隐私设计（Privacy by Design）#

/**
 * 数据最小化验证器
 * 在数据收集时进行必要性检查
 */
@Service
public class DataMinimizationValidator {
    
    private final Map<String, List<RequiredField>> purposeFieldMapping;
    
    /**
     * 验证数据收集请求是否符合最小化原则
     */
    public MinimizationCheckResult validateCollection(CollectionRequest request) {
        List<String> requiredFields = purposeFieldMapping.get(request.getPurpose());
        List<String> requestedFields = request.getFields();
        
        List<String> unnecessaryFields = requestedFields.stream()
            .filter(field -> !requiredFields.contains(field))
            .collect(Collectors.toList());
        
        if (!unnecessaryFields.isEmpty()) {
            return MinimizationCheckResult.failure(
                "以下字段对于 " + request.getPurpose() + " 目的并非必需: " 
                + unnecessaryFields
            );
        }
        
        return MinimizationCheckResult.success();
    }
}

/**
 * 目的限定访问控制
 * 确保数据仅用于声明的目的
 */
@Service
public class PurposeLimitedAccess {
    
    private final AccessControlService accessControl;
    
    /**
     * 在目的限定下访问数据
     */
    public DataAccessResult accessData(Long userId, String purpose, 
                                      List<String> fields) {
        // 验证用户对该目的的授权
        UserAuthorization auth = accessControl.getAuthorization(userId, purpose);
        
        if (!auth.isAuthorized()) {
            throw new UnauthorizedAccessException(
                "用户无 " + purpose + " 目的的访问权限"
            );
        }
        
        // 限制只能访问该目的所需的字段
        List<String> allowedFields = auth.getAllowedFields();
        List<String> requestedFields = fields.stream()
            .filter(allowedFields::contains)
            .collect(Collectors.toList());
        
        // 记录访问日志
        auditService.logPurposeLimitedAccess(userId, purpose, requestedFields);
        
        return dataRepository.findById(userId, requestedFields);
    }
}

/**
 * 存储限制服务
 * 实现数据留存期限的自动化管理
 */
@Service
public class StorageLimitationService {
    
    private final DataRepository dataRepository;
    private final ScheduledTaskService scheduledTask;
    
    /**
     * 配置数据留存策略
     */
    public void configureRetentionPolicy(String dataType, 
                                         Duration retentionPeriod,
                                         DisposalMethod disposalMethod) {
        RetentionPolicy policy = RetentionPolicy.builder()
            .dataType(dataType)
            .retentionPeriod(retentionPeriod)
            .disposalMethod(disposalMethod)
            .nextDisposalDate(calculateNextDate(retentionPeriod))
            .build();
        
        retentionPolicyRepository.save(policy);
    }
    
    /**
     * 每日检查并执行过期数据删除
     */
    @Scheduled(cron = "0 0 2 * * ?")  // 每天凌晨 2 点
    public void processExpiredData() {
        List<RetentionPolicy> expiredPolicies = 
            retentionPolicyRepository.findExpiredPolicies();
        
        for (RetentionPolicy policy : expiredPolicies) {
            List<Long> expiredRecordIds = dataRepository
                .findExpiredRecords(policy.getDataType(), policy.getRetentionPeriod());
            
            for (Long recordId : expiredRecordIds) {
                performDisposal(recordId, policy.getDisposalMethod());
            }
            
            auditService.logBatchDisposal(
                policy.getDataType(), 
                expiredRecordIds.size(), 
                policy.getDisposalMethod()
            );
        }
    }
}

/**
 * 透明度服务
 * 向用户提供数据处理信息
 */
@Service
public class TransparencyService {
    
    /**
     * 生成用户数据处理报告
     */
    public DataProcessingReport generateUserReport(Long userId) {
        User user = userRepository.findById(userId);
        
        return DataProcessingReport.builder()
            .userId(userId)
            .generatedAt(Instant.now())
            // 已收集的数据类别
            .dataCategories(dataCategoryRepository.findByUserId(userId))
            // 数据收集来源
            .collectionPurposes(purposeRepository.findActiveByUserId(userId))
            // 数据共享对象
            .dataRecipients(recipientRepository.findByUserId(userId))
            // 数据保留期限
            .retentionPeriods(retentionRepository.findByUserId(userId))
            // 用户权利行使记录
            .rightsExercised(rightsRepository.findByUserId(userId))
            .build();
    }
}

/**
 * 问责服务
 * 提供合规证明
 */
@Service
public class AccountabilityService {
    
    private final AuditLogService auditLog;
    
    /**
     * 记录数据处理活动
     * 用于证明合规
     */
    public void recordProcessingActivity(ProcessingActivity activity) {
        ProcessingRecord record = ProcessingRecord.builder()
            .activityType(activity.getType())
            .dataCategories(activity.getDataCategories())
            .purpose(activity.getPurpose())
            .legalBasis(activity.getLegalBasis())
            .timestamp(activity.getTimestamp())
            .performedBy(activity.getPerformedBy())
            .build();
        
        recordRepository.save(record);
        
        // 触发合规检查
        complianceChecker.checkCompliance(record);
    }
    
    /**
     * 生成合规报告
     */
    public ComplianceReport generateComplianceReport(Period period) {
        List<ProcessingRecord> records = recordRepository.findByPeriod(period);
        List<ComplianceViolation> violations = complianceChecker.findViolations(records);
        
        return ComplianceReport.builder()
            .period(period)
            .totalRecords(records.size())
            .violations(violations)
            .compliant(computeCompliantScore(records, violations))
            .build();
    }
}

/**
 * 隐私设计的编码实践示例
 */

// 实践 1：最小化参数
public class UserRegistration {
    // 错误：过早收集
    public void register(String email, String phone, String address, 
                        String education, String income) {
        // ...
    }
    
    // 正确：渐进式收集
    public RegistrationResult registerMinimal(String email) {
        // 只收集必要信息
        return userRepository.create(email);
    }
    
    // 补充信息需要用户主动提供
    public void addOptionalInfo(Long userId, OptionalInfo info) {
        // ...
    }
}

// 实践 2：假名化存储
public class AnalyticsService {
    // 错误：直接存储用户标识
    public void record(User user, String action) {
        analyticsLog.save(user.getId(), action);
    }
    
    // 正确：使用假名
    public void record(String pseudonymizedId, String action) {
        String pseudonym = pseudonymizer.generate(user.getId());
        analyticsLog.save(pseudonym, action);
    }
}

// 实践 3：加密敏感字段
@Entity
public class User {
    @Id
    private Long id;
    
    // 普通字段
    private String nickname;
    
    // 敏感字段加密存储
    @Encrypted
    private String phone;
    
    @Encrypted
    private String idCard;
}