"use strict";
/**
 * GDPR Data Subject Rights Evidence Template
 *
 * Covers Articles 15-22 of Regulation (EU) 2016/679 (GDPR):
 *   Art. 15 -- Right of access
 *   Art. 16 -- Right to rectification
 *   Art. 17 -- Right to erasure ("right to be forgotten")
 *   Art. 18 -- Right to restriction of processing
 *   Art. 19 -- Notification obligation (rectification/erasure/restriction)
 *   Art. 20 -- Right to data portability
 *   Art. 21 -- Right to object
 *   Art. 22 -- Automated individual decision-making, including profiling
 *
 * This template documents how an AI governance platform handles DSR requests
 * affecting AI agent activity, produces evidence for DSR fulfilment audit,
 * and satisfies GDPR Art. 5(2) accountability principle documentation.
 *
 * Regulatory references:
 *   Regulation (EU) 2016/679 (GDPR) Articles 15-22
 *   GDPR Art. 5(2) -- Accountability principle
 *   GDPR Art. 30 -- Records of processing activities (RoPA)
 *   GDPR Art. 22 -- Automated decision-making safeguards
 *   EDPB Guidelines 01/2022 on data subject rights
 *   EDPB Guidelines 05/2020 on consent
 *
 * Required audit event types:
 *   retention:deleted           -- erasure fulfilment (Art. 17)
 *   pack-binding-changed        -- processing scope change (restriction/portability)
 *   approval:decided            -- legal-reviewer tier approval (Art. 22 safeguard)
 *
 * Spec: P4-AIR-02 item 7
 *
 * @connexum/ai-governance
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.GDPR_DATA_SUBJECT_RIGHTS_TEMPLATE = void 0;
const CITATION_INSTRUCTION = `
MANDATORY CITATION RULES: Every factual claim MUST immediately reference the
audit-chain event ID in square brackets, e.g. [EVT-abc123]. You may ONLY cite
event IDs from the AVAILABLE EVENTS list. If evidence is absent for a DSR
fulfilment step, write "No evidence found in audit chain; controller must
supplement with DSR tracking records per GDPR Art. 5(2) accountability
principle." Never invent event IDs.
`.trim();
exports.GDPR_DATA_SUBJECT_RIGHTS_TEMPLATE = {
    templateId: 'tpl-gdpr-data-subject-rights-v1',
    name: 'GDPR Art. 15-22 Data Subject Rights Evidence Report',
    framework: 'gdpr',
    requiredAuditEventTypes: [
        'retention:deleted',
        'pack-binding-changed',
        'approval:decided',
    ],
    artefactFormat: 'pdf',
    legalReviewRequired: true,
    sections: [
        {
            id: 'gdpr-dsr-art15-access',
            title: 'Art. 15: Right of Access -- Evidence of Fulfilment',
            citationRequirement: 'required',
            promptTemplate: `
You are drafting the Art. 15 (Right of Access) section for a GDPR Data Subject
Rights evidence report.

GDPR Art. 15 gives data subjects the right to obtain confirmation of whether
their personal data is processed, access to that data, and supplementary
information. Requests must be fulfilled within one month (Art. 12(3)).

For AI governance platforms, Art. 15 requests may cover:
  - What AI agent activity involved the data subject's data
  - What decisions were made by AI agents affecting the data subject
  - What data was processed and for what purposes

Using ONLY the audit-chain events provided, describe:
1. Access requests received during the review period and their status
   (evidence of fulfilment or pending status from chain events).
2. Evidence of what AI agent activity involved data subject data -- governance
   verdicts and pack-binding events relevant to the data subject.
3. The one-month response timeline: were requests fulfilled within the deadline?
4. Any extensions invoked (GDPR Art. 12(3) allows 2-month extension for
   complex requests -- must be documented).

${CITATION_INSTRUCTION}

Write 3-5 formal paragraphs.
`.trim(),
        },
        {
            id: 'gdpr-dsr-art17-erasure',
            title: 'Art. 17: Right to Erasure -- Deletion Evidence',
            citationRequirement: 'required',
            promptTemplate: `
You are drafting the Art. 17 (Right to Erasure) section for a GDPR Data Subject
Rights evidence report.

GDPR Art. 17 requires erasure of personal data without undue delay where one of
the six grounds applies (e.g., data no longer necessary, consent withdrawn,
unlawful processing, legal obligation to erase). Art. 17(3) sets out exceptions
(freedom of expression, legal obligation, public interest, legal claims).

Using ONLY the audit-chain events provided, describe:
1. Erasure requests received and the retention:deleted events evidencing fulfilment.
2. For each deletion event: the data category erased, the timestamp, and the
   legal basis for erasure or the exception invoked.
3. Evidence that AI agent training data or activity logs containing the data
   subject's data were also erased or anonymised.
4. Any erasure requests denied and the Art. 17(3) exception documented.
5. Third-party notification: where AI governance data was shared with sub-processors,
   evidence that erasure was propagated (Art. 17(2)).

${CITATION_INSTRUCTION}

Write 4-6 formal paragraphs.
`.trim(),
        },
        {
            id: 'gdpr-dsr-art18-restriction',
            title: 'Art. 18: Right to Restriction of Processing',
            citationRequirement: 'required',
            promptTemplate: `
You are drafting the Art. 18 (Right to Restriction) section for a GDPR Data
Subject Rights evidence report.

GDPR Art. 18 allows data subjects to restrict processing where: (a) accuracy is
contested, (b) processing is unlawful but the data subject opposes erasure, (c)
the controller no longer needs the data but the data subject needs it for legal
claims, (d) the data subject has objected under Art. 21 pending verification.

Using ONLY the audit-chain events provided, describe:
1. Restriction requests received and the pack-binding-changed events evidencing
   that processing scope was narrowed in response.
2. Evidence that restricted data was marked in the governance system (pack binding
   removal or tagging) preventing its use in AI agent processing.
3. Notification to the data subject that restriction has been lifted (Art. 19).
4. Any restriction periods and their end dates.

${CITATION_INSTRUCTION}

Write 3-5 formal paragraphs.
`.trim(),
        },
        {
            id: 'gdpr-dsr-art20-portability',
            title: 'Art. 20: Right to Data Portability',
            citationRequirement: 'required',
            promptTemplate: `
You are drafting the Art. 20 (Right to Data Portability) section for a GDPR Data
Subject Rights evidence report.

GDPR Art. 20 gives data subjects the right to receive their personal data in a
structured, commonly used, machine-readable format, and to transmit it to another
controller. Applies where processing is based on consent or contract and is
carried out by automated means.

For AI governance platforms, portability may cover:
  - The data subject's interaction history with AI agents
  - Decisions made by AI agents that affected the data subject
  - Profile data used for AI personalisation

Using ONLY the audit-chain events provided, describe:
1. Portability requests received and evidence of fulfilment.
2. The data format provided (structured, machine-readable per Art. 20(1)).
3. Any direct transmission to another controller (Art. 20(2)) evidenced in the chain.
4. Audit-chain events covering AI agent activity history exported to the data subject.

${CITATION_INSTRUCTION}

Write 3-5 formal paragraphs.
`.trim(),
        },
        {
            id: 'gdpr-dsr-art22-automated-decisions',
            title: 'Art. 22: Automated Individual Decision-Making and Profiling',
            citationRequirement: 'required',
            promptTemplate: `
You are drafting the Art. 22 (Automated Decision-Making) section for a GDPR Data
Subject Rights evidence report.

GDPR Art. 22(1) prohibits decisions based solely on automated processing, including
profiling, that produce legal or similarly significant effects on the data subject,
unless one of the three exceptions applies:
  (a) Necessary for a contract
  (b) Authorised by EU/member state law
  (c) Based on explicit consent

Art. 22(3) requires that where an exception applies, the controller implements
suitable safeguards, including at minimum the right to obtain human intervention,
to express their point of view, and to contest the decision.

Using ONLY the audit-chain events provided, describe:
1. AI agent decisions during the review period that produced significant effects
   on data subjects -- governance verdict events and their outcomes.
2. Whether any decision was made solely by an AI agent without human review
   (Art. 22(1) concern) -- identify such events and the exception invoked.
3. Human oversight safeguards: approval:decided events where a legal reviewer
   reviewed an AI governance decision affecting a data subject.
4. Evidence that data subjects were notified of automated decisions and their
   right to contest (Art. 22(3)(b)).

${CITATION_INSTRUCTION}

Write 4-6 formal paragraphs. This section has the highest legal-review priority.
`.trim(),
        },
        {
            id: 'gdpr-dsr-art5-accountability',
            title: 'Art. 5(2): Accountability Principle -- Governance Evidence',
            citationRequirement: 'required',
            promptTemplate: `
You are drafting the Art. 5(2) (Accountability) section for a GDPR Data Subject
Rights evidence report. Art. 5(2) requires the controller to be responsible for
and able to demonstrate compliance with Art. 5(1) principles (lawfulness, fairness,
transparency; purpose limitation; data minimisation; accuracy; storage limitation;
integrity and confidentiality).

Using ONLY the audit-chain events provided, demonstrate accountability for AI
governance:
1. Lawfulness: evidence that AI agents operated within declared legal bases
   (pack bindings reflect lawful processing purposes).
2. Purpose limitation: governance verdicts denying out-of-scope tool use.
3. Data minimisation: retention events showing data was deleted when no longer needed.
4. Integrity and confidentiality: enforcement events and anomaly detection showing
   active protection of data.
5. Storage limitation: evidence that retention schedules were enforced and data
   was deleted at the end of the permitted period.

${CITATION_INSTRUCTION}

Write 4-6 formal paragraphs.
`.trim(),
        },
    ],
};
//# sourceMappingURL=gdpr-data-subject-rights.js.map