[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AEYD7D8EY4PTYHQP9B55WM":3,"skill-same:01M6AEYD7D8EY4PTYHQP9B55WM":100},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":28,"publishedAt":34,"linkOnly":35,"markdownContent":36,"markdownBody":37,"frontMatter":38,"refName":43,"commitSha":44,"skillDirectory":45,"forksCount":46,"repositoryHtmlUrl":47,"repositoryHomepageUrl":6,"ownerHtmlUrl":48,"ownerBlogUrl":49,"ownerDescription":50,"updatedAt":51,"install":52,"resources":65},"01M6AEYD7D8EY4PTYHQP9B55WM","legit-interest-vs-consent",null,"Decision framework for choosing between consent and legitimate interest as the lawful basis for processing. Covers power imbalance indicators, conditionality prohibition under Article 7(4), granularity requirements, the three-part LIA test (purpose, necessity, balancing), and practical decision trees for common scenarios.","mukul975\u002FPrivacy-Data-Protection-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADNKWX1HF4Q5DKEXT5M774",336,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Flegit-interest-vs-consent\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000036","内容创作者","PROFESSION","适用职业",[29,30,31,32,33],"legit interest vs consent","test","framework","privacy","indicators","2026-11-10 10:12:30",false,"---\nname: legit-interest-vs-consent\ndescription: >-\n  Decision framework for choosing between consent and legitimate interest as the\n  lawful basis for processing. Covers power imbalance indicators, conditionality\n  prohibition under Article 7(4), granularity requirements, the three-part LIA test\n  (purpose, necessity, balancing), and practical decision trees for common scenarios.\nlicense: Apache-2.0\nmetadata:\n  author: mukul975\n  version: \"1.0\"\n  domain: privacy\n  subdomain: consent-management\n  tags: \"legitimate-interest, consent-vs-lia, lawful-basis, power-imbalance, article-6\"\n---\n\n# Assessing Legitimate Interest vs Consent\n\n## Overview\n\nGDPR Article 6(1) provides six lawful bases for processing. Consent (Article 6(1)(a)) and legitimate interest (Article 6(1)(f)) are the two most commonly used bases for commercial data processing. Choosing the wrong basis creates compliance risk: relying on consent when it cannot be freely given undermines validity, while relying on legitimate interest when consent is required (e.g., for electronic marketing under the ePrivacy Directive) violates sectoral law.\n\n## Decision Framework: When to Use Each Basis\n\n### Use Consent When:\n\n1. **Regulatory requirement**: Specific legislation mandates consent (e.g., ePrivacy Directive Article 5(3) for non-essential cookies, Article 13 for unsolicited electronic marketing)\n2. **Special category data**: Processing sensitive data under Article 9(2)(a) requires explicit consent\n3. **Automated decision-making**: Processing under Article 22(2)(c) requires explicit consent\n4. **International transfers**: Article 49(1)(a) explicit consent for transfers without adequacy\u002Fsafeguards\n5. **User control priority**: The processing is entirely optional and the data subject should have full control\n\n### Use Legitimate Interest When:\n\n1. **Power imbalance exists**: Consent cannot be freely given (employer-employee, public authority-citizen)\n2. **Processing is necessary**: The processing is necessary for the controller's or third party's legitimate interest and is proportionate\n3. **Reasonable expectation**: The data subject would reasonably expect the processing (Recital 47)\n4. **Withdrawal would be problematic**: If consent withdrawal would cause operational issues (e.g., fraud prevention)\n5. **No specific consent requirement**: No ePrivacy or sectoral law mandates consent\n\n## Power Imbalance Indicators\n\nPer EDPB Guidelines 05\u002F2020 (paragraphs 13-25) and Recital 43, consent is presumed not to be freely given when a clear imbalance exists:\n\n| Indicator | Example | Implication |\n|-----------|---------|-------------|\n| Employment relationship | Employer asks employee to consent to monitoring | Use LI or legal obligation, not consent |\n| Public authority | Tax authority processes taxpayer data | Use legal obligation or public task |\n| Service dependency | Only provider in market; user has no alternative | Consent may not be freely given |\n| Contractual bundling | Consent required as condition of contract (Art. 7(4)) | Consent likely invalid |\n| Vulnerable data subjects | Children, elderly, patients | Extra scrutiny; consent may not be free |\n| Significant consequence | Refusing consent leads to job loss or service termination | Consent not freely given |\n\n## The Three-Part Legitimate Interest Assessment (LIA)\n\nPer CJEU case law (C-13\u002F16 Rigas, C-40\u002F17 Fashion ID) and Article 29 Working Party Opinion 06\u002F2014:\n\n### Part 1: Purpose Test\n\nIs the interest legitimate?\n\n- The interest must be lawful (not in itself illegal)\n- The interest must be real and present (not speculative)\n- The interest must be sufficiently clearly articulated\n\n**CloudVault SaaS Inc. examples of legitimate interests:**\n- Network and information security (Recital 49)\n- Fraud prevention and detection\n- Direct marketing to existing customers (Recital 47)\n- Internal administrative purposes within a group (Recital 48)\n- Service improvement based on aggregated usage analytics\n\n### Part 2: Necessity Test\n\nIs the processing necessary for the legitimate interest?\n\n- Could the same interest be achieved with less data?\n- Could the same interest be achieved without processing personal data?\n- Is the processing proportionate to the interest pursued?\n\n### Part 3: Balancing Test\n\nDo the data subject's rights and freedoms override the legitimate interest?\n\n| Factor | Weighs Toward LI | Weighs Toward Data Subject |\n|--------|------------------|---------------------------|\n| Data sensitivity | Non-sensitive data | Special category data |\n| Reasonable expectation | Processing expected by data subject | Surprising or unexpected processing |\n| Relationship | Existing customer\u002Fuser relationship | No prior relationship |\n| Impact | Minimal impact on individual | Significant consequences |\n| Safeguards | Robust safeguards in place | No safeguards |\n| Data subject control | Easy opt-out available | No opt-out mechanism |\n| Vulnerable groups | No vulnerable individuals | Children or vulnerable adults |\n| Data volume | Minimal data used | Extensive profiling |\n\n## Decision Tree\n\n```\nSTART: Need to establish lawful basis for processing activity\n  │\n  ├─► Q1: Does specific legislation require consent?\n  │     (ePrivacy Art. 5(3) for cookies, Art. 13 for e-marketing,\n  │      GDPR Art. 9(2)(a) for special categories, Art. 22(2)(c) for automated decisions)\n  │     │\n  │     ├─ YES → Use CONSENT (mandatory)\n  │     │\n  │     └─ NO → Continue to Q2\n  │\n  ├─► Q2: Is there a power imbalance between controller and data subject?\n  │     (employer-employee, public authority, service dependency)\n  │     │\n  │     ├─ YES → Consent likely INVALID; consider LEGITIMATE INTEREST\n  │     │         (or legal obligation\u002Fpublic task if applicable)\n  │     │\n  │     └─ NO → Continue to Q3\n  │\n  ├─► Q3: Is consent conditioned on the service?\n  │     (Would refusing consent result in service denial or degradation?)\n  │     │\n  │     ├─ YES → Violates Art. 7(4); consent likely INVALID\n  │     │         Consider LEGITIMATE INTEREST or restructure the service\n  │     │\n  │     └─ NO → Continue to Q4\n  │\n  ├─► Q4: Is consent withdrawal operationally feasible?\n  │     (Can you stop processing immediately if consent is withdrawn?)\n  │     │\n  │     ├─ NO → LEGITIMATE INTEREST may be more appropriate\n  │     │        (e.g., fraud prevention cannot stop mid-transaction)\n  │     │\n  │     └─ YES → Continue to Q5\n  │\n  ├─► Q5: Does the data subject reasonably expect this processing?\n  │     │\n  │     ├─ YES → Either CONSENT or LEGITIMATE INTEREST may work\n  │     │         Choose based on control preference and overhead\n  │     │\n  │     └─ NO → CONSENT is more appropriate\n  │               (unexpected processing needs explicit agreement)\n  │\n  └─► Q6: Final determination\n        ├─ If consent: Implement full Art. 7 requirements (freely given, specific,\n        │   informed, unambiguous, withdrawal as easy as giving)\n        └─ If LI: Document three-part LIA, implement opt-out mechanism,\n            include in privacy notice per Art. 13(1)(d)\u002F14(2)(b)\n```\n\n## Common Scenarios at CloudVault SaaS Inc.\n\n| Scenario | Recommended Basis | Reasoning |\n|----------|------------------|-----------|\n| Essential cookies for session management | Not consent; exempt under ePrivacy Art. 5(3) | Strictly necessary; no consent required |\n| Analytics cookies (non-essential) | Consent | ePrivacy Art. 5(3) requires consent for non-essential cookies |\n| Email marketing to existing customers | Legitimate interest (soft opt-in) | ePrivacy Art. 13(2) allows soft opt-in for existing customers with opt-out |\n| Email marketing to new contacts | Consent | ePrivacy Art. 13(1) requires prior consent for unsolicited e-marketing |\n| Fraud detection on transactions | Legitimate interest | Cannot withdraw; Recital 47 recognizes fraud prevention |\n| Sharing data with Datalytics Partners Ltd. | Consent | Third-party sharing not reasonably expected; user control appropriate |\n| Network security monitoring | Legitimate interest | Recital 49 explicitly recognizes network security as LI |\n| Employee performance monitoring | Legitimate interest | Power imbalance makes employee consent invalid (WP29 Opinion 2\u002F2017) |\n\n## Key Regulatory References\n\n- GDPR Article 6(1)(a) — Consent as lawful basis\n- GDPR Article 6(1)(f) — Legitimate interest as lawful basis\n- GDPR Article 7(4) — Conditionality prohibition\n- GDPR Recitals 47, 48, 49 — Guidance on legitimate interest scenarios\n- Article 29 WP Opinion 06\u002F2014 on Legitimate Interest (WP217)\n- EDPB Guidelines 05\u002F2020 on Consent — Power imbalance analysis\n- CJEU C-13\u002F16 (Rigas) — Legitimate interest balancing test\n- CJEU C-40\u002F17 (Fashion ID) — Joint controller LI responsibility\n- ePrivacy Directive Articles 5(3) and 13 — Sector-specific consent requirements\n- WP29 Opinion 2\u002F2017 on Data Processing at Work — Employee consent limitations\n","# Assessing Legitimate Interest vs Consent\n\n## Overview\n\nGDPR Article 6(1) provides six lawful bases for processing. Consent (Article 6(1)(a)) and legitimate interest (Article 6(1)(f)) are the two most commonly used bases for commercial data processing. Choosing the wrong basis creates compliance risk: relying on consent when it cannot be freely given undermines validity, while relying on legitimate interest when consent is required (e.g., for electronic marketing under the ePrivacy Directive) violates sectoral law.\n\n## Decision Framework: When to Use Each Basis\n\n### Use Consent When:\n\n1. **Regulatory requirement**: Specific legislation mandates consent (e.g., ePrivacy Directive Article 5(3) for non-essential cookies, Article 13 for unsolicited electronic marketing)\n2. **Special category data**: Processing sensitive data under Article 9(2)(a) requires explicit consent\n3. **Automated decision-making**: Processing under Article 22(2)(c) requires explicit consent\n4. **International transfers**: Article 49(1)(a) explicit consent for transfers without adequacy\u002Fsafeguards\n5. **User control priority**: The processing is entirely optional and the data subject should have full control\n\n### Use Legitimate Interest When:\n\n1. **Power imbalance exists**: Consent cannot be freely given (employer-employee, public authority-citizen)\n2. **Processing is necessary**: The processing is necessary for the controller's or third party's legitimate interest and is proportionate\n3. **Reasonable expectation**: The data subject would reasonably expect the processing (Recital 47)\n4. **Withdrawal would be problematic**: If consent withdrawal would cause operational issues (e.g., fraud prevention)\n5. **No specific consent requirement**: No ePrivacy or sectoral law mandates consent\n\n## Power Imbalance Indicators\n\nPer EDPB Guidelines 05\u002F2020 (paragraphs 13-25) and Recital 43, consent is presumed not to be freely given when a clear imbalance exists:\n\n| Indicator | Example | Implication |\n|-----------|---------|-------------|\n| Employment relationship | Employer asks employee to consent to monitoring | Use LI or legal obligation, not consent |\n| Public authority | Tax authority processes taxpayer data | Use legal obligation or public task |\n| Service dependency | Only provider in market; user has no alternative | Consent may not be freely given |\n| Contractual bundling | Consent required as condition of contract (Art. 7(4)) | Consent likely invalid |\n| Vulnerable data subjects | Children, elderly, patients | Extra scrutiny; consent may not be free |\n| Significant consequence | Refusing consent leads to job loss or service termination | Consent not freely given |\n\n## The Three-Part Legitimate Interest Assessment (LIA)\n\nPer CJEU case law (C-13\u002F16 Rigas, C-40\u002F17 Fashion ID) and Article 29 Working Party Opinion 06\u002F2014:\n\n### Part 1: Purpose Test\n\nIs the interest legitimate?\n\n- The interest must be lawful (not in itself illegal)\n- The interest must be real and present (not speculative)\n- The interest must be sufficiently clearly articulated\n\n**CloudVault SaaS Inc. examples of legitimate interests:**\n- Network and information security (Recital 49)\n- Fraud prevention and detection\n- Direct marketing to existing customers (Recital 47)\n- Internal administrative purposes within a group (Recital 48)\n- Service improvement based on aggregated usage analytics\n\n### Part 2: Necessity Test\n\nIs the processing necessary for the legitimate interest?\n\n- Could the same interest be achieved with less data?\n- Could the same interest be achieved without processing personal data?\n- Is the processing proportionate to the interest pursued?\n\n### Part 3: Balancing Test\n\nDo the data subject's rights and freedoms override the legitimate interest?\n\n| Factor | Weighs Toward LI | Weighs Toward Data Subject |\n|--------|------------------|---------------------------|\n| Data sensitivity | Non-sensitive data | Special category data |\n| Reasonable expectation | Processing expected by data subject | Surprising or unexpected processing |\n| Relationship | Existing customer\u002Fuser relationship | No prior relationship |\n| Impact | Minimal impact on individual | Significant consequences |\n| Safeguards | Robust safeguards in place | No safeguards |\n| Data subject control | Easy opt-out available | No opt-out mechanism |\n| Vulnerable groups | No vulnerable individuals | Children or vulnerable adults |\n| Data volume | Minimal data used | Extensive profiling |\n\n## Decision Tree\n\n```\nSTART: Need to establish lawful basis for processing activity\n  │\n  ├─► Q1: Does specific legislation require consent?\n  │     (ePrivacy Art. 5(3) for cookies, Art. 13 for e-marketing,\n  │      GDPR Art. 9(2)(a) for special categories, Art. 22(2)(c) for automated decisions)\n  │     │\n  │     ├─ YES → Use CONSENT (mandatory)\n  │     │\n  │     └─ NO → Continue to Q2\n  │\n  ├─► Q2: Is there a power imbalance between controller and data subject?\n  │     (employer-employee, public authority, service dependency)\n  │     │\n  │     ├─ YES → Consent likely INVALID; consider LEGITIMATE INTEREST\n  │     │         (or legal obligation\u002Fpublic task if applicable)\n  │     │\n  │     └─ NO → Continue to Q3\n  │\n  ├─► Q3: Is consent conditioned on the service?\n  │     (Would refusing consent result in service denial or degradation?)\n  │     │\n  │     ├─ YES → Violates Art. 7(4); consent likely INVALID\n  │     │         Consider LEGITIMATE INTEREST or restructure the service\n  │     │\n  │     └─ NO → Continue to Q4\n  │\n  ├─► Q4: Is consent withdrawal operationally feasible?\n  │     (Can you stop processing immediately if consent is withdrawn?)\n  │     │\n  │     ├─ NO → LEGITIMATE INTEREST may be more appropriate\n  │     │        (e.g., fraud prevention cannot stop mid-transaction)\n  │     │\n  │     └─ YES → Continue to Q5\n  │\n  ├─► Q5: Does the data subject reasonably expect this processing?\n  │     │\n  │     ├─ YES → Either CONSENT or LEGITIMATE INTEREST may work\n  │     │         Choose based on control preference and overhead\n  │     │\n  │     └─ NO → CONSENT is more appropriate\n  │               (unexpected processing needs explicit agreement)\n  │\n  └─► Q6: Final determination\n        ├─ If consent: Implement full Art. 7 requirements (freely given, specific,\n        │   informed, unambiguous, withdrawal as easy as giving)\n        └─ If LI: Document three-part LIA, implement opt-out mechanism,\n            include in privacy notice per Art. 13(1)(d)\u002F14(2)(b)\n```\n\n## Common Scenarios at CloudVault SaaS Inc.\n\n| Scenario | Recommended Basis | Reasoning |\n|----------|------------------|-----------|\n| Essential cookies for session management | Not consent; exempt under ePrivacy Art. 5(3) | Strictly necessary; no consent required |\n| Analytics cookies (non-essential) | Consent | ePrivacy Art. 5(3) requires consent for non-essential cookies |\n| Email marketing to existing customers | Legitimate interest (soft opt-in) | ePrivacy Art. 13(2) allows soft opt-in for existing customers with opt-out |\n| Email marketing to new contacts | Consent | ePrivacy Art. 13(1) requires prior consent for unsolicited e-marketing |\n| Fraud detection on transactions | Legitimate interest | Cannot withdraw; Recital 47 recognizes fraud prevention |\n| Sharing data with Datalytics Partners Ltd. | Consent | Third-party sharing not reasonably expected; user control appropriate |\n| Network security monitoring | Legitimate interest | Recital 49 explicitly recognizes network security as LI |\n| Employee performance monitoring | Legitimate interest | Power imbalance makes employee consent invalid (WP29 Opinion 2\u002F2017) |\n\n## Key Regulatory References\n\n- GDPR Article 6(1)(a) — Consent as lawful basis\n- GDPR Article 6(1)(f) — Legitimate interest as lawful basis\n- GDPR Article 7(4) — Conditionality prohibition\n- GDPR Recitals 47, 48, 49 — Guidance on legitimate interest scenarios\n- Article 29 WP Opinion 06\u002F2014 on Legitimate Interest (WP217)\n- EDPB Guidelines 05\u002F2020 on Consent — Power imbalance analysis\n- CJEU C-13\u002F16 (Rigas) — Legitimate interest balancing test\n- CJEU C-40\u002F17 (Fashion ID) — Joint controller LI responsibility\n- ePrivacy Directive Articles 5(3) and 13 — Sector-specific consent requirements\n- WP29 Opinion 2\u002F2017 on Data Processing at Work — Employee consent limitations\n",{"name":5,"license":15,"metadata":39,"description":7},{"tags":40,"author":9,"domain":32,"version":41,"subdomain":42},"legitimate-interest, consent-vs-lia, lawful-basis, power-imbalance, article-6","1.0","consent-management","main","9b2ef9eae161c00a17241d42a388571321b33e9f","plugins\u002Fprivacy-skills-complete\u002Fskills\u002Flegit-interest-vs-consent",67,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-03-17 04:06:52",{"source":8,"skillName":5,"commands":53,"prompt":63,"zipAvailable":64},[54,57,60],{"tool":55,"command":56},"npx","npx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill legit-interest-vs-consent",{"tool":58,"command":59},"bunx","bunx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill legit-interest-vs-consent",{"tool":61,"command":62},"pnpm","pnpm dlx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill legit-interest-vs-consent","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Flegit-interest-vs-consent\u002FSKILL.md",true,[66,72,78,82,86,90,96],{"path":67,"resourceType":68,"resourceTypeDesc":69,"sizeBytes":70,"sourceHtmlUrl":71},"assets\u002Ftemplate.md","ASSET","资产文件",3177,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Flegit-interest-vs-consent\u002Fassets\u002Ftemplate.md",{"path":73,"resourceType":74,"resourceTypeDesc":75,"sizeBytes":76,"sourceHtmlUrl":77},"code-quality-reviewer-prompt.md","REFERENCE","参考文档",630,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Frghamilton3-dotfiles\u002Fdot_config\u002Fopencode\u002Fsuperpowers\u002Fskills\u002Fsubagent-driven-development\u002Fcode-quality-reviewer-prompt.md",{"path":79,"resourceType":74,"resourceTypeDesc":75,"sizeBytes":80,"sourceHtmlUrl":81},"implementer-prompt.md",2195,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Frghamilton3-dotfiles\u002Fdot_config\u002Fopencode\u002Fsuperpowers\u002Fskills\u002Fsubagent-driven-development\u002Fimplementer-prompt.md",{"path":83,"resourceType":74,"resourceTypeDesc":75,"sizeBytes":84,"sourceHtmlUrl":85},"references\u002Fstandards.md",4665,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Flegit-interest-vs-consent\u002Freferences\u002Fstandards.md",{"path":87,"resourceType":74,"resourceTypeDesc":75,"sizeBytes":88,"sourceHtmlUrl":89},"references\u002Fworkflows.md",4608,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Flegit-interest-vs-consent\u002Freferences\u002Fworkflows.md",{"path":91,"resourceType":92,"resourceTypeDesc":93,"sizeBytes":94,"sourceHtmlUrl":95},"scripts\u002Fprocess.py","SCRIPT","脚本",11882,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fprivacy-skills-complete\u002Fskills\u002Flegit-interest-vs-consent\u002Fscripts\u002Fprocess.py",{"path":97,"resourceType":74,"resourceTypeDesc":75,"sizeBytes":98,"sourceHtmlUrl":99},"spec-reviewer-prompt.md",1999,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Frghamilton3-dotfiles\u002Fdot_config\u002Fopencode\u002Fsuperpowers\u002Fskills\u002Fsubagent-driven-development\u002Fspec-reviewer-prompt.md",[101,126,143,156,173,186],{"skillNo":102,"name":103,"nameZh":6,"description":104,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":105,"categories":106,"keywords":116,"publishedAt":34},"01M6AG6K8R3XW10ENWH2FH18RH","workplace-email-privacy","Implements email and internet monitoring compliance in the workplace per Barbulescu v Romania (ECHR Grand Chamber), EDPB guidance, and national labour law. Covers acceptable use policies, legitimate expectation of privacy, proportionality testing, and content vs metadata monitoring. Keywords: email monitoring, Barbulescu, workplace privacy, internet monitoring, acceptable use policy, ECHR, proportionality.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fworkplace-email-privacy\u002FSKILL.md",[107,110,113],{"categoryNo":108,"categoryName":109,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000005","邮件与沟通",{"categoryNo":111,"categoryName":112,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":114,"categoryName":115,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000037","律师与法务",[117,118,32,119,120,121,122,123,124,125],"email","workplace email privacy","compliance","content","data","policy","testing","monitoring","metadata",{"skillNo":127,"name":128,"nameZh":6,"description":129,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":130,"categories":131,"keywords":136,"publishedAt":34},"01M6AG6FRCBJY7D061BJZMNV49","whistleblower-data","Implements data protection compliance for whistleblowing systems under EU Directive 2019\u002F1937 and GDPR. Covers anonymous reporting channels, identity protection for whistleblowers and accused persons, retention limits, access restrictions, and retaliation prevention. Addresses national transpositions and DPA guidance. Keywords: whistleblower, Directive 2019\u002F1937, anonymous reporting, identity protection, retaliation, retention, reporting channel.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fwhistleblower-data\u002FSKILL.md",[132,135],{"categoryNo":133,"categoryName":134,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000033","数据分析师",{"categoryNo":114,"categoryName":115,"taxonomyType":26,"taxonomyTypeDesc":27},[121,137,138,139,119,140,141,32,142],"whistleblower data","identity","reporting","data protection","gdpr","prevention",{"skillNo":144,"name":145,"nameZh":6,"description":146,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":147,"categories":148,"keywords":150,"publishedAt":34},"01M6AG6CJP0PW3X65HC7VP9SR9","vendor-termination-data","Vendor termination data return and deletion procedures per GDPR Article 28(3)(g). Covers data extraction formats, deletion certification requirements, transition planning, residual data handling, and post-termination verification.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-termination-data\u002FSKILL.md",[149],{"categoryNo":133,"categoryName":134,"taxonomyType":26,"taxonomyTypeDesc":27},[121,151,152,153,154,141,32,155],"vendor termination data","planning","verification","extraction","certification",{"skillNo":157,"name":158,"nameZh":6,"description":159,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":160,"categories":161,"keywords":163,"publishedAt":34},"01M6AG69E277DXZB2NF6KV17ZA","vendor-risk-scoring","Vendor privacy risk tiering methodology for processor management. Covers scoring factors including data volume, sensitivity, transfer locations, certifications, breach history, and control maturity with weighted risk calculation and tier assignment.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-risk-scoring\u002FSKILL.md",[162],{"categoryNo":133,"categoryName":134,"taxonomyType":26,"taxonomyTypeDesc":27},[164,165,166,167,168,169,170,171,32,121,172],"vendor risk scoring","risk","risk scoring","methodology","risk-scoring","assessment","transfer","certifications","processor",{"skillNo":174,"name":175,"nameZh":6,"description":176,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":177,"categories":178,"keywords":180,"publishedAt":34},"01M6AG6655ABFKT2BBWHCP4PAT","vendor-privacy-due-diligence","Pre-contract vendor privacy due diligence per GDPR Article 28(1). Covers risk questionnaires, technical controls assessment, certification review, data flow analysis, and documented sufficiency decisions for processor engagement.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-privacy-due-diligence\u002FSKILL.md",[179],{"categoryNo":114,"categoryName":115,"taxonomyType":26,"taxonomyTypeDesc":27},[32,181,141,182,169,183,184,121,172,165,155,185],"vendor privacy due diligence","review","onboarding","flow","analysis",{"skillNo":187,"name":188,"nameZh":6,"description":189,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":190,"categories":191,"keywords":195,"publishedAt":34},"01M6AG62C3VD8SYNGH4N7RHZTE","vendor-privacy-audit","On-site and remote vendor audit procedures per GDPR Article 28(3)(h). Covers audit planning, evidence collection methodologies, finding classification, remediation tracking, and audit report generation for processor compliance verification.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-privacy-audit\u002FSKILL.md",[192,193,194],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},{"categoryNo":114,"categoryName":115,"taxonomyType":26,"taxonomyTypeDesc":27},[196,197,32,198,153,199,119,141,200,172,201,202,203,152],"vendor privacy audit","audit","report","audit report","remediation","collection","remediation-tracking","classification"]