"use strict";
/**
 * Hong Kong Personal Data (Privacy) Ordinance Compliance Pack
 *
 * Statute: Personal Data (Privacy) Ordinance (Cap. 486). HK's
 *   foundational data-protection statute since 1995, materially amended
 *   in 2021 (anti-doxxing) and 2022 (criminal offence reforms).
 *
 * Jurisdiction: Hong Kong SAR
 * Authority: Office of the Privacy Commissioner for Personal Data
 *   (PCPD)
 *
 * Six Data Protection Principles (Schedule 1):
 *   DPP1 — Collection (purpose, lawful + fair, necessary, notify)
 *   DPP2 — Accuracy + Retention
 *   DPP3 — Use (consistent with original purpose)
 *   DPP4 — Security
 *   DPP5 — Information available (privacy policy + practices)
 *   DPP6 — Access + correction
 *
 * 2021 amendment — anti-doxxing offence (s.64 PDPO; specific intent
 *   doxxing; up to HK$1M fine + 5 years imprisonment).
 *
 * Why this pack:
 *   - HK PDPO is the baseline data-protection statute for HK; distinct
 *     from PRC PIPL + DSL + CSL (which apply to mainland China).
 *   - Material differences from GDPR: no general consent requirement;
 *     no DPO mandatory; no statutory data-breach notification (though
 *     PCPD voluntary scheme operates).
 *
 * @connexum/ai-governance
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.HK_PDPO_PACK = exports.HK_PDPO_CATEGORY_CLASSIFIERS = void 0;
exports.HK_PDPO_CATEGORY_CLASSIFIERS = {
    DPP_PRINCIPLE: {
        references: ['HK PDPO Schedule 1 — Six Data Protection Principles'],
        classifier: (i) => /\b(?:dpp[1-6]|hk\s+pdpo\s+principle|personal\s+data\s+privacy\s+ordinance\s+principle)\b/i.test(i),
    },
    HK_PII: {
        references: ['HK PDPO s.2 personal data definition'],
        classifier: (i) => /\b(?:hk\s+id\s+(?:card|number)|hkid|hong\s+kong\s+identity\s+card)\b/i.test(i),
    },
    PCPD_NOTIFICATION: {
        references: ['HK PCPD voluntary breach notification scheme'],
        classifier: (i) => /\b(?:pcpd\s+(?:notification|investigation|complaint|enquiry)|privacy\s+commissioner\s+hong\s+kong)\b/i.test(i),
    },
    ANTI_DOXXING: {
        references: ['HK PDPO s.64 anti-doxxing offence (2021 amendment)'],
        classifier: (i) => /\b(?:doxxing|s\.?\s*64\s+pdpo|specific\s+intent\s+doxxing|anti[\s-]?doxxing\s+hk)\b/i.test(i),
    },
    CROSS_BORDER_TRANSFER_HK: {
        references: ['HK PDPO s.33 cross-border transfer (not yet operative; voluntary practice)'],
        classifier: (i) => /\b(?:s\.?\s*33\s+pdpo|cross[\s-]?border\s+transfer\s+hk|hk\s+international\s+transfer)\b/i.test(i),
    },
    CREDENTIALS: {
        references: ['Cross-pack secrets safety'],
        classifier: (i) => {
            if (/\b(?:api[_-]?key|apikey)\s*[=:]\s*["']?[A-Za-z0-9_\-\/+]{16,}["']?/i.test(i))
                return true;
            if (/\bpassword\s*[=:]\s*["']?[A-Za-z0-9!@#$%^&*_\-]{8,}["']?/i.test(i))
                return true;
            if (/-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/.test(i))
                return true;
            return false;
        },
    },
};
exports.HK_PDPO_PACK = {
    categoryClassifiers: exports.HK_PDPO_CATEGORY_CLASSIFIERS,
    id: 'hk-pdpo',
    aliases: ['hong-kong-pdpo', 'pdpo-hk', 'cap-486', 'personal-data-privacy-ordinance'],
    name: 'Hong Kong Personal Data (Privacy) Ordinance (Cap. 486)',
    version: '1.0.0',
    contentHash: 'd47dceeee00d0e9adea91fef0336b2144ea14b41d590505e95c0c6acc110eed7',
    description: 'Hong Kong baseline data-protection statute since 1995. Six Data Protection Principles (DPP1-6 in Schedule 1) covering collection / accuracy + retention / use / security / openness / access. 2021 anti-doxxing amendment (s.64). Distinct from PRC PIPL + DSL + CSL (mainland China). Materially differs from GDPR: no general consent requirement, no mandatory DPO, no statutory breach notification (PCPD voluntary scheme).',
    authority: 'Office of the Privacy Commissioner for Personal Data (PCPD)',
    industries: ['technology', 'financial-services', 'healthcare', 'retail', 'media', 'legal', 'professional-services'],
    requiredModules: [
        { name: 'governance-runtime', required: true, reason: 'DPP1 collection lawfulness gate; DPP3 purpose-limitation enforcement; s.64 anti-doxxing default-deny on doxxing-pattern outputs.', reference: 'HK PDPO Schedule 1 + s.64' },
        { name: 'attestation-manager', required: true, reason: 'DPP5 privacy policy + personal information collection statement (PICS) tracking; DPP6 data-access-request log.', reference: 'HK PDPO DPP5 + DPP6' },
        { name: 'data-classifier', required: true, reason: 'HK PII detection (HKID, HK passport); DPP-evidence categorisation; doxxing-pattern detection.', reference: 'HK PDPO DPP1' },
        { name: 'audit-integrity', required: true, reason: 'Tamper-evident audit chain for DPP4 security evidence + PCPD investigation evidence.', reference: 'HK PDPO DPP4 + PCPD investigations' },
        { name: 'event-bus', required: true, reason: 'PCPD voluntary breach notification routing; data-access-request escalation.', reference: 'HK PCPD voluntary scheme; DPP6' },
        { name: 'transparency-injector', required: true, reason: 'PICS publication; DPP5 information-availability + privacy policy.', reference: 'HK PDPO DPP5' },
        { name: 'agent-auth', required: true, reason: 'Identity binding for data-access requests; named data-protection officer when designated.', reference: 'HK PDPO DPP6' },
        { name: 'session-persistence', required: true, reason: 'DPP2 retention enforcement; do not retain longer than necessary.', reference: 'HK PDPO DPP2' },
        { name: 'encryption-layer', required: true, reason: 'DPP4 security: appropriate technical measures including encryption.', reference: 'HK PDPO DPP4' },
        { name: 'supply-chain', required: true, reason: 'Sub-processor accountability; DPP4 cascade.', reference: 'HK PDPO DPP4 sub-processor accountability' },
        { name: 'approval-queue', required: true, reason: 'Cross-border transfer approval (s.33 voluntary); doxxing-borderline content review.', reference: 'HK PDPO s.33 + s.64' },
    ],
    moduleConfig: {
        'governance-runtime': { dpp1CollectionLawfulnessGateRequired: true, dpp3PurposeLimitationGateRequired: true, antiDoxxingDefaultDenyRequired: true },
        'attestation-manager': { picsPublicationTracked: true, dataAccessRequestLogRequired: true },
        'data-classifier': { enabledCategories: ['DPP_PRINCIPLE', 'HK_PII', 'PCPD_NOTIFICATION', 'ANTI_DOXXING', 'CROSS_BORDER_TRANSFER_HK', 'CREDENTIALS'], hkPiiAction: 'WARN', credentialsAction: 'BLOCK' },
        'audit-integrity': { pcpdInvestigationEvidenceTrackingRequired: true },
        'event-bus': { pcpdBreachRoutingRequired: true, accessRequestEscalationRequired: true },
        'transparency-injector': { picsPublicationRequired: true },
        'agent-auth': { dataAccessRequestIdentityBindingRequired: true },
        'session-persistence': { retentionDaysMinimum: 1095 },
        'encryption-layer': { algorithm: 'aes-256-gcm', dpp4SecurityRequired: true },
        'supply-chain': { processorAccountabilityRequired: true },
        'approval-queue': { reviewTier: 'T2' },
    },
    providerPolicy: { blockedProviders: [], requiredCapabilities: ['HK-DATA-RESIDENCY-AVAILABLE', 'PROCESSOR-CONTRACT'], blockReasons: {} },
    dataPolicy: {
        scanCategories: ['DPP_PRINCIPLE', 'HK_PII', 'PCPD_NOTIFICATION', 'ANTI_DOXXING', 'CROSS_BORDER_TRANSFER_HK', 'CREDENTIALS'],
        categoryActions: { DPP_PRINCIPLE: 'WARN', HK_PII: 'WARN', PCPD_NOTIFICATION: 'WARN', ANTI_DOXXING: 'BLOCK', CROSS_BORDER_TRANSFER_HK: 'WARN', CREDENTIALS: 'BLOCK' },
        encryptionRequired: true, encryptionStandard: 'AES-256-GCM', minimumClassification: 'RESTRICTED',
    },
    retentionPolicy: { auditLogRetentionDays: 1095, sessionRetentionDays: 1095, incidentRetentionDays: 2190, reference: 'HK PDPO DPP2 retention principle; civil-claim limitation', forceDelete: false, requiresLegalHoldSupport: true, sovereignty: ['hk'] },
    incidentPolicy: { notificationDeadlineHours: 72, reference: 'PCPD voluntary breach notification scheme', requiredRecipients: ['pcpd', 'data-protection-officer-hk', 'legal-counsel'], formalNotificationRequired: false },
    validators: [
        { id: 'hk-pdpo-dpp1-collection', description: 'DPP1 collection lawfulness + purpose specification + collection statement.', reference: 'HK PDPO DPP1', check: 'governance_active', failSeverity: 'CRITICAL' },
        { id: 'hk-pdpo-dpp2-retention', description: 'DPP2 accuracy + retention; data not retained longer than necessary.', reference: 'HK PDPO DPP2', check: 'retention_policy_active', failSeverity: 'HIGH' },
        { id: 'hk-pdpo-dpp3-purpose-limitation', description: 'DPP3 use consistent with original purpose.', reference: 'HK PDPO DPP3', check: 'governance_active', failSeverity: 'CRITICAL' },
        { id: 'hk-pdpo-dpp4-security', description: 'DPP4 security: appropriate technical measures including encryption.', reference: 'HK PDPO DPP4', check: 'encryption_active', failSeverity: 'CRITICAL' },
        { id: 'hk-pdpo-dpp5-pics', description: 'DPP5 information availability: PICS published + privacy policy.', reference: 'HK PDPO DPP5', check: 'transparency_active', failSeverity: 'HIGH' },
        { id: 'hk-pdpo-dpp6-access', description: 'DPP6 data-access + correction request workflow active.', reference: 'HK PDPO DPP6', check: 'monitoring_active', failSeverity: 'HIGH' },
        { id: 'hk-pdpo-anti-doxxing', description: 's.64 anti-doxxing offence: default-deny on doxxing-pattern outputs.', reference: 'HK PDPO s.64 (2021 amendment)', check: 'governance_active', failSeverity: 'CRITICAL' },
        { id: 'hk-pdpo-pcpd-cooperation', description: 'PCPD investigation cooperation + voluntary breach notification routing.', reference: 'HK PCPD scheme', check: 'monitoring_active', failSeverity: 'HIGH' },
        { id: 'hk-pdpo-supplier-flow-down', description: 'Sub-processor DPP4 cascade attested.', reference: 'HK PDPO DPP4 sub-processor accountability', check: 'subservice_registry_active', failSeverity: 'MEDIUM' },
        { id: 'hk-pdpo-credential-block', description: 'Plaintext credentials blocked.', reference: 'HK PDPO DPP4', check: 'data_classifier_active', failSeverity: 'CRITICAL' },
    ],
};
//# sourceMappingURL=hk-pdpo.js.map