            PII: 'WARN',
+            CREDENTIALS: 'BLOCK',
+        },
+        encryptionRequired: true,
+        encryptionStandard: 'AES-256-GCM',
+        minimumClassification: 'RESTRICTED',
+    },
+    retentionPolicy: {
+        // HGB §257: 6-year commercial records including payroll/HR.
+        // AO §147: 10-year tax records (longer period governs for tax-related data).
+        // Video surveillance: 72 hours unless evidence preservation needed (BDSG §4/§25 principle).
+        auditLogRetentionDays: 2190, // 6 years (HGB §257 minimum)
+        sessionRetentionDays: 2190,
+        incidentRetentionDays: 2190,
+        reference: 'HGB §257 -- 6-year commercial record retention (payroll, HR); AO §147 -- 10-year tax retention; BDSG §4/§25 -- video surveillance brief retention (72-hour general limit); GDPR Art. 5(1)(e) -- storage limitation (applies via BDSG)',
+        forceDelete: false,
+        requiresLegalHoldSupport: true,
+        sovereignty: ['de', 'eu'],
+    },
+    incidentPolicy: {
+        // GDPR Art. 33: 72-hour notification to competent supervisory authority.
+        // For German employment data: Landesbehörde (state supervisory authority) + BfDI (if federal data).
+        // Additional: works council notification for employment-data incidents per BetrVG §80(1) No. 1.
+        notificationDeadlineHours: 72,
+        reference: 'GDPR Art. 33 -- 72-hour supervisory authority notification; BDSG -- Landesbehörde as competent authority for most German processing; BetrVG §80(1) No. 1 -- works council right to information on data breaches affecting employees; BfDI coordination for federal public bodies',
+        requiredRecipients: ['landesbehorde-supervisory-authority', 'bfdi-federal', 'data-protection-officer', 'works-council-chair', 'chief-privacy-officer'],
+        formalNotificationRequired: true,
+    },
+    validators: [
+        {
+            id: 'de-bdsg-works-council-gate',
+            description: 'BetrVG §87(1) No. 6 works council codetermination gate ACTIVE: no AI-powered employee monitoring deployed without documented Betriebsvereinbarung (works council agreement) or BetrVG §76-76a conciliation outcome',
+            reference: 'BetrVG §87(1) No. 6 -- mandatory works council codetermination for technical employee monitoring measures; Bundesarbeitsgericht jurisprudence on software monitoring',
+            check: 'approval_queue_active',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'de-bdsg-purpose-limitation',
+            description: 'BDSG §26 strict purpose limitation active: employee personal data processed only for specified employment-related purposes; purpose limitation gate enforced before any AI inference on employee data',
+            reference: 'BDSG §26 -- employee personal data purpose limitation; BGH jurisprudence on BDSG §26 interpretation; EDPB guidance on purpose limitation (applies via GDPR)',
+            check: 'governance_active',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'de-bdsg-special-category-employee',
+            description: 'BDSG §26(3) special-category employee data classified and blocked without explicit legal basis; trade union membership, health data, and disability data of employees subject to heightened controls',
+            reference: 'BDSG §26(3) -- special category employee data (GDPR Art. 9 conditions); BDSG §22 -- special category data German overlay; BfDI guidance on sensitive employee data',
+            check: 'data_classifier_active',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'de-bdsg-dpo-designation',
+            description: 'DPO designation documented for organisations with 10+ employees regularly processing personal data; DPO independence and access to highest management level confirmed',
+            reference: 'BDSG §38 -- mandatory DPO designation (10+ employees regularly processing); GDPR Art. 37-39 -- DPO obligations; BfDI guidance on DPO requirements under BDSG',
+            check: 'attestation_active',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'de-bdsg-breach-notification',
+            description: 'GDPR Art. 33 72-hour breach notification workflow active with German overlay: Landesbehörde routing configured; BfDI escalation for federal bodies; works council notification for employment-data breaches',
+            reference: 'GDPR Art. 33 -- 72-hour supervisory authority notification; BDSG -- Landesbehörde competence; BetrVG §80(1) No. 1 -- works council right on employment data breaches',
+            check: 'gdpr_breach_72h_active',
+            failSeverity: 'CRITICAL',
+        },
+        {
+            id: 'de-bdsg-video-surveillance-disclosure',
+            description: 'BDSG §4 video surveillance disclosure active: persons entering video-surveilled spaces notified; surveillance purpose documented; retention limited to operational necessity (72-hour general limit)',
+            reference: 'BDSG §4 -- video surveillance of publicly accessible spaces; BDSG §25 -- other video surveillance; BfDI guidance on workplace video surveillance under BDSG',
+            check: 'transparency_active',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'de-bdsg-audit-trail',
+            description: 'Tamper-evident audit trail active for BDSG §26 purpose decisions, works council consultations, DPO engagement records, and employment data processing activities',
+            reference: 'GDPR Art. 5(2) -- accountability (applies via BDSG); BfDI audit requirements; BetrVG §87(1) No. 6 documentation requirements',
+            check: 'audit_trail_exists',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'de-bdsg-agv-bias-monitor',
+            description: 'AGG (Allgemeines Gleichbehandlungsgesetz) non-discrimination monitoring active: AI outputs for employee-facing decisions monitored for discriminatory treatment across protected characteristics',
+            reference: 'AGG (Allgemeines Gleichbehandlungsgesetz) §1 -- protected characteristics; BDSG §26(1) -- non-discriminatory employee data processing; EDPB guidance on automated decision-making and discrimination',
+            check: 'bias_monitor_active',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'de-bdsg-processor-contracts',
+            description: 'GDPR Art. 28 processor contracts with German overlay: BDSG §26 purpose limitation clauses; AI vendor Betriebsvereinbarung documentation chain for employee-monitoring deployments',
+            reference: 'GDPR Art. 28 -- processor contracts; BDSG §26 -- processor obligation to purpose limitation; BetrVG §87(1) No. 6 -- AI vendor accountability in works council process',
+            check: 'subservice_registry_active',
+            failSeverity: 'HIGH',
+        },
+        {
+            id: 'de-bdsg-encryption',
+            description: 'German employee personal data, special-category employee data, and works council consultation records encrypted at rest and in transit per GDPR Art. 32 + BDSG §64',
+            reference: 'GDPR Art. 32(1)(a) -- encryption; BDSG §64 -- security of processing; BfDI technical-organisational measures guidance',
+            check: 'encryption_active',
+            failSeverity: 'HIGH',
+        },
+    ],
+};
+//# sourceMappingURL=de-bdsg.js.map

package/dist/esm/packs/de-bdsg.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"de-bdsg.js","sourceRoot":"","sources":["../../../src/packs/de-bdsg.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AAKH,MAAM,CAAC,MAAM,4BAA4B,GAAwB;IAC/D,gCAAgC,EAAE;QAChC,UAAU,EAAE,CAAC,+GAA+G,CAAC;QAC7H,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,gHAAgH,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC9I,IAAI,kIAAkI,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAChK,IAAI,iHAAiH,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC/I,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,oCAAoC,EAAE;QACpC,UAAU,EAAE,CAAC,wGAAwG,CAAC;QACtH,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,sHAAsH,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpJ,IAAI,0IAA0I,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACxK,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,0BAA0B,EAAE;QAC1B,UAAU,EAAE,CAAC,0GAA0G,CAAC;QACxH,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,qGAAqG,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACnI,IAAI,0IAA0I,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACxK,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,0BAA0B,EAAE;QAC1B,UAAU,EAAE,CAAC,0GAA0G,CAAC;QACxH,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,mIAAmI,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACjK,IAAI,gIAAgI,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC9J,IAAI,gIAAgI,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC9J,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,iCAAiC,EAAE;QACjC,UAAU,EAAE,CAAC,4HAA4H,CAAC;QAC1I,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,sFAAsF,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpH,IAAI,yIAAyI,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACvK,IAAI,yHAAyH,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACvJ,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD;;;;;OAKG;IACH,gCAAgC,EAAE;QAChC,UAAU,EAAE,CAAC,yGAAyG,CAAC;QACvH,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,mBAAmB;YACnB,IAAI,kDAAkD,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAChF,IAAI,6GAA6G,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC3I,IAAI,iFAAiF,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC/G,IAAI,8EAA8E,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC5G,kBAAkB;YAClB,IAAI,iCAAiC,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC/D,IAAI,iCAAiC,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC/D,IAAI,oDAAoD,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAClF,IAAI,uEAAuE,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACrG,IAAI,wEAAwE,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACtG,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,GAAG,EAAE;QACH,UAAU,EAAE,CAAC,oFAAoF,CAAC;QAClG,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,qDAAqD,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACnF,sDAAsD;YACtD,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,iEAAiE,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC3H,IAAI,wFAAwF,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACtH,IAAI,uDAAuD,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACrF,OAAO,KAAK,CAAC;QACf,CAAC;KACF;IACD,WAAW,EAAE;QACX,UAAU,EAAE,CAAC,2FAA2F,CAAC;QACzG,UAAU,EAAE,CAAC,KAAa,EAAW,EAAE;YACrC,IAAI,qEAAqE,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACnG,IAAI,2DAA2D,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACzF,IAAI,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpD,IAAI,4CAA4C,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC1E,OAAO,KAAK,CAAC;QACf,CAAC;KACF;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAkE;IACzF,mBAAmB,EAAE,4BAA4B;IACjD,EAAE,EAAE,SAAS;IACb,OAAO,EAAE,EAAE;IACX,IAAI,EAAE,2CAA2C;IACjD,OAAO,EAAE,OAAO;IAChB,WAAW,EACT,ypBAAypB;IAC3pB,SAAS,EAAE,8IAA8I;IACzJ,UAAU,EAAE,CAAC,KAAK,EAAE,eAAe,EAAE,oBAAoB,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,eAAe,EAAE,YAAY,CAAC;IAE/H,eAAe,EAAE;QACf;YACE,IAAI,EAAE,oBAAoB;YAC1B,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,kOAAkO;YAC1O,SAAS,EAAE,6JAA6J;SACzK;QACD;YACE,IAAI,EAAE,gBAAgB;YACtB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,8OAA8O;YACtP,SAAS,EAAE,oKAAoK;SAChL;QACD;YACE,IAAI,EAAE,iBAAiB;YACvB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,kMAAkM;YAC1M,SAAS,EAAE,sJAAsJ;SAClK;QACD;YACE,IAAI,EAAE,iBAAiB;YACvB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,gNAAgN;YACxN,SAAS,EAAE,6IAA6I;SACzJ;QACD;YACE,IAAI,EAAE,qBAAqB;YAC3B,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,0NAA0N;YAClO,SAAS,EAAE,qJAAqJ;SACjK;QACD;YACE,IAAI,EAAE,kBAAkB;YACxB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,0MAA0M;YAClN,SAAS,EAAE,uHAAuH;SACnI;QACD;YACE,IAAI,EAAE,WAAW;YACjB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,uMAAuM;YAC/M,SAAS,EAAE,qLAAqL;SACjM;QACD;YACE,IAAI,EAAE,cAAc;YACpB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,wMAAwM;YAChN,SAAS,EAAE,gLAAgL;SAC5L;QACD;YACE,IAAI,EAAE,qBAAqB;YAC3B,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,0NAA0N;YAClO,SAAS,EAAE,sLAAsL;SAClM;QACD;YACE,IAAI,EAAE,cAAc;YACpB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,wPAAwP;YAChQ,SAAS,EAAE,2LAA2L;SACvM;KACF;IAED,YAAY,EAAE;QACZ,oBAAoB,EAAE;YACpB,+BAA+B,EAAE,IAAI;YACrC,uCAAuC,EAAE,IAAI;YAC7C,8BAA8B,EAAE,EAAE;YAClC,iCAAiC,EAAE,IAAI;SACxC;QACD,gBAAgB,EAAE;YAChB,oCAAoC,EAAE,IAAI;YAC1C,yCAAyC,EAAE,IAAI;YAC/C,kCAAkC,EAAE,IAAI;SACzC;QACD,iBAAiB,EAAE;YACjB,iBAAiB,EAAE,CAAC,kCAAkC,EAAE,sCAAsC,EAAE,4BAA4B,EAAE,4BAA4B,EAAE,mCAAmC,EAAE,kCAAkC,EAAE,KAAK,EAAE,aAAa,CAAC;YAC1P,oBAAoB,EAAE,MAAM;YAC5B,iCAAiC,EAAE,OAAO;YAC1C,uBAAuB,EAAE,MAAM;YAC/B,iGAAiG;YACjG,mCAAmC,EAAE,OAAO;YAC5C,iBAAiB,EAAE,OAAO;SAC3B;QACD,qBAAqB,EAAE;YACrB,sBAAsB,EAAE,IAAI;YAC5B,mCAAmC,EAAE,IAAI;YACzC,oCAAoC,EAAE,IAAI;YAC1C,mCAAmC,EAAE,IAAI;SAC1C;QACD,WAAW,EAAE;YACX,2BAA2B,EAAE,EAAE;YAC/B,sCAAsC,EAAE,IAAI;YAC5C,gCAAgC,EAAE,IAAI;SACvC;QACD,qBAAqB,EAAE;YACrB,6BAA6B,EAAE,IAAI,EAAE,4BAA4B;YACjE,sBAAsB,EAAE,IAAI,EAAS,mBAAmB;YACxD,kCAAkC,EAAE,EAAE;YACtC,yBAAyB,EAAE,IAAI;SAChC;QACD,cAAc,EAAE;YACd,mCAAmC,EAAE,IAAI;YACzC,yCAAyC,EAAE,IAAI;SAChD;KACF;IAED,cAAc,EAAE;QACd,gBAAgB,EAAE,CAAC,UAAU,EAAE,OAAO,EAAE,SAAS,CAAC;QAClD,oBAAoB,EAAE,CAAC,mBAAmB,EAAE,+BAA+B,EAAE,wCAAwC,CAAC;QACtH,YAAY,EAAE;YACZ,QAAQ,EAAE,uNAAuN;YACjO,KAAK,EAAE,kMAAkM;YACzM,OAAO,EAAE,6LAA6L;SACvM;KACF;IAED,UAAU,EAAE;QACV,cAAc,EAAE,CAAC,kCAAkC,EAAE,sCAAsC,EAAE,4BAA4B,EAAE,4BAA4B,EAAE,mCAAmC,EAAE,kCAAkC,EAAE,KAAK,EAAE,aAAa,CAAC;QACvP,eAAe,EAAE;YACf,gCAAgC,EAAE,MAAM;YACxC,oCAAoC,EAAE,OAAO;YAC7C,0BAA0B,EAAE,MAAM;YAClC,0BAA0B,EAAE,MAAM;YAClC,iCAAiC,EAAE,MAAM;YACzC,2FAA2F;YAC3F,gCAAgC,EAAE,OAAO;YACzC,GAAG,EAAE,MAAM;YACX,WAAW,EAAE,OAAO;SACrB;QACD,kBAAkB,EAAE,IAAI;QACxB,kBAAkB,EAAE,aAAa;QACjC,qBAAqB,EAAE,YAAY;KACpC;IAED,eAAe,EAAE;QACf,4DAA4D;QAC5D,6EAA6E;QAC7E,4FAA4F;QAC5F,qBAAqB,EAAE,IAAI,EAAE,6BAA6B;QAC1D,oBAAoB,EAAE,IAAI;QAC1B,qBAAqB,EAAE,IAAI;QAC3B,SAAS,EAAE,uOAAuO;QAClP,WAAW,EAAE,KAAK;QAClB,wBAAwB,EAAE,IAAI;QAC9B,WAAW,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;KAC1B;IAED,cAAc,EAAE;QACd,yEAAyE;QACzE,oGAAoG;QACpG,gGAAgG;QAChG,yBAAyB,EAAE,EAAE;QAC7B,SAAS,EAAE,kRAAkR;QAC7R,kBAAkB,EAAE,CAAC,qCAAqC,EAAE,cAAc,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,uBAAuB,CAAC;QACtJ,0BAA0B,EAAE,IAAI;KACjC;IAED,UAAU,EAAE;QACV;YACE,EAAE,EAAE,4BAA4B;YAChC,WAAW,EAAE,oNAAoN;YACjO,SAAS,EAAE,sKAAsK;YACjL,KAAK,EAAE,uBAAuB;YAC9B,YAAY,EAAE,UAAU;SACzB;QACD;YACE,EAAE,EAAE,4BAA4B;YAChC,WAAW,EAAE,uMAAuM;YACpN,SAAS,EAAE,6JAA6J;YACxK,KAAK,EAAE,mBAAmB;YAC1B,YAAY,EAAE,UAAU;SACzB;QACD;YACE,EAAE,EAAE,mCAAmC;YACvC,WAAW,EAAE,sMAAsM;YACnN,SAAS,EAAE,oKAAoK;YAC/K,KAAK,EAAE,wBAAwB;YAC/B,YAAY,EAAE,UAAU;SACzB;QACD;YACE,EAAE,EAAE,yBAAyB;YAC7B,WAAW,EAAE,uKAAuK;YACpL,SAAS,EAAE,8JAA8J;YACzK,KAAK,EAAE,oBAAoB;YAC3B,YAAY,EAAE,UAAU;SACzB;QACD;YACE,EAAE,EAAE,6BAA6B;YACjC,WAAW,EAAE,6MAA6M;YAC1N,SAAS,EAAE,sKAAsK;YACjL,KAAK,EAAE,wBAAwB;YAC/B,YAAY,EAAE,UAAU;SACzB;QACD;YACE,EAAE,EAAE,uCAAuC;YAC3C,WAAW,EAAE,sMAAsM;YACnN,SAAS,EAAE,6JAA6J;YACxK,KAAK,EAAE,qBAAqB;YAC5B,YAAY,EAAE,MAAM;SACrB;QACD;YACE,EAAE,EAAE,qBAAqB;YACzB,WAAW,EAAE,kKAAkK;YAC/K,SAAS,EAAE,8HAA8H;YACzI,KAAK,EAAE,oBAAoB;YAC3B,YAAY,EAAE,MAAM;SACrB;QACD;YACE,EAAE,EAAE,0BAA0B;YAC9B,WAAW,EAAE,kMAAkM;YAC/M,SAAS,EAAE,sMAAsM;YACjN,KAAK,EAAE,qBAAqB;YAC5B,YAAY,EAAE,MAAM;SACrB;QACD;YACE,EAAE,EAAE,6BAA6B;YACjC,WAAW,EAAE,mLAAmL;YAChM,SAAS,EAAE,uKAAuK;YAClL,KAAK,EAAE,4BAA4B;YACnC,YAAY,EAAE,MAAM;SACrB;QACD;YACE,EAAE,EAAE,oBAAoB;YACxB,WAAW,EAAE,oKAAoK;YACjL,SAAS,EAAE,uHAAuH;YAClI,KAAK,EAAE,mBAAmB;YAC1B,YAAY,EAAE,MAAM;SACrB;KACF;CACF,CAAC"}