papers/lux-id-iam/sections/10-privacy-and-compliance.tex

\section{Privacy and Compliance}


\subsection{GDPR Compliance}

Lux.id implements GDPR requirements:

\begin{itemize}
    \item \textbf{Data Minimization}: Collect only necessary information
    \item \textbf{Purpose Limitation}: Use data only for stated purposes
    \item \textbf{Storage Limitation}: Automatic data expiration
    \item \textbf{Right to Access}: User data export API
    \item \textbf{Right to Erasure}: Account deletion with cascade
    \item \textbf{Data Portability}: Standard format exports (JSON, CSV)
\end{itemize}

\subsection{Data Minimization}

Selective attribute disclosure:

\begin{lstlisting}[language=json]
{
  "requested_claims": {
    "userinfo": {
      "email": {"essential": true},
      "name": {"essential": false},
      "wallet_address": {"essential": true}
    }
  }
}
\end{lstlisting}

\subsection{Right to be Forgotten}

Data deletion implementation:

\begin{lstlisting}[language=C]
func DeleteUser(userID string) error {
    tx := db.Begin()

    // Delete sessions
    tx.Where("user_id = ?", userID).Delete(&Session{})

    // Delete permissions
    tx.Where("user_id = ?", userID).Delete(&Permission{})

    // Anonymize audit logs
    tx.Model(&AuditLog{}).
       Where("user_id = ?", userID).
       Update("user_id", "deleted-user")

    // Delete user
    tx.Where("id = ?", userID).Delete(&User{})

    return tx.Commit().Error
}
\end{lstlisting}

\subsection{Data Portability}

Export user data in machine-readable format:

\begin{lstlisting}[language=C]
func ExportUserData(userID string) ([]byte, error) {
    data := struct {
        Profile     *User        `json:"profile"`
        Sessions    []Session    `json:"sessions"`
        Permissions []Permission `json:"permissions"`
        AuditLogs   []AuditLog   `json:"audit_logs"`
    }{
        Profile:     GetUser(userID),
        Sessions:    GetUserSessions(userID),
        Permissions: GetUserPermissions(userID),
        AuditLogs:   GetUserAuditLogs(userID),
    }

    return json.MarshalIndent(data, "", "  ")
}
\end{lstlisting}