개인정보 영향평가

# DPIA 자동화 평가 시스템
from dataclasses import dataclass, field
from typing import List, Dict, Optional
from datetime import datetime
from enum import Enum

class RiskLevel(Enum):
    """위험 수준"""
    LOW = "low"
    MEDIUM = "medium"
    HIGH = "high"
    VERY_HIGH = "very_high"

class DPIATrigger(Enum):
    """DPIA 의무 트리거 (GDPR Article 35)"""
    AUTOMATED_DECISION = "systematic_automated_decision"  # 자동화 의사결정
    SENSITIVE_DATA_LARGE_SCALE = "sensitive_large_scale"  # 민감정보 대규모
    PUBLIC_MONITORING = "public_area_monitoring"          # 공개장소 모니터링
    PROFILING = "profiling_with_legal_effect"            # 법적효과 프로파일링
    NEW_TECHNOLOGY = "new_technology_high_risk"          # 신기술 고위험
    AI_HIGH_RISK = "ai_act_high_risk"                    # EU AI Act 고위험

@dataclass
class ProcessingActivity:
    """개인정보 처리 활동"""
    name: str
    purpose: str
    legal_basis: str
    data_categories: List[str]
    data_subjects: List[str]
    recipients: List[str]
    retention_period: str
    transfers_outside_eea: bool = False
    automated_decision: bool = False
    profiling: bool = False
    uses_ai: bool = False
    ai_risk_level: Optional[str] = None

@dataclass
class DPIAAssessment:
    """DPIA 평가"""
    id: str
    processing: ProcessingActivity
    assessor: str
    dpo_consulted: bool = False
    created_at: datetime = field(default_factory=datetime.now)

    # 평가 결과
    triggers: List[DPIATrigger] = field(default_factory=list)
    risks: List[Dict] = field(default_factory=list)
    mitigations: List[Dict] = field(default_factory=list)
    overall_risk: Optional[RiskLevel] = None
    approved: bool = False

    def check_dpia_required(self) -> Dict:
        """DPIA 필요성 판단"""
        triggers_found = []

        # 자동화 의사결정 체크
        if self.processing.automated_decision:
            triggers_found.append(DPIATrigger.AUTOMATED_DECISION)

        # 민감정보 대규모 처리 체크
        sensitive_categories = ["health", "biometric", "genetic", "racial", "political", "religious", "sexual"]
        if any(cat in self.processing.data_categories for cat in sensitive_categories):
            triggers_found.append(DPIATrigger.SENSITIVE_DATA_LARGE_SCALE)

        # 프로파일링 체크
        if self.processing.profiling:
            triggers_found.append(DPIATrigger.PROFILING)

        # AI 고위험 체크
        if self.processing.uses_ai and self.processing.ai_risk_level == "high":
            triggers_found.append(DPIATrigger.AI_HIGH_RISK)

        self.triggers = triggers_found

        return {
            "dpia_required": len(triggers_found) > 0,
            "triggers": [t.value for t in triggers_found],
            "legal_basis": "GDPR Article 35(3)" if triggers_found else None,
            "recommendation": "DPIA 수행 필수" if triggers_found else "DPIA 권장 (선제적 평가)"
        }

    def assess_risks(self) -> List[Dict]:
        """위험 평가"""
        risks = []

        # 데이터 범위 위험
        if len(self.processing.data_subjects) > 1000:
            risks.append({
                "category": "데이터 규모",
                "description": "대규모 정보주체 영향",
                "likelihood": "high",
                "impact": "high",
                "risk_level": RiskLevel.HIGH
            })

        # 민감정보 위험
        sensitive = ["health", "biometric", "genetic"]
        if any(cat in self.processing.data_categories for cat in sensitive):
            risks.append({
                "category": "민감정보",
                "description": "특수 범주 개인정보 처리",
                "likelihood": "medium",
                "impact": "very_high",
                "risk_level": RiskLevel.VERY_HIGH
            })

        # 국외이전 위험
        if self.processing.transfers_outside_eea:
            risks.append({
                "category": "국외이전",
                "description": "EEA 외부 개인정보 이전",
                "likelihood": "medium",
                "impact": "high",
                "risk_level": RiskLevel.HIGH
            })

        # AI 관련 위험
        if self.processing.uses_ai:
            risks.append({
                "category": "AI 시스템",
                "description": "알고리즘 편향, 투명성 부족 위험",
                "likelihood": "medium",
                "impact": "high",
                "risk_level": RiskLevel.HIGH
            })

        self.risks = risks
        return risks

    def add_mitigation(self, risk_category: str, measure: str, residual_risk: RiskLevel):
        """위험 완화 조치 추가"""
        self.mitigations.append({
            "risk_category": risk_category,
            "measure": measure,
            "residual_risk": residual_risk.value,
            "implemented": False
        })

    def calculate_overall_risk(self) -> RiskLevel:
        """전체 위험 수준 계산"""
        if not self.risks:
            return RiskLevel.LOW

        risk_scores = {
            RiskLevel.LOW: 1,
            RiskLevel.MEDIUM: 2,
            RiskLevel.HIGH: 3,
            RiskLevel.VERY_HIGH: 4
        }

        max_risk = max(r["risk_level"] for r in self.risks)
        self.overall_risk = max_risk
        return max_risk

    def generate_report(self) -> Dict:
        """DPIA 보고서 생성"""
        return {
            "dpia_id": self.id,
            "processing_activity": self.processing.name,
            "assessment_date": self.created_at.isoformat(),
            "assessor": self.assessor,
            "dpo_consulted": self.dpo_consulted,
            "section_1_description": {
                "purpose": self.processing.purpose,
                "legal_basis": self.processing.legal_basis,
                "data_categories": self.processing.data_categories,
                "data_subjects": self.processing.data_subjects
            },
            "section_2_necessity": {
                "proportionality": "처리 목적 달성에 필요한 최소한의 정보만 처리",
                "data_minimization": True
            },
            "section_3_risks": self.risks,
            "section_4_mitigations": self.mitigations,
            "conclusion": {
                "overall_risk": self.overall_risk.value if self.overall_risk else "not_assessed",
                "residual_risk_acceptable": self.overall_risk in [RiskLevel.LOW, RiskLevel.MEDIUM] if self.overall_risk else False,
                "prior_consultation_required": self.overall_risk == RiskLevel.VERY_HIGH if self.overall_risk else False
            }
        }

# 사용 예시
processing = ProcessingActivity(
    name="AI 채용 스크리닝 시스템",
    purpose="이력서 자동 분석 및 후보자 순위화",
    legal_basis="정당한 이익 (GDPR Article 6(1)(f))",
    data_categories=["employment_history", "education", "skills"],
    data_subjects=["job_applicants"],
    recipients=["HR_department", "hiring_managers"],
    retention_period="채용 완료 후 2년",
    automated_decision=True,
    profiling=True,
    uses_ai=True,
    ai_risk_level="high"
)

dpia = DPIAAssessment(
    id="DPIA-2024-001",
    processing=processing,
    assessor="개인정보보호팀",
    dpo_consulted=True
)

# DPIA 필요성 확인
requirement = dpia.check_dpia_required()
print(f"DPIA 필요: {requirement['dpia_required']}")
print(f"트리거: {requirement['triggers']}")

# 위험 평가
risks = dpia.assess_risks()
dpia.calculate_overall_risk()
print(f"전체 위험 수준: {dpia.overall_risk.value}")