TypeScript Regulatory Compliance & Legal Framework 2 — Questions and Answers
Question 1: Under GDPR, which TypeScript pattern best enforces that user consent is recorded before processing personal data?
- Using optional chaining to skip processing if consent is undefined
- A branded type `ConsentToken` that processing functions require as a parameter (Correct answer)
- Storing consent as a boolean in localStorage
- Using a generic type parameter to mark data as personal
Correct answer: A branded type `ConsentToken` that processing functions require as a parameter
A branded (nominal) type ensures at compile time that a consent token has been obtained before calling any processing function.
Question 2: Which open-source license requires that derivative works also be distributed under the same license, creating a 'copyleft' obligation?
- MIT License
- Apache License 2.0
- GNU General Public License (GPL) (Correct answer)
- BSD 2-Clause License
Correct answer: GNU General Public License (GPL)
The GPL is a copyleft license, meaning any derivative or combined work distributed publicly must also be released under the GPL.
Question 3: A TypeScript library ships type definitions that expose internal implementation details. Which legal concept most directly governs whether those definitions can be reverse-engineered?
- Patent law
- Trade secret law
- Copyright law on the type definitions themselves (Correct answer)
- Export control regulations
Correct answer: Copyright law on the type definitions themselves
Type definition files (.d.ts) are copyrightable expression, so their reproduction and derivative use is governed by the copyright held by the author.
Question 4: Which HIPAA safeguard category specifically covers technical controls such as encryption and audit logs in a TypeScript healthcare application?
- Administrative Safeguards
- Physical Safeguards
- Technical Safeguards (Correct answer)
- Organizational Requirements
Correct answer: Technical Safeguards
HIPAA Technical Safeguards cover technology-based controls—encryption, access controls, and audit logging—used to protect ePHI.
Question 5: When a TypeScript npm package includes code from multiple contributors, which practice best documents license obligations for downstream users?
- Listing all contributor GitHub usernames in README.md
- Including a NOTICE or THIRD-PARTY-LICENSES file that lists each component's license (Correct answer)
- Using a monorepo so each sub-package has its own package.json
- Adding a comment in index.ts referencing the main project license
Correct answer: Including a NOTICE or THIRD-PARTY-LICENSES file that lists each component's license
A NOTICE or THIRD-PARTY-LICENSES file is the standard mechanism for attributing third-party code and satisfying notice requirements of licenses like Apache 2.0.
Question 6: Under the California Consumer Privacy Act (CCPA), what right allows a user to demand that a TypeScript-backed service delete all personal information it holds about them?
- Right to Portability
- Right to Opt-Out
- Right to Deletion (Right to be Forgotten) (Correct answer)
- Right to Non-Discrimination
Correct answer: Right to Deletion (Right to be Forgotten)
The CCPA's Right to Deletion lets California consumers request that businesses delete their personal information, subject to certain exceptions.
Question 7: A company publishes a TypeScript SDK and wants to allow commercial use without requiring source disclosure. Which license best fits?
- GNU Affero General Public License (AGPL)
- MIT License (Correct answer)
- GNU Lesser General Public License (LGPL)
- Creative Commons BY-SA
Correct answer: MIT License
The MIT License permits commercial use, modification, and distribution without requiring source code disclosure, making it the most permissive common choice.
TypeScript Regulatory Compliance & Legal Framework 2
Under GDPR, which TypeScript pattern best enforces that user consent is recorded before processing personal data?