"use strict";
/**
 * AU Privacy Act 1988 — Australian Privacy Principles (APPs 1-13)
 *
 * Primary statutes:
 *   - Privacy Act 1988 (Cth); Australian Privacy Principles (Schedule 1)
 *   - Privacy Legislation Amendment (Enhancing Online Privacy and Other Measures)
 *     Act 2021
 *   - Privacy and Other Legislation Amendment Act 2024 (royal assent October 2024,
 *     phased commencement 2026-2027)
 *
 * Entities covered: Australian Government agencies; private sector organisations
 * with annual turnover exceeding AUD 3 million; health service providers
 * regardless of size; operators of certain websites and online services with an
 * Australian link; credit reporting bodies; tax file number recipients. 2024
 * amendments expand coverage to small businesses that trade in personal
 * information.
 *
 * Key AI obligations:
 *   - APP 3: Collect only what is reasonably necessary (purpose limitation).
 *   - APP 6: Secondary uses (AI analytics, training) require separate basis.
 *   - APP 8: Overseas transfers require reasonable steps for comparable protection;
 *     AU entity liable for offshore recipient breaches.
 *   - APP 9: Government identifiers (TFN, Medicare) not adopted as internal IDs.
 *   - APP 11: Security measures; destroy or de-identify when no longer needed.
 *   - APP 12: Individual access within 30 days.
 *   - NDB Scheme (Part IIIC): 30-day internal assessment from awareness;
 *     OAIC + affected individuals notified on eligible breach.
 *   - 2024 amendments: AUD 50M penalty for serious/repeated interference;
 *     statutory tort for serious invasions of privacy.
 *
 * Cross-pack interactions:
 *   - au-privacy-act + au-cdr: CDR Privacy Safeguards are lex specialis for
 *     CDR data; APPs fill gaps. Dual OAIC + ACCC oversight.
 *   - au-privacy-act + au-cps234: APRA entities must meet CPS 234 for APP 11.
 *     CPS 234 is floor; APPs remain independently applicable.
 *   - au-privacy-act + gdpr: Both apply where AU organisation targets EU data
 *     subjects. GDPR Art. 6 lawful basis does not substitute for APP compliance;
 *     dual obligations; stricter governs per category.
 *   - au-privacy-act + hipaa: Where AU SaMD/clinical AI processes US patient data
 *     on AU infrastructure, HIPAA covers US-side; Privacy Act APPs cover AU-side.
 *
 * Authority: Office of the Australian Information Commissioner (OAIC)
 * Sovereignty: Australian Federal
 *
 * @connexum/ai-governance
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.AU_PRIVACY_ACT_PACK = exports.AU_PRIVACY_ACT_CATEGORY_CLASSIFIERS = void 0;
exports.AU_PRIVACY_ACT_CATEGORY_CLASSIFIERS = {
    AU_PI_INDIVIDUAL: {
        references: ['Privacy Act 1988 (Cth) s.6 — definition of personal information'],
        classifier: (input) => {
            if (/\b(?:au[_\-\s]?individual|australian\s+(?:person|resident|citizen)|personal\s+information)/i.test(input))
                return true;
            if (/\b(?:full\s+name|date\s+of\s+birth|home\s+address|phone\s+number|email\s+address)\b.*\b(?:australia|au\s+client|au\s+customer)/i.test(input))
                return true;
            return false;
        },
    },
    AU_PI_SENSITIVE: {
        references: ['Privacy Act 1988 s.6 — sensitive information; APP 3/6 heightened protection'],
        classifier: (input) => {
            if (/\b(?:health\s+information|biometric|racial\s+origin|ethnic\s+origin|political\s+opinion|religious\s+belief|sexual\s+orientation|criminal\s+record|trade\s+union\s+membership)/i.test(input))
                return true;
            return false;
        },
    },
    AU_PI_CHILD: {
        references: ['Privacy Act 1988 anticipated Children\'s Online Privacy Code (2024)'],
        classifier: (input) => {
            if (/\b(?:under\s*18|minor\s+user|child\s+(?:user|account|data)|age\s*[<:]\s*1[0-7]\b)/i.test(input))
                return true;
            return false;
        },
    },
    AU_PI_GOVERNMENT_ID: {
        references: ['Privacy Act 1988 APP 9 — government-related identifiers'],
        classifier: (input) => {
            // TFN: three-group numeric format (123 456 789) or inline
            if (/\b(?:TFN|tax\s+file\s+number)\b/i.test(input))
                return true;
            if (/\b\d{3}\s+\d{3}\s+\d{3}\b/.test(input))
                return true; // TFN pattern
            // Medicare
            if (/\b(?:medicare\s+(?:number|card|no)|Medicare\s+#)/i.test(input))
                return true;
            if (/\b\d{4}\s+\d{5}\s+\d{1}\b/.test(input))
                return true; // Medicare number pattern
            return false;
        },
    },
    AU_PI_OFFSHORE_TRANSFER: {
        references: ['Privacy Act 1988 APP 8 — cross-border disclosure of personal information'],
        classifier: (input) => {
            if (/\b(?:transfer(?:ring|red)?\s+(?:to\s+)?(?:overseas|offshore|outside\s+australia)|cross[_\-\s]?border\s+(?:data|transfer|disclosure)|overseas\s+(?:recipient|processor|provider))/i.test(input))
                return true;
            return false;
        },
    },
    AU_PI_SECONDARY_USE: {
        references: ['Privacy Act 1988 APP 6 — use and disclosure for secondary purpose'],
        classifier: (input) => {
            if (/\b(?:secondary\s+(?:use|purpose|analytics)|ai\s+training\s+(?:data|on\s+customer)|model\s+training.*personal\s+information|re[_\-]?use.*personal\s+information\s+for)/i.test(input))
                return true;
            return false;
        },
    },
    AU_PI_AUTOMATED_DECISION: {
        references: ['Privacy and Other Legislation Amendment Act 2024 — automated decisions transparency'],
        classifier: (input) => {
            if (/\b(?:automated\s+(?:decision|decision[_\-]making|scoring|assessment)|ai[_\-\s]?(?:decision|determination|verdict|recommendation).*(?:individual|customer|applicant))/i.test(input))
                return true;
            return false;
        },
    },
    AU_PI_RETENTION_ELAPSED: {
        references: ['Privacy Act 1988 APP 11 — security and de-identification when no longer needed'],
        classifier: (input) => {
            if (/\b(?:retention\s+(?:period\s+)?(?:elapsed|expired|exceeded|overdue)|data\s+(?:held\s+beyond|past)\s+retention|no\s+longer\s+needed.*personal\s+information)/i.test(input))
                return true;
            return false;
        },
    },
};
exports.AU_PRIVACY_ACT_PACK = {
    categoryClassifiers: exports.AU_PRIVACY_ACT_CATEGORY_CLASSIFIERS,
    /**
     * P3.5: PI of AU individuals is subject-keyed — every processing event
     * must carry a data subject identifier to satisfy APP 12 access-right
     * tracking and the NDB disclosure obligation under Part IIIC.
     * Retention-elapsed is non-subject-keyed (bulk schedule enforcement).
     */
    subjectKeyedCategories: [
        'AU_PI_INDIVIDUAL',
        'AU_PI_SENSITIVE',
        'AU_PI_CHILD',
        'AU_PI_GOVERNMENT_ID',
        'AU_PI_OFFSHORE_TRANSFER',
        'AU_PI_SECONDARY_USE',
        'AU_PI_AUTOMATED_DECISION',
    ],
    id: 'au-privacy-act',
    name: 'AU Privacy Act 1988 — Australian Privacy Principles (APPs 1-13)',
    version: '1.0.0',
    description: 'Privacy Act 1988 (Cth) compliance for AI systems processing personal information of Australian individuals. Covers APPs 1-13, NDB breach notification (30-day assessment), APP 9 government identifier prohibition, APP 8 overseas transfer controls, and 2024 amendments including AUD 50M penalties and statutory tort for serious privacy invasions.',
    authority: 'Office of the Australian Information Commissioner (OAIC)',
    industries: [
        'all-au', 'healthcare', 'fintech', 'edtech', 'saas',
        'retail', 'legal', 'insurance', 'government',
    ],
    requiredModules: [
        {
            name: 'governance-runtime',
            required: true,
            reason: 'APP 6 secondary-use basis enforcement; APP 8 overseas-transfer gate; APP 9 government-identifier block; automated decision disclosure (2024 amendments)',
            reference: 'Privacy Act 1988 APP 6, APP 8, APP 9; Privacy and Other Legislation Amendment Act 2024',
        },
        {
            name: 'audit-integrity',
            required: true,
            reason: 'NDB assessment audit trail; disclosure records per data subject for APP 12 access tracking',
            reference: 'Privacy Act 1988 Part IIIC (NDB scheme); APP 12 (access); APP 5 (notification)',
        },
        {
            name: 'encryption-layer',
            required: true,
            reason: 'APP 11 security obligation — reasonable technical measures protecting PI at rest and in transit',
            reference: 'Privacy Act 1988 APP 11',
        },
        {
            name: 'data-classifier',
            required: true,
            reason: 'Classify PI categories, detect sensitive information, government identifiers, children\'s data, secondary-use events, overseas transfers',
            reference: 'Privacy Act 1988 s.6 (definitions); APP 3; APP 9',
        },
        {
            name: 'session-persistence',
            required: true,
            reason: 'Per-data-subject rights tracking; consent lifecycle; retention schedule enforcement',
            reference: 'Privacy Act 1988 APP 12 (access 30d); APP 13 (correction); APP 11 (retention)',
        },
        {
            name: 'supply-chain',
            required: true,
            reason: 'APP 8 overseas recipient contractual controls; AI vendor data processing agreements with APP-equivalent protections',
            reference: 'Privacy Act 1988 APP 8',
        },
        {
            name: 'approval-queue',
            required: true,
            reason: 'Secondary-use approval gate; overseas transfer approval; automated decision approval (2024); NDB notification workflow',
            reference: 'Privacy Act 1988 APP 6; APP 8; Part IIIC',
        },
        {
            name: 'transparency-injector',
            required: true,
            reason: 'APP 5 collection notice; APP 1 privacy policy disclosure of AI data flows and automated processing',
            reference: 'Privacy Act 1988 APP 1, APP 5',
        },
        {
            name: 'event-bus',
            required: true,
            reason: 'NDB eligible-breach event stream; consent-revocation events; APP 8 offshore transfer events',
            reference: 'Privacy Act 1988 Part IIIC (NDB); APP 12/13 access/correction workflow',
        },
    ],
    moduleConfig: {
        'data-classifier': {
            enabledCategories: [
                'AU_PI_INDIVIDUAL',
                'AU_PI_SENSITIVE',
                'AU_PI_CHILD',
                'AU_PI_GOVERNMENT_ID',
                'AU_PI_OFFSHORE_TRANSFER',
                'AU_PI_SECONDARY_USE',
                'AU_PI_AUTOMATED_DECISION',
                'AU_PI_RETENTION_ELAPSED',
            ],
            sensitiveInfoApprovalRequired: true,
            offshoreTransferApprovalRequired: true,
            secondaryUseApprovalRequired: true,
            automatedDecisionLoggingActive: true,
            govtIdUnauthorisedUseBlock: true,
        },
        'governance-runtime': {
            sensitiveInfoApprovalRequired: true,
            offshoreTransferApprovalRequired: true,
            secondaryUseApprovalRequired: true,
            automatedDecisionLoggingActive: true,
            govtIdUnauthorisedUseBlock: true,
            ndbAssessmentDays: 30,
            accessRequestSlaDays: 30,
            retentionScheduleEnforced: true,
        },
        'session-persistence': {
            perSubjectRightsTrackingRequired: true,
            accessRequestSlaDays: 30,
        },
        'supply-chain': {
            overseasRecipientContractRequired: true,
            appEquivalentProtectionRequired: true,
        },
        'approval-queue': {
            sensitiveInfoGateRequired: true,
            offshoreTransferGateRequired: true,
            secondaryUseGateRequired: true,
            ndbNotificationWorkflowRequired: true,
        },
        'transparency-injector': {
            collectionNoticeRequired: true,
            aiDataFlowDisclosureRequired: true,
        },
    },
    providerPolicy: {
        blockedProviders: [],
        requiredCapabilities: [
            'DATA-RESIDENCY-AU-OR-EQUIVALENT',
            'ZERO-TRAINING-ON-INPUTS',
            'APP8-CONTRACTUAL-PROTECTIONS',
        ],
        blockReasons: {},
    },
    dataPolicy: {
        scanCategories: [
            'AU_PI_INDIVIDUAL',
            'AU_PI_SENSITIVE',
            'AU_PI_CHILD',
            'AU_PI_GOVERNMENT_ID',
            'AU_PI_OFFSHORE_TRANSFER',
            'AU_PI_SECONDARY_USE',
            'AU_PI_AUTOMATED_DECISION',
            'AU_PI_RETENTION_ELAPSED',
        ],
        categoryActions: {
            AU_PI_INDIVIDUAL: 'LOG',
            AU_PI_SENSITIVE: 'REQUIRE_APPROVAL',
            AU_PI_CHILD: 'REQUIRE_APPROVAL',
            AU_PI_GOVERNMENT_ID: 'BLOCK',
            AU_PI_OFFSHORE_TRANSFER: 'REQUIRE_APPROVAL',
            AU_PI_SECONDARY_USE: 'REQUIRE_APPROVAL',
            AU_PI_AUTOMATED_DECISION: 'REQUIRE_APPROVAL',
            AU_PI_RETENTION_ELAPSED: 'WARN',
        },
        encryptionRequired: true,
        encryptionStandard: 'AES-256',
        minimumClassification: 'CONFIDENTIAL',
    },
    retentionPolicy: {
        sovereignty: ['AU'],
        // NDB notifications: 5 years; APP 8 overseas disclosure records: 7 years;
        // Consent records: duration + 5 years; Access/correction: 7 years.
        // Runtime default: 7 years (most conservative standard).
        auditLogRetentionDays: 2555, // 7 years
        sessionRetentionDays: 2555,
        incidentRetentionDays: 1825, // 5 years (NDB standard)
        reference: 'Privacy Act 1988 APP 8 overseas disclosure records (7y); APP 12 access records (7y); NDB notifications (5y)',
    },
    incidentPolicy: {
        notificationDeadlineHours: 720, // 30 days = 720 hours (NDB internal assessment)
        reference: 'Privacy Act 1988 Part IIIC s.26WK — 30 days from awareness of potential eligible data breach',
        requiredRecipients: ['oaic', 'affected-individuals'],
        formalNotificationRequired: true,
    },
    validators: [
        {
            id: 'au-privacy-sensitive-gate',
            description: 'Sensitive PI (health, biometric, racial, religious, sexual orientation) requires approval gate',
            reference: 'Privacy Act 1988 APP 3 (collection), APP 6 (use/disclosure)',
            check: 'au_privacy_sensitive_gate_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'au-privacy-offshore-gate',
            description: 'Overseas transfer of PI requires approval and APP 8 comparable-protection confirmation',
            reference: 'Privacy Act 1988 APP 8',
            check: 'au_privacy_offshore_gate_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'au-privacy-ndb-timer',
            description: 'NDB internal assessment completed within 30 days of awareness of potential eligible breach',
            reference: 'Privacy Act 1988 Part IIIC s.26WK',
            check: 'au_privacy_ndb_timer_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'au-privacy-govt-id-block',
            description: 'Government identifier (TFN, Medicare number) use blocked outside authorised purpose',
            reference: 'Privacy Act 1988 APP 9',
            check: 'au_privacy_govt_id_block_active',
            failSeverity: 'CRITICAL',
        },
        {
            id: 'au-privacy-secondary-use-gate',
            description: 'Secondary use or disclosure of PI blocked without lawful basis or consent',
            reference: 'Privacy Act 1988 APP 6',
            check: 'au_privacy_secondary_use_gate_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'au-privacy-automated-decision-log',
            description: 'Automated decisions with significant individual effect logged and disclosed per 2024 amendments',
            reference: 'Privacy and Other Legislation Amendment Act 2024',
            check: 'au_privacy_automated_decision_log_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'au-privacy-access-sla',
            description: 'Individual access requests actioned within 30-day SLA',
            reference: 'Privacy Act 1988 APP 12',
            check: 'au_privacy_access_sla_active',
            failSeverity: 'HIGH',
        },
        {
            id: 'au-privacy-retention-check',
            description: 'PI destruction or de-identification enforced when no longer needed for primary purpose',
            reference: 'Privacy Act 1988 APP 11',
            check: 'au_privacy_retention_check_active',
            failSeverity: 'MEDIUM',
        },
    ],
};
//# sourceMappingURL=au-privacy-act.js.map