[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AF8RYX2QKAM15PDFH5YB8K":3,"skill-same:01M6AF8RYX2QKAM15PDFH5YB8K":88},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":26,"publishedAt":34,"linkOnly":35,"markdownContent":36,"markdownBody":37,"frontMatter":38,"refName":43,"commitSha":44,"skillDirectory":45,"forksCount":46,"repositoryHtmlUrl":47,"repositoryHomepageUrl":6,"ownerHtmlUrl":48,"ownerBlogUrl":49,"ownerDescription":50,"updatedAt":51,"install":52,"resources":65},"01M6AF8RYX2QKAM15PDFH5YB8K","colorado-cpa-compliance",null,"Colorado Privacy Act (CPA) compliance implementation. Covers universal opt-out mechanism required since July 2024, profiling opt-out rights, sensitive data consent requirements, AG rulemaking under 4 CCR 904-3, and consumer rights framework. Effective July 1, 2023.","mukul975\u002FPrivacy-Data-Protection-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADNKWX1HF4Q5DKEXT5M774",336,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fus-state-privacy-skills\u002Fskills\u002Fcolorado-cpa-compliance\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000033","数据分析师","PROFESSION","适用职业",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000037","律师与法务",[27,28,29,30,31,32,33],"compliance","colorado cpa compliance","state","framework","privacy","data","sensitive-data","2026-11-10 10:12:30",false,"---\nname: colorado-cpa-compliance\ndescription: >-\n  Colorado Privacy Act (CPA) compliance implementation. Covers universal\n  opt-out mechanism required since July 2024, profiling opt-out rights,\n  sensitive data consent requirements, AG rulemaking under 4 CCR 904-3,\n  and consumer rights framework. Effective July 1, 2023.\nlicense: Apache-2.0\nmetadata:\n  author: mukul975\n  version: \"1.0\"\n  domain: privacy\n  subdomain: us-state-privacy-laws\n  tags: \"colorado-cpa, universal-opt-out, profiling, sensitive-data, ag-rulemaking\"\n---\n\n# Colorado Privacy Act (CPA) Compliance\n\n## Overview\n\nThe Colorado Privacy Act (CPA), codified as C.R.S. §6-1-1301 through §6-1-1313, was signed into law on July 7, 2021 (SB 21-190), and became effective July 1, 2023. Colorado was the third state to enact comprehensive consumer privacy legislation. The CPA is notable for its robust rulemaking by the Colorado Attorney General, resulting in detailed implementing regulations at 4 CCR 904-3, and for being the first state (alongside Connecticut) to require recognition of universal opt-out mechanisms.\n\nThe Colorado AG published final rules effective March 1, 2024, with the universal opt-out mechanism requirement taking effect July 1, 2024.\n\n## Applicability (§6-1-1304)\n\nThe CPA applies to controllers that conduct business in Colorado or produce products or services intentionally targeted to Colorado residents AND:\n\n1. Control or process personal data of 100,000 or more Colorado consumers per calendar year; OR\n2. Control or process personal data of 25,000 or more Colorado consumers AND derive revenue or receive a discount on the price of goods or services from the sale of personal data.\n\n**Note:** Threshold (2) does not require a specific revenue percentage (unlike Virginia's 50% threshold).\n\n**Exemptions (§6-1-1304(2)):**\n- State and local government entities\n- National securities associations registered under 15 U.S.C. §78o-3\n- Financial institutions and affiliates subject to GLBA (entity-level)\n- Covered entities and business associates under HIPAA (entity-level)\n- Nonprofit organizations\n- Institutions of higher education\n- Data governed by GLBA, HIPAA, FERPA, FCRA, DPPA, COPPA, Farm Credit Act, and certain other federal statutes\n\n**Liberty Commerce Inc. Assessment:**\nLiberty Commerce Inc. processes data of approximately 98,000 Colorado consumers and derives advertising revenue from data-related activities. It meets threshold (2) and is subject to the CPA.\n\n## Consumer Rights (§6-1-1306)\n\n### 1. Right to Access (§6-1-1306(1)(a))\nConfirm whether a controller is processing their personal data and access such data.\n\n### 2. Right to Correct (§6-1-1306(1)(b))\nCorrect inaccuracies in personal data, taking into account the nature of the data and the purposes of processing.\n\n### 3. Right to Delete (§6-1-1306(1)(c))\nDelete personal data provided by or obtained about the consumer.\n\n### 4. Right to Data Portability (§6-1-1306(1)(d))\nObtain personal data in a portable and, to the extent technically feasible, readily usable format.\n\n### 5. Right to Opt Out (§6-1-1306(1)(e))\nOpt out of processing for purposes of:\n- **Targeted advertising**\n- **Sale of personal data**\n- **Profiling** in furtherance of decisions that produce legal or similarly significant effects\n\n**Liberty Commerce Inc. Implementation:**\nAll five rights are exercisable through the privacy portal at privacy.libertycommerce.com\u002Fcolorado. Opt-out rights are also accessible via universal opt-out mechanism (GPC) and a dedicated \"Your Privacy Choices\" link with the Colorado-approved opt-out icon.\n\n## Universal Opt-Out Mechanism (4 CCR 904-3, Rule 5.11)\n\nThe CPA is the first state law (alongside Connecticut) to mandate that controllers recognize universal opt-out mechanisms. The requirement became effective July 1, 2024.\n\n### Requirements\n\nControllers must:\n1. **Recognize and process** opt-out signals sent through a universal opt-out mechanism\n2. **Treat the signal** as a valid opt-out of sale of personal data and targeted advertising\n3. **Not require** additional consumer verification to process the signal\n4. **Not display** a pop-up, interstitial, or other mechanism asking the consumer to verify or modify the signal\n5. **Apply the signal** at the browser\u002Fdevice level for unauthenticated consumers\n6. **Apply the signal** at the account level for authenticated consumers\n7. **Resolve conflicts** in favor of the most recently expressed preference\n\n### Technical Standards (4 CCR 904-3, Rule 5.11)\n\nThe AG rules specify that a universal opt-out mechanism must:\n- Be a setting or extension of a platform, technology, or mechanism\n- Not be a default setting (must be affirmatively selected by the consumer)\n- Clearly communicate to the consumer what the setting means\n- Be consumer-friendly and easy to use\n- Send a signal to the controller that clearly communicates the consumer's choice\n\n**Global Privacy Control (GPC)** is recognized as a compliant universal opt-out mechanism.\n\n**Liberty Commerce Inc. Implementation:**\nLiberty Commerce Inc. detects GPC via the `Sec-GPC: 1` HTTP header and `navigator.globalPrivacyControl` JavaScript API. Upon detection:\n- Unauthenticated: Apply session-level opt-out of targeted advertising and sale\n- Authenticated: Permanently set account-level opt-out preferences\n- Suppress all third-party advertising tags and data sharing for cross-context behavioral advertising\n- Allow first-party analytics under processor agreement\n\n## Sensitive Data (§6-1-1304(26), §6-1-1308(7))\n\n### Categories\n1. Personal data revealing racial or ethnic origin\n2. Religious beliefs\n3. Mental or physical health condition or diagnosis\n4. Sex life or sexual orientation\n5. Citizenship or citizenship status\n6. Genetic or biometric data processed for uniquely identifying an individual\n7. Personal data of a known child\n\n### Consent Requirement\nProcessing of sensitive data requires the consumer's **opt-in consent**. Consent must be:\n- Freely given, specific, informed, and unambiguous\n- Clear affirmative act (no pre-checked boxes)\n- Specific to each sensitive data category and purpose\n\n### Profiling Opt-Out (§6-1-1306(1)(e)(III))\n\nConsumers may opt out of profiling in furtherance of decisions that produce legal or similarly significant effects. This is broader than most state laws and includes:\n- Decisions about provision or denial of financial or lending services\n- Decisions about provision or denial of housing\n- Decisions about provision or denial of insurance\n- Decisions about provision or denial of education enrollment or opportunity\n- Decisions about provision or denial of employment\n- Decisions about provision or denial of health care services\n- Decisions about access to basic necessities (food, water, shelter, energy, transportation)\n\n**Liberty Commerce Inc. Implementation:**\nLiberty Commerce Inc. conducts profiling for its buy-now-pay-later feature (credit scoring). Colorado consumers are provided a specific opt-out mechanism for this profiling activity, with disclosure of the logic involved, significance of the decision, and anticipated consequences.\n\n## Controller Obligations (§6-1-1308)\n\n### Privacy Notice (§6-1-1308(1))\nMust include:\n- Categories of personal data collected or processed\n- Purposes for processing\n- Consumer rights and how to exercise them\n- Categories of personal data shared with third parties\n- Categories of third parties with whom data is shared\n- Contact information (email or online mechanism)\n- Whether personal data is sold or used for targeted advertising\n- Whether profiling is conducted and opt-out information\n\n### Data Minimization (§6-1-1308(3))\nCollection must be adequate, relevant, and limited to what is reasonably necessary in relation to the specified purposes.\n\n### Purpose Limitation (§6-1-1308(4))\nProcessing may not exceed what is reasonably necessary to and compatible with the specified purposes.\n\n### Data Security (§6-1-1308(5))\nReasonable administrative, technical, and physical security practices appropriate to the volume, scope, and nature of the data.\n\n### Non-Discrimination (§6-1-1308(6))\nMay not process personal data in violation of state and federal antidiscrimination laws.\n\n### DPIA Requirements (§6-1-1309)\n\nControllers must conduct DPIAs for:\n- Targeted advertising processing\n- Sale of personal data\n- Certain types of profiling\n- Sensitive data processing\n- Any processing presenting heightened risk of harm\n\nDPIAs must be made available to the AG upon request.\n\n## Enforcement (§6-1-1311, §6-1-1312)\n\n### Attorney General Authority\n- Exclusive enforcement under the Colorado Consumer Protection Act (§6-1-101 et seq.)\n- May issue civil investigative demands\n- May seek injunctive relief, restitution, and civil penalties\n\n### Cure Period\n- 60-day cure period was available until January 1, 2025\n- After January 1, 2025: No automatic cure period; AG has discretion to consider good-faith efforts\n\n### Penalties\n- Treated as a deceptive trade practice under §6-1-105\n- Civil penalties up to $20,000 per violation (under Colorado Consumer Protection Act)\n- Injunctive relief and restitution\n\n## AG Rulemaking (4 CCR 904-3)\n\nThe Colorado AG published comprehensive regulations addressing:\n- **Rule 2**: Definitions and general provisions\n- **Rule 3**: Consumer rights procedures\n- **Rule 4**: Controller and processor obligations\n- **Rule 5**: Universal opt-out mechanism technical standards\n- **Rule 6**: Consent requirements for sensitive data\n- **Rule 7**: Data protection impact assessment requirements\n- **Rule 8**: Biennial review of universal opt-out mechanisms\n\n## Key Regulatory References\n\n- C.R.S. §6-1-1301 through §6-1-1313 (Colorado Privacy Act)\n- 4 CCR 904-3 (AG implementing regulations, effective March 1, 2024)\n- C.R.S. §6-1-101 et seq. (Colorado Consumer Protection Act — enforcement framework)\n- AG Technical Guidance on Universal Opt-Out Mechanisms (July 2024)\n- Global Privacy Control Specification v1.0\n","# Colorado Privacy Act (CPA) Compliance\n\n## Overview\n\nThe Colorado Privacy Act (CPA), codified as C.R.S. §6-1-1301 through §6-1-1313, was signed into law on July 7, 2021 (SB 21-190), and became effective July 1, 2023. Colorado was the third state to enact comprehensive consumer privacy legislation. The CPA is notable for its robust rulemaking by the Colorado Attorney General, resulting in detailed implementing regulations at 4 CCR 904-3, and for being the first state (alongside Connecticut) to require recognition of universal opt-out mechanisms.\n\nThe Colorado AG published final rules effective March 1, 2024, with the universal opt-out mechanism requirement taking effect July 1, 2024.\n\n## Applicability (§6-1-1304)\n\nThe CPA applies to controllers that conduct business in Colorado or produce products or services intentionally targeted to Colorado residents AND:\n\n1. Control or process personal data of 100,000 or more Colorado consumers per calendar year; OR\n2. Control or process personal data of 25,000 or more Colorado consumers AND derive revenue or receive a discount on the price of goods or services from the sale of personal data.\n\n**Note:** Threshold (2) does not require a specific revenue percentage (unlike Virginia's 50% threshold).\n\n**Exemptions (§6-1-1304(2)):**\n- State and local government entities\n- National securities associations registered under 15 U.S.C. §78o-3\n- Financial institutions and affiliates subject to GLBA (entity-level)\n- Covered entities and business associates under HIPAA (entity-level)\n- Nonprofit organizations\n- Institutions of higher education\n- Data governed by GLBA, HIPAA, FERPA, FCRA, DPPA, COPPA, Farm Credit Act, and certain other federal statutes\n\n**Liberty Commerce Inc. Assessment:**\nLiberty Commerce Inc. processes data of approximately 98,000 Colorado consumers and derives advertising revenue from data-related activities. It meets threshold (2) and is subject to the CPA.\n\n## Consumer Rights (§6-1-1306)\n\n### 1. Right to Access (§6-1-1306(1)(a))\nConfirm whether a controller is processing their personal data and access such data.\n\n### 2. Right to Correct (§6-1-1306(1)(b))\nCorrect inaccuracies in personal data, taking into account the nature of the data and the purposes of processing.\n\n### 3. Right to Delete (§6-1-1306(1)(c))\nDelete personal data provided by or obtained about the consumer.\n\n### 4. Right to Data Portability (§6-1-1306(1)(d))\nObtain personal data in a portable and, to the extent technically feasible, readily usable format.\n\n### 5. Right to Opt Out (§6-1-1306(1)(e))\nOpt out of processing for purposes of:\n- **Targeted advertising**\n- **Sale of personal data**\n- **Profiling** in furtherance of decisions that produce legal or similarly significant effects\n\n**Liberty Commerce Inc. Implementation:**\nAll five rights are exercisable through the privacy portal at privacy.libertycommerce.com\u002Fcolorado. Opt-out rights are also accessible via universal opt-out mechanism (GPC) and a dedicated \"Your Privacy Choices\" link with the Colorado-approved opt-out icon.\n\n## Universal Opt-Out Mechanism (4 CCR 904-3, Rule 5.11)\n\nThe CPA is the first state law (alongside Connecticut) to mandate that controllers recognize universal opt-out mechanisms. The requirement became effective July 1, 2024.\n\n### Requirements\n\nControllers must:\n1. **Recognize and process** opt-out signals sent through a universal opt-out mechanism\n2. **Treat the signal** as a valid opt-out of sale of personal data and targeted advertising\n3. **Not require** additional consumer verification to process the signal\n4. **Not display** a pop-up, interstitial, or other mechanism asking the consumer to verify or modify the signal\n5. **Apply the signal** at the browser\u002Fdevice level for unauthenticated consumers\n6. **Apply the signal** at the account level for authenticated consumers\n7. **Resolve conflicts** in favor of the most recently expressed preference\n\n### Technical Standards (4 CCR 904-3, Rule 5.11)\n\nThe AG rules specify that a universal opt-out mechanism must:\n- Be a setting or extension of a platform, technology, or mechanism\n- Not be a default setting (must be affirmatively selected by the consumer)\n- Clearly communicate to the consumer what the setting means\n- Be consumer-friendly and easy to use\n- Send a signal to the controller that clearly communicates the consumer's choice\n\n**Global Privacy Control (GPC)** is recognized as a compliant universal opt-out mechanism.\n\n**Liberty Commerce Inc. Implementation:**\nLiberty Commerce Inc. detects GPC via the `Sec-GPC: 1` HTTP header and `navigator.globalPrivacyControl` JavaScript API. Upon detection:\n- Unauthenticated: Apply session-level opt-out of targeted advertising and sale\n- Authenticated: Permanently set account-level opt-out preferences\n- Suppress all third-party advertising tags and data sharing for cross-context behavioral advertising\n- Allow first-party analytics under processor agreement\n\n## Sensitive Data (§6-1-1304(26), §6-1-1308(7))\n\n### Categories\n1. Personal data revealing racial or ethnic origin\n2. Religious beliefs\n3. Mental or physical health condition or diagnosis\n4. Sex life or sexual orientation\n5. Citizenship or citizenship status\n6. Genetic or biometric data processed for uniquely identifying an individual\n7. Personal data of a known child\n\n### Consent Requirement\nProcessing of sensitive data requires the consumer's **opt-in consent**. Consent must be:\n- Freely given, specific, informed, and unambiguous\n- Clear affirmative act (no pre-checked boxes)\n- Specific to each sensitive data category and purpose\n\n### Profiling Opt-Out (§6-1-1306(1)(e)(III))\n\nConsumers may opt out of profiling in furtherance of decisions that produce legal or similarly significant effects. This is broader than most state laws and includes:\n- Decisions about provision or denial of financial or lending services\n- Decisions about provision or denial of housing\n- Decisions about provision or denial of insurance\n- Decisions about provision or denial of education enrollment or opportunity\n- Decisions about provision or denial of employment\n- Decisions about provision or denial of health care services\n- Decisions about access to basic necessities (food, water, shelter, energy, transportation)\n\n**Liberty Commerce Inc. Implementation:**\nLiberty Commerce Inc. conducts profiling for its buy-now-pay-later feature (credit scoring). Colorado consumers are provided a specific opt-out mechanism for this profiling activity, with disclosure of the logic involved, significance of the decision, and anticipated consequences.\n\n## Controller Obligations (§6-1-1308)\n\n### Privacy Notice (§6-1-1308(1))\nMust include:\n- Categories of personal data collected or processed\n- Purposes for processing\n- Consumer rights and how to exercise them\n- Categories of personal data shared with third parties\n- Categories of third parties with whom data is shared\n- Contact information (email or online mechanism)\n- Whether personal data is sold or used for targeted advertising\n- Whether profiling is conducted and opt-out information\n\n### Data Minimization (§6-1-1308(3))\nCollection must be adequate, relevant, and limited to what is reasonably necessary in relation to the specified purposes.\n\n### Purpose Limitation (§6-1-1308(4))\nProcessing may not exceed what is reasonably necessary to and compatible with the specified purposes.\n\n### Data Security (§6-1-1308(5))\nReasonable administrative, technical, and physical security practices appropriate to the volume, scope, and nature of the data.\n\n### Non-Discrimination (§6-1-1308(6))\nMay not process personal data in violation of state and federal antidiscrimination laws.\n\n### DPIA Requirements (§6-1-1309)\n\nControllers must conduct DPIAs for:\n- Targeted advertising processing\n- Sale of personal data\n- Certain types of profiling\n- Sensitive data processing\n- Any processing presenting heightened risk of harm\n\nDPIAs must be made available to the AG upon request.\n\n## Enforcement (§6-1-1311, §6-1-1312)\n\n### Attorney General Authority\n- Exclusive enforcement under the Colorado Consumer Protection Act (§6-1-101 et seq.)\n- May issue civil investigative demands\n- May seek injunctive relief, restitution, and civil penalties\n\n### Cure Period\n- 60-day cure period was available until January 1, 2025\n- After January 1, 2025: No automatic cure period; AG has discretion to consider good-faith efforts\n\n### Penalties\n- Treated as a deceptive trade practice under §6-1-105\n- Civil penalties up to $20,000 per violation (under Colorado Consumer Protection Act)\n- Injunctive relief and restitution\n\n## AG Rulemaking (4 CCR 904-3)\n\nThe Colorado AG published comprehensive regulations addressing:\n- **Rule 2**: Definitions and general provisions\n- **Rule 3**: Consumer rights procedures\n- **Rule 4**: Controller and processor obligations\n- **Rule 5**: Universal opt-out mechanism technical standards\n- **Rule 6**: Consent requirements for sensitive data\n- **Rule 7**: Data protection impact assessment requirements\n- **Rule 8**: Biennial review of universal opt-out mechanisms\n\n## Key Regulatory References\n\n- C.R.S. §6-1-1301 through §6-1-1313 (Colorado Privacy Act)\n- 4 CCR 904-3 (AG implementing regulations, effective March 1, 2024)\n- C.R.S. §6-1-101 et seq. (Colorado Consumer Protection Act — enforcement framework)\n- AG Technical Guidance on Universal Opt-Out Mechanisms (July 2024)\n- Global Privacy Control Specification v1.0\n",{"name":5,"license":15,"metadata":39,"description":7},{"tags":40,"author":9,"domain":31,"version":41,"subdomain":42},"colorado-cpa, universal-opt-out, profiling, sensitive-data, ag-rulemaking","1.0","us-state-privacy-laws","main","9b2ef9eae161c00a17241d42a388571321b33e9f","plugins\u002Fus-state-privacy-skills\u002Fskills\u002Fcolorado-cpa-compliance",67,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-03-17 04:06:52",{"source":8,"skillName":5,"commands":53,"prompt":63,"zipAvailable":64},[54,57,60],{"tool":55,"command":56},"npx","npx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill colorado-cpa-compliance",{"tool":58,"command":59},"bunx","bunx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill colorado-cpa-compliance",{"tool":61,"command":62},"pnpm","pnpm dlx skills add mukul975\u002FPrivacy-Data-Protection-Skills --skill colorado-cpa-compliance","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fus-state-privacy-skills\u002Fskills\u002Fcolorado-cpa-compliance\u002FSKILL.md",true,[66,72,78,82],{"path":67,"resourceType":68,"resourceTypeDesc":69,"sizeBytes":70,"sourceHtmlUrl":71},"assets\u002Ftemplate.md","ASSET","资产文件",1762,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fus-state-privacy-skills\u002Fskills\u002Fcolorado-cpa-compliance\u002Fassets\u002Ftemplate.md",{"path":73,"resourceType":74,"resourceTypeDesc":75,"sizeBytes":76,"sourceHtmlUrl":77},"references\u002Fstandards.md","REFERENCE","参考文档",4184,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fus-state-privacy-skills\u002Fskills\u002Fcolorado-cpa-compliance\u002Freferences\u002Fstandards.md",{"path":79,"resourceType":74,"resourceTypeDesc":75,"sizeBytes":80,"sourceHtmlUrl":81},"references\u002Fworkflows.md",5008,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fus-state-privacy-skills\u002Fskills\u002Fcolorado-cpa-compliance\u002Freferences\u002Fworkflows.md",{"path":83,"resourceType":84,"resourceTypeDesc":85,"sizeBytes":86,"sourceHtmlUrl":87},"scripts\u002Fprocess.py","SCRIPT","脚本",8323,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fplugins\u002Fus-state-privacy-skills\u002Fskills\u002Fcolorado-cpa-compliance\u002Fscripts\u002Fprocess.py",[89,112,127,140,157,170],{"skillNo":90,"name":91,"nameZh":6,"description":92,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":93,"categories":94,"keywords":104,"publishedAt":34},"01M6AG6K8R3XW10ENWH2FH18RH","workplace-email-privacy","Implements email and internet monitoring compliance in the workplace per Barbulescu v Romania (ECHR Grand Chamber), EDPB guidance, and national labour law. Covers acceptable use policies, legitimate expectation of privacy, proportionality testing, and content vs metadata monitoring. Keywords: email monitoring, Barbulescu, workplace privacy, internet monitoring, acceptable use policy, ECHR, proportionality.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fworkplace-email-privacy\u002FSKILL.md",[95,100,103],{"categoryNo":96,"categoryName":97,"taxonomyType":98,"taxonomyTypeDesc":99},"01JBSEEDCAT000000000000005","邮件与沟通","SCENARIO","使用场景",{"categoryNo":101,"categoryName":102,"taxonomyType":98,"taxonomyTypeDesc":99},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[105,106,31,27,107,32,108,109,110,111],"email","workplace email privacy","content","policy","testing","monitoring","metadata",{"skillNo":113,"name":114,"nameZh":6,"description":115,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":116,"categories":117,"keywords":120,"publishedAt":34},"01M6AG6FRCBJY7D061BJZMNV49","whistleblower-data","Implements data protection compliance for whistleblowing systems under EU Directive 2019\u002F1937 and GDPR. Covers anonymous reporting channels, identity protection for whistleblowers and accused persons, retention limits, access restrictions, and retaliation prevention. Addresses national transpositions and DPA guidance. Keywords: whistleblower, Directive 2019\u002F1937, anonymous reporting, identity protection, retaliation, retention, reporting channel.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fwhistleblower-data\u002FSKILL.md",[118,119],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[32,121,122,123,27,124,125,31,126],"whistleblower data","identity","reporting","data protection","gdpr","prevention",{"skillNo":128,"name":129,"nameZh":6,"description":130,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":131,"categories":132,"keywords":134,"publishedAt":34},"01M6AG6CJP0PW3X65HC7VP9SR9","vendor-termination-data","Vendor termination data return and deletion procedures per GDPR Article 28(3)(g). Covers data extraction formats, deletion certification requirements, transition planning, residual data handling, and post-termination verification.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-termination-data\u002FSKILL.md",[133],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[32,135,136,137,138,125,31,139],"vendor termination data","planning","verification","extraction","certification",{"skillNo":141,"name":142,"nameZh":6,"description":143,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":144,"categories":145,"keywords":147,"publishedAt":34},"01M6AG69E277DXZB2NF6KV17ZA","vendor-risk-scoring","Vendor privacy risk tiering methodology for processor management. Covers scoring factors including data volume, sensitivity, transfer locations, certifications, breach history, and control maturity with weighted risk calculation and tier assignment.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-risk-scoring\u002FSKILL.md",[146],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[148,149,150,151,152,153,154,155,31,32,156],"vendor risk scoring","risk","risk scoring","methodology","risk-scoring","assessment","transfer","certifications","processor",{"skillNo":158,"name":159,"nameZh":6,"description":160,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":161,"categories":162,"keywords":164,"publishedAt":34},"01M6AG6655ABFKT2BBWHCP4PAT","vendor-privacy-due-diligence","Pre-contract vendor privacy due diligence per GDPR Article 28(1). Covers risk questionnaires, technical controls assessment, certification review, data flow analysis, and documented sufficiency decisions for processor engagement.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-privacy-due-diligence\u002FSKILL.md",[163],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[31,165,125,166,153,167,168,32,156,149,139,169],"vendor privacy due diligence","review","onboarding","flow","analysis",{"skillNo":171,"name":172,"nameZh":6,"description":173,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":174,"categories":175,"keywords":183,"publishedAt":34},"01M6AG62C3VD8SYNGH4N7RHZTE","vendor-privacy-audit","On-site and remote vendor audit procedures per GDPR Article 28(3)(h). Covers audit planning, evidence collection methodologies, finding classification, remediation tracking, and audit report generation for processor compliance verification.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FPrivacy-Data-Protection-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fprivacy\u002Fvendor-privacy-audit\u002FSKILL.md",[176,179,182],{"categoryNo":177,"categoryName":178,"taxonomyType":98,"taxonomyTypeDesc":99},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":180,"categoryName":181,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000036","内容创作者",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[184,185,31,186,137,187,27,125,188,156,189,190,191,136],"vendor privacy audit","audit","report","audit report","remediation","collection","remediation-tracking","classification"]