Your Privacy Docs Are Fiction: Let’s Fix That with .NET CLI Tools

public class UserProfile
{
    public Guid Id { get; set; }
    public string Email { get; set; }
    public string FullName { get; set; }
    
    // Added in sprint 47 - privacy docs? What privacy docs?
    public string SocialSecurityNumber { get; set; }
    public string BiometricHash { get; set; }
}

public async Task DeleteUserAccount(Guid userId)
{
    // Deletes from Users table
    await _dbContext.Users.Where(u => u.Id == userId).ExecuteDeleteAsync();
    
    // But PII remains in: OrderHistory, AuditLogs, EmailCampaigns, 
    // BackupSnapshots, and that analytics database nobody remembers exists
}

public class DiscoverPiiCommand
{
    public async Task<PrivacyAuditReport> ExecuteAsync(string assemblyPath, string connectionString)
    {
        var report = new PrivacyAuditReport();
        var assembly = Assembly.LoadFrom(assemblyPath);
        
        // Find all properties marked with [PersonalData]
        var piiProperties = assembly.GetTypes()
            .SelectMany(type => type.GetProperties())
            .Where(prop => prop.GetCustomAttribute<PersonalDataAttribute>() != null)
            .Select(prop => new PiiProperty
            {
                TypeName = prop.DeclaringType?.FullName,
                PropertyName = prop.Name,
                LegalBasis = prop.GetCustomAttribute<LegalBasisAttribute>()?.Basis ?? "NOT_DOCUMENTED"
            });
        
        report.DiscoveredPiiProperties = piiProperties.ToList();
        
        // Scan EF metadata for database columns
        await using var dbContext = new ApplicationDbContext(connectionString);
        foreach (var entityType in dbContext.Model.GetEntityTypes())
        {
            var piiColumns = entityType.GetProperties()
                .Where(p => p.FindAnnotation("Privacy:IsPII")?.Value as bool? == true);
            
            report.DatabasePiiColumns.AddRange(piiColumns.Select(p => new DatabasePiiColumn
            {
                TableName = entityType.GetTableName(),
                ColumnName = p.GetColumnName(),
                LegalBasis = p.FindAnnotation("Privacy:LegalBasis")?.Value as string ?? "UNDOCUMENTED"
            }));
        }
        
        // Cross-reference against processing records - anything missing is a compliance gap
        var documented = await LoadProcessingRecordsAsync();
        report.UndocumentedPii = report.DatabasePiiColumns
            .Where(col => !documented.Any(rec => rec.CoversColumn(col.TableName, col.ColumnName)))
            .ToList();
        
        return report;
    }
}

public class ConsentAuditCommand
{
    public async Task<ConsentAuditReport> ExecuteAsync()
    {
        var today = DateTime.UtcNow;
        var report = new ConsentAuditReport { AuditDate = today };
        
        // Find expired consents still marked active
        report.ExpiredActiveConsents = await _dbContext.MarketingConsents
            .Where(c => c.IsActive && c.ExpirationDate < today)
            .Select(c => new ExpiredConsent
            {
                UserId = c.UserId,
                Purpose = c.Purpose,
                DaysOverdue = (int)(today - c.ExpirationDate).TotalDays
            })
            .ToListAsync();
        
        // Verify "completed" deletion requests actually deleted everything
        var deletionRequests = await _dbContext.GdprDeletionRequests
            .Where(r => r.Status == DeletionStatus.Completed)
            .Select(r => r.UserId)
            .ToListAsync();
        
        foreach (var userId in deletionRequests)
        {
            var remainingData = await ScanAllTablesForUser(userId);
            if (remainingData.Any())
                report.IncompleteDeletions.Add(new IncompleteDeletion { UserId = userId, Locations = remainingData });
        }
        
        return report;
    }
}

public class DpiaChangeDetectionCommand
{
    public async Task<DpiaChangeReport> ExecuteAsync(string currentCommit, string previousCommit)
    {
        var report = new DpiaChangeReport { CurrentCommit = currentCommit };
        var gitDiff = await GetGitDiffAsync(previousCommit, currentCommit);
        
        foreach (var changedFile in gitDiff.ChangedFiles.Where(f => f.Path.EndsWith(".cs")))
        {
            var currentTree = CSharpSyntaxTree.ParseText(await File.ReadAllTextAsync(changedFile.Path));
            var previousTree = CSharpSyntaxTree.ParseText(await GetFileContentAtCommitAsync(changedFile.Path, previousCommit));
            
            // Detect new [PersonalData] properties
            var newPiiFields = GetPiiProperties(currentTree.GetRoot())
                .Except(GetPiiProperties(previousTree.GetRoot()))
                .ToList();
            
            if (newPiiFields.Any())
            {
                report.FilesWithPrivacyChanges.Add(new PrivacyChange
                {
                    FilePath = changedFile.Path,
                    NewPiiFields = newPiiFields,
                    RequiresDpiaUpdate = true
                });
            }
        }
        
        return report;
    }
}

public class DeletionVerificationCommand
{
    public async Task<DeletionReport> ExecuteAsync()
    {
        // Find all tables containing user PII
        var piiTables = _dbContext.Model.GetEntityTypes()
            .Where(e => e.GetProperties().Any(p => p.FindAnnotation("Privacy:IsPII")?.Value as bool? == true))
            .Select(e => e.GetTableName())
            .ToList();
        
        // Create synthetic test user with data in all PII tables
        var testUserId = await CreateSyntheticUserWithPii();
        await _deletionService.DeleteUserAccount(testUserId);
        
        // Verify deletion actually worked
        var report = new DeletionReport();
        foreach (var table in piiTables)
        {
            var remainingRecords = await CountRecordsForUser(table, testUserId);
            if (remainingRecords > 0)
                report.Issues.Add($"Table {table} still contains {remainingRecords} records after deletion");
        }
        
        return report;
    }
}

public class GenerateProcessingRecordCommand
{
    public async Task ExecuteAsync()
    {
        var record = new ProcessingRecord { GeneratedDate = DateTime.UtcNow };
        
        foreach (var entityType in _dbContext.Model.GetEntityTypes())
        {
            var piiProperties = entityType.GetProperties()
                .Where(p => p.FindAnnotation("Privacy:IsPII")?.Value as bool? == true)
                .ToList();
            
            if (!piiProperties.Any()) continue;
            
            record.Activities.Add(new ProcessingActivity
            {
                Name = entityType.ClrType.Name,
                DataCategories = piiProperties.Select(p => p.FindAnnotation("Privacy:Category")?.Value as string).ToList(),
                LegalBasis = entityType.FindAnnotation("Privacy:LegalBasis")?.Value as string ?? "NOT_DOCUMENTED",
                Purpose = entityType.FindAnnotation("Privacy:Purpose")?.Value as string ?? "NOT_DOCUMENTED"
            });
        }
        
        await File.WriteAllTextAsync("ProcessingRecord.json", JsonSerializer.Serialize(record, new JsonSerializerOptions { WriteIndented = true }));
    }
}

name: Privacy Compliance Audit

on:
  push:
    branches: [main, develop]
  pull_request:
  schedule:
    - cron: '0 2 * * *'  # Daily at 2 AM

jobs:
  privacy-audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 2
      
      - uses: actions/setup-dotnet@v4
        with:
          dotnet-version: '9.0.x'
      
      - name: Discover Undocumented PII
        run: dotnet run --project PrivacyAudit.Cli -- discover-pii --output pii-report.json
      
      - name: Audit Consent Records
        run: dotnet run --project PrivacyAudit.Cli -- audit-consent --output consent-report.json
      
      - name: Detect Privacy-Impacting Changes
        run: dotnet run --project PrivacyAudit.Cli -- detect-changes --output changes-report.json
      
      - name: Verify Deletion Completeness
        run: dotnet run --project PrivacyAudit.Cli -- verify-deletion --output deletion-report.json
      
      - name: Fail on Violations
        run: dotnet run --project PrivacyAudit.Cli -- check-compliance --fail-on-violations true
      
      - uses: actions/upload-artifact@v4
        if: always()
        with:
          name: privacy-audit-reports
          path: '*-report.json'