# ===================================================================
# MODULE 6, LESSON 5: DATA PRIVACY AND ETHICS
# ===================================================================

import pandas as pd
import numpy as np
import matplotlib.pyplot as plt
import seaborn as sns
from datetime import datetime, timedelta
import hashlib
import re
import warnings
warnings.filterwarnings('ignore')

print("="*70)
print("DATA PRIVACY AND ETHICS IN DIGITAL BANKING")
print("="*70)

# ----------------------------------------------------------------
# PART A: DATA PRIVACY REGULATORY MAPPING
# ----------------------------------------------------------------

print("\n" + "-"*60)
print("PART A: Data Privacy Regulatory Mapping")
print("-"*60)

privacy_regulations = pd.DataFrame({
    'Regulation': ['GDPR', 'CCPA', 'CPRA', 'PIPEDA', 'Privacy Act'],
    'Region': ['EU', 'US (CA)', 'US (CA)', 'Canada', 'Australia'],
    'Key Rights': [
        'Access, Erasure, Portability',
        'Access, Deletion, Opt-Out',
        'Sensitive Data, Enforcement',
        'Consent, Access, Safeguarding',
        'Collection, Use, Disclosure'
    ],
    'Status': ['✅', '✅', '🟡', '✅', '🟡'],
    'Next Steps': [
        'Maintain compliance',
        'Update CCPA procedures',
        'Prepare for CPRA enforcement',
        'Review consent mechanisms',
        'Update privacy policy'
    ]
})

print("Data Privacy Regulatory Mapping:")
print(privacy_regulations.to_string(index=False))

# ----------------------------------------------------------------
# PART B: DATA SUBJECT ACCESS REQUEST (DSAR) SIMULATION
# ----------------------------------------------------------------

print("\n" + "-"*60)
print("PART B: Data Subject Access Request (DSAR) Simulation")
print("-"*60)

class DSARService:
    """Simulate a Data Subject Access Request service."""
    
    def __init__(self):
        self.requests = []
        self.customer_data = {
            'CUST001': {
                'name': 'John Smith',
                'email': 'john@email.com',
                'phone': '555-123-4567',
                'address': '123 Main St',
                'accounts': ['ACC001', 'ACC002'],
                'transactions': [
                    {'date': '2024-01-15', 'amount': 500, 'description': 'Deposit'},
                    {'date': '2024-01-20', 'amount': 200, 'description': 'Withdrawal'}
                ],
                'created_at': '2023-01-01'
            },
            'CUST002': {
                'name': 'Jane Doe',
                'email': 'jane@email.com',
                'phone': '555-987-6543',
                'address': '456 Oak Ave',
                'accounts': ['ACC003'],
                'transactions': [
                    {'date': '2024-02-01', 'amount': 1000, 'description': 'Deposit'}
                ],
                'created_at': '2023-06-01'
            }
        }
    
    def submit_request(self, customer_id, request_type):
        """Submit a DSAR request."""
        if customer_id not in self.customer_data:
            return {'error': 'Customer not found'}
        
        request = {
            'request_id': f'DSAR-{len(self.requests) + 1:04d}',
            'customer_id': customer_id,
            'request_type': request_type,
            'status': 'Received',
            'submitted_at': datetime.now().isoformat(),
            'fulfilled_at': None
        }
        self.requests.append(request)
        return request
    
    def process_request(self, request_id):
        """Process a DSAR request."""
        request = next((r for r in self.requests if r['request_id'] == request_id), None)
        if not request:
            return {'error': 'Request not found'}
        
        customer_id = request['customer_id']
        data = self.customer_data.get(customer_id, {})
        
        # Fulfill request
        request['status'] = 'Fulfilled'
        request['fulfilled_at'] = datetime.now().isoformat()
        
        return {
            'request_id': request_id,
            'customer_id': customer_id,
            'data': data,
            'fulfilled_at': request['fulfilled_at']
        }
    
    def get_status(self, request_id):
        """Get the status of a DSAR request."""
        request = next((r for r in self.requests if r['request_id'] == request_id), None)
        if not request:
            return {'error': 'Request not found'}
        return {
            'request_id': request_id,
            'status': request['status'],
            'submitted_at': request['submitted_at'],
            'fulfilled_at': request['fulfilled_at']
        }

# Test DSAR service
dsar = DSARService()

print("DSAR Service Simulation:")
request1 = dsar.submit_request('CUST001', 'Access')
print(f"Request submitted: {request1['request_id']}")

result = dsar.process_request('DSAR-0001')
print(f"Request processed: {result['request_id']}")

status = dsar.get_status('DSAR-0001')
print(f"Request status: {status['status']}")

# ----------------------------------------------------------------
# PART C: DATA ANONYMISATION
# ----------------------------------------------------------------

print("\n" + "-"*60)
print("PART C: Data Anonymisation Simulation")
print("-"*60)

class DataAnonymiser:
    """Simulate data anonymisation for privacy protection."""
    
    @staticmethod
    def anonymise_name(name):
        """Anonymise a name."""
        if not name:
            return name
        parts = name.split()
        if len(parts) >= 2:
            return f"{parts[0][0]}. {parts[-1]}"
        return f"{name[0]}."
    
    @staticmethod
    def anonymise_email(email):
        """Anonymise an email."""
        if not email:
            return email
        parts = email.split('@')
        if len(parts) >= 2:
            return f"{parts[0][:1]}*****@{parts[1]}"
        return email
    
    @staticmethod
    def anonymise_phone(phone):
        """Anonymise a phone number."""
        if not phone:
            return phone
        # Remove non-digits
        digits = re.sub(r'\D', '', phone)
        if len(digits) >= 10:
            return f"XXX-XXX-{digits[-4:]}"
        return "XXX-XXX-XXXX"
    
    @staticmethod
    def anonymise_address(address):
        """Anonymise an address."""
        if not address:
            return address
        return "XXX [Anonymised Address]"

# Test anonymisation
sample_customer = {
    'name': 'John Smith',
    'email': 'john.smith@email.com',
    'phone': '555-123-4567',
    'address': '123 Main Street, City, State 12345'
}

print("Data Anonymisation Examples:")
print(f"  Original Name: {sample_customer['name']}")
print(f"  Anonymised Name: {DataAnonymiser.anonymise_name(sample_customer['name'])}")
print(f"  Original Email: {sample_customer['email']}")
print(f"  Anonymised Email: {DataAnonymiser.anonymise_email(sample_customer['email'])}")
print(f"  Original Phone: {sample_customer['phone']}")
print(f"  Anonymised Phone: {DataAnonymiser.anonymise_phone(sample_customer['phone'])}")
print(f"  Original Address: {sample_customer['address']}")
print(f"  Anonymised Address: {DataAnonymiser.anonymise_address(sample_customer['address'])}")

# ----------------------------------------------------------------
# PART D: DATA PRIVACY METRICS DASHBOARD
# ----------------------------------------------------------------

print("\n" + "-"*60)
print("PART D: Data Privacy Metrics Dashboard")
print("-"*60)

privacy_metrics = pd.DataFrame({
    'Metric': [
        'GDPR Compliance Score',
        'CCPA Compliance Score',
        'DSAR Response Time',
        'Data Breach Incidents',
        'Consent Management Rate',
        'Data Inventory Coverage',
        'Privacy Impact Assessments',
        'Data Subject Complaints'
    ],
    'Current Value': [
        '82/100',
        '75/100',
        '3.2 days',
        '2/month',
        '78%',
        '65%',
        '45%',
        '15/month'
    ],
    'Target Value': [
        '> 95/100',
        '> 90/100',
        '< 1 day',
        '0/month',
        '> 95%',
        '> 95%',
        '> 90%',
        '< 5/month'
    ],
    'Status': ['🟡', '🟡', '🟡', '🟡', '🟡', '🔴', '🔴', '🟡']
})

print("Data Privacy Metrics Dashboard:")
print(privacy_metrics.to_string(index=False))

# ----------------------------------------------------------------
# PART E: DATA ETHICS PRINCIPLES CHECKLIST
# ----------------------------------------------------------------

print("\n" + "-"*60)
print("PART E: Data Ethics Principles Checklist")
print("-"*60)

ethics_checklist = [
    "✅ Fairness: Bias testing conducted for all models.",
    "✅ Transparency: Model explainability implemented (SHAP/LIME).",
    "✅ Accountability: Model governance established.",
    "✅ Privacy: Data protection controls implemented.",
    "✅ Beneficence: Models designed for positive outcomes.",
    "✅ Non-Maleficence: Risk assessments conducted.",
    "✅ Autonomy: Customer consent obtained.",
    "✅ Data Minimisation: Only necessary data collected.",
    "✅ Purpose Limitation: Data used for stated purposes.",
    "✅ Accuracy: Data quality controls in place."
]

print("Data Ethics Principles Checklist:")
for item in ethics_checklist:
    print(f"  {item}")

# ----------------------------------------------------------------
# PART F: DATA PRIVACY ROADMAP
# ----------------------------------------------------------------

print("\n" + "-"*60)
print("PART F: Data Privacy Roadmap")
print("-"*60)

roadmap = {
    "Phase 1 (0-6 months) – Foundation": {
        "Focus": "Establish data privacy foundation.",
        "Activities": [
            "Complete data inventory and classification.",
            "Implement data protection controls (encryption, access).",
            "Establish consent management process.",
            "Develop privacy policies and notices."
        ],
        "Success Metrics": ["Data inventory > 90%", "GDPR compliance > 85%"]
    },
    "Phase 2 (6-12 months) – Scale": {
        "Focus": "Scale data privacy capabilities.",
        "Activities": [
            "Implement DSAR automation.",
            "Establish privacy impact assessment process.",
            "Enhance data anonymisation.",
            "Implement third-party privacy agreements."
        ],
        "Success Metrics": ["GDPR compliance > 90%", "DSAR response < 2 days"]
    },
    "Phase 3 (12-24 months) – Advanced": {
        "Focus": "Advanced data privacy.",
        "Activities": [
            "Implement AI-powered privacy monitoring.",
            "Deploy privacy automation.",
            "Build privacy dashboards.",
            "Establish privacy culture."
        ],
        "Success Metrics": ["GDPR compliance > 95%", "DSAR response < 1 day"]
    },
    "Phase 4 (24+ months) – Leadership": {
        "Focus": "Industry-leading data privacy.",
        "Activities": [
            "Implement autonomous privacy controls.",
            "Build predictive privacy analytics.",
            "Achieve industry leadership.",
            "Establish privacy-first culture."
        ],
        "Success Metrics": ["Industry-leading privacy", "Continuous improvement"]
    }
}

for phase, details in roadmap.items():
    print(f"\n{phase}:")
    print(f"  Focus: {details['Focus']}")
    print("  Activities:")
    for activity in details['Activities']:
        print(f"    • {activity}")
    print("  Success Metrics:")
    for metric in details['Success Metrics']:
        print(f"    • {metric}")

# ----------------------------------------------------------------
# PART G: SUMMARY AND RECOMMENDATIONS
# ----------------------------------------------------------------

print("\n" + "="*70)
print("PART G: Summary and Recommendations")
print("="*70)

print("""
Data Privacy and Ethics – Key Takeaways:

1. Data privacy is critical for customer trust and regulatory compliance.
2. Key regulations: GDPR, CCPA, CPRA, PIPEDA, Privacy Act.
3. Data privacy principles: lawfulness, fairness, transparency, purpose limitation, data minimisation.
4. DSAR process: submit → process → fulfill → report.
5. Data anonymisation protects personal data while enabling analysis.
6. Data ethics principles: fairness, transparency, accountability, privacy, beneficence.
7. Roadmap: foundation → scale → advanced → leadership.

Recommendations:
  - Complete data inventory and classification.
  - Implement data protection controls.
  - Establish DSAR process.
  - Conduct privacy impact assessments.
  - Ensure third-party data processing agreements.
  - Build a privacy-first culture.
""")

print("="*70)
print("END OF LESSON 5 – MODULE 6")
print("="*70)