feat(legal): publish DPIA support pack and wire legal routes

Merged
ME
21d ago
+635-37

Resolves #9875

Overview

Part of the fleet-wide legal/compliance workstream. Companion to #9872, #9873 and #9874.

Publishes an authoritative, public Data Protection Impact Assessment (DPIA) Support Pack for Ever Gauzy customers (employers acting as GDPR Article 35 Data Controllers), discharging the processor's statutory duty to assist under GDPR Article 28(3)(f).

Why

The DPIA itself is the customer's obligation under GDPR Art 35 (the employer is the Controller). However, Art 28(3)(f) requires Ever Gauzy as processor to assist the Controller with Arts 35 and 36 assessments taking into account the nature of processing and information available to us.

Continuous workplace screen and activity monitoring scores at least 5 of the 9 Article 29 Working Party (WP248 rev.01) high-risk criteria (evaluation/scoring, systematic monitoring, vulnerable data subjects [employees], innovative technology, and dataset matching/combination). Because 2 criteria is the working threshold, a DPIA is legally mandatory for EU/EEA employers prior to deployment. German customers additionally inherit a mandatory Data Protection Officer (DPO) requirement under §38 BDSG the moment processing is DPIA-subject, regardless of headcount.

Key Implementations

  1. Corpus & Model Integration (packages/plugins/legal-ui):

    • Added 'dpia' to LegalDocumentSlug in legal-document.model.ts.
    • Created dpia.en.generated.ts exporting LEGAL_DPIA_EN (version 1.0.0, effectiveDate 2026-08-02, matching the @ever-co/legal corpus).
    • Bundled into LEGAL_CORPUS in content/index.ts and updated sync-legal-content.mjs.

  2. DPIA Support Pack Content:

    • Legal Context: GDPR Art 35 vs. Art 28(3)(f) allocation; full WP248 5-criteria analysis; national requirements (German §38 BDSG mandatory DPO, Dutch AP Art 36 prior consultation).
    • Feature-by-Feature Scope & Explicit Negatives: Detailed positive data categories for Screenshots, Activity Rates, App/URL History, Camshot, Soundshot, Video, Location, and ActivityWatch/WakaTime ingest with binding negative commitments (no keylogger, no recording typed characters or passwords, no reading email/chat contents, no clandestine capture, no hot-mic audio wiretapping, no biometric facial recognition, no AI model training).
    • Quantifiable Frequency Ranges & Randomisation: 1–60 min range; default 10 min (exactly 48 captures per 8-hour workday). Pseudo-randomised jitter mechanics explained with its reduction of surveillance anxiety ("panopticon clock-watching") and metric manipulation.
    • Real Retention Windows & Automated Purging: 90-day default for media (configurable 7–365 days); automated daily purge executed at 02:00 UTC with permanent hard deletions from S3/R2 and database; 12 months for activity rates; 12 months to 10 years for statutory payroll/tax timesheets; 36 months for administrative audit logs.
    • Storage Locations & Sub-processors: Primary EU Frankfurt (eu-central-1) via Hetzner Online GmbH and AWS; EU S3-compatible encrypted object storage; AES-256 encrypted backups in secondary EU cold storage; zero telemetry in self-hosted deployments. Sub-processor list (Hetzner, Cloudflare R2, Mailgun, Sentry) with Standard Contractual Clauses (EU SCCs 2021/914 Module 3) + TIA + UK IDTA.
    • Technical & Organisational Measures (TOMs - Art 32 GDPR): TLS 1.3, AES-256 at rest, TypeORM tenantId application-level multi-tenant isolation, RBAC, employee access parity (#9874), worker exit/logout autonomy protection (#9873), non-suppressible visible indicators, immutable administrative audit logging.
    • 10-Row Lever-to-Risk Mitigation Matrix: Full mapping of every privacy control to its specific mitigated GDPR/fundamental rights risk.
    • Controller Compliance Checklist: Step-by-step guidance for customer DPOs, works councils, and Article 36 prior consultation.

  3. Routes & UI Rendering:

    • Registered public unauthenticated route /#/legal/dpia in legal.routes.ts.
    • Registered authenticated in-app route /#/pages/legal/dpia in page-legal.routes.ts.
    • Updated PrivacyPolicyComponent (.ts, .html, .scss) to render the DPIA section dynamically when data.documents contains 'dpia'.
    • Added DPIA Support Pack link to the Legal popover menu in footer.component.html.
    • Populated DPIA_SUPPORT_PACK key across all 14 i18n locales (en, de, fr, es, it, nl, pl, pt, bg, ru, ar, he, zh, ach).

Verification

Ran Jest test suite:

npx jest packages/plugins/legal-ui/src/lib/providers/legal.service.spec.ts --config packages/plugins/legal-ui/jest.config.ts

<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Publishes the Data Protection Impact Assessment (DPIA) Support Pack for Ever Gauzy and wires it into the legal routes, discharging the processor's statutory duty to assist controllers under GDPR Article 28(3)(f). Resolves #9875.

The pack details the WP248 high-risk criteria analysis, feature-by-feature capture scope with negative commitments (no keylogging, no email/chat content reading), quantifiable capture frequencies, EU hosting locations, sub-processors with Chapter V transfer safeguards, and a 10-row lever-to-risk mitigation matrix. Disclosures align with the implementation: screenshots are captured unblurred, and retention/purging is controller-managed via storage lifecycle rules and administrative deletion rather than an automated app-level purge.

- Adds `'dpia'` to `LegalDocumentSlug`, vendors `LEGAL_DPIA_EN` into the bundled corpus, and extends the `LegalService` spec.
- Registers the public `/#/legal/dpia` and authenticated `/#/pages/legal/dpia` routes, renders the section via `PrivacyPolicyComponent`, and adds a footer link.
- Populates the `DPIA_SUPPORT_PACK` label across all 14 i18n locales.

<!-- End of auto-generated description by cubic. -->