本文へ移動
cccskills
無料GitHub で公開

dpia-stakeholder-consult

Guides data subject and stakeholder consultation requirements during Data Protection Impact Assessments under GDPR Article 35(9). Covers consultation planning, data subject engagement methods, DPO involvement per Art. 35(2), and documentation of views received. Keywords: DPIA consultation, stakeholder engagement, Art. 35(9), data subject views, DPO advice, public consultation, representative groups.

インストール方法を見る

含まれるファイル(5)

  • SKILL.md3.4 KB
  • assets/template.md8.8 KB
  • references/standards.md3.2 KB
  • references/workflows.md3.4 KB
  • scripts/process.py13.4 KB

SKILL.md(原文)

インストールする前に、エージェントに与えられる指示の中身を確認できます。

DPIA Stakeholder Consultation

Overview

Article 35(9) GDPR requires that controllers "shall, where appropriate, seek the views of data subjects or their representatives on the intended processing, without prejudice to the protection of commercial or public interests or the security of processing operations." This skill provides a structured approach to meeting this obligation.

Legal Requirements

Art. 35(9) -- Data Subject Consultation

The controller must seek data subject views "where appropriate." EDPB WP248rev.01 clarifies that failure to consult must be justified and documented.

Art. 35(2) -- DPO Involvement

"The controller shall seek the advice of the data protection officer, where designated, when carrying out a data protection impact assessment."

Art. 36(1) -- Prior Consultation Context

Where prior consultation with the supervisory authority is required, evidence of stakeholder consultation strengthens the submission.

Consultation Methods

MethodSuitabilityScaleCost
Focus groupsDeep qualitative insightSmall (8-12 participants)Medium
Online surveysBroad quantitative dataLarge (hundreds+)Low
Written consultationFormal, documented responsesMediumLow
Public meetingsCommunity engagementMedium-LargeMedium
Representative body engagementSector-specific expertiseVariesLow
Advisory panelOngoing inputSmall (5-10 members)Medium
User testing with privacy lensPractical usability insightSmall-MediumHigh

Consultation Process

Step 1: Determine Appropriateness

  • Assess whether consultation is feasible without compromising security
  • Document any reasons for not consulting (Art. 35(9) exemption)
  • Consider proportionality: scale of processing vs consultation effort

Step 2: Identify Stakeholders

  • Direct data subjects (or representative sample)
  • Data subject representative bodies (consumer associations, patient groups, trade unions)
  • Data Protection Officer
  • Processor representatives
  • Relevant internal stakeholders (IT security, legal, business unit)

Step 3: Design Consultation

  • Select appropriate method(s) from the table above
  • Prepare accessible consultation materials explaining the processing
  • Define the specific questions or areas for input
  • Set timeline and response deadlines

Step 4: Execute and Document

  • Conduct consultation activities
  • Record all views received
  • Analyse feedback for themes and concerns
  • Document how feedback influenced the DPIA outcome

Step 5: Feedback Loop

  • Inform consultees of the outcome and actions taken
  • Explain where their views were incorporated or why they were not
  • Maintain ongoing engagement channel for future DPIA reviews

レビュー

まだレビューはありません。使ってみた感想をお寄せください。

同じリポジトリのスキル

概要と使いどころ

Implements 42 CFR Part 2 protections for substance use disorder patient records. Covers written consent requirements stricter than HIPAA, re-disclosure prohibition, court order procedures, qualified service organization agreements, and 2024 amendments aligning Part 2 with HIPAA. Keywords: 42 CFR Part 2, substance use disorder, SUD records, re-disclosure, consent, Part 2 amendments.

日本語の概要は準備中です。原文の説明を表示しています。

mukul975/Privacy-Data-Protection-Skills3032026年3月17日 更新

Guides assessment of third-country adequacy decisions under GDPR Article 45 for international data transfers. Covers the current EC adequacy decisions list, adequacy assessment criteria, partial adequacy handling, and monitoring of adequacy decision reviews. Keywords: adequacy decision, Article 45, third country, adequate protection, EC adequacy list.

日本語の概要は準備中です。原文の説明を表示しています。

mukul975/Privacy-Data-Protection-Skills3032026年3月17日 更新

Implements age-gating mechanisms for online services to restrict access based on user age. Covers hard gates versus soft gates, neutral age prompts, re-verification triggers, circumvention prevention, and regulatory requirements under GDPR, COPPA, UK Online Safety Act, and DSA. Keywords: age gate, age restriction, neutral prompt, children, online services, access control.

日本語の概要は準備中です。原文の説明を表示しています。

mukul975/Privacy-Data-Protection-Skills3032026年3月17日 更新

Evaluates and implements age estimation and verification technologies for online services. Covers facial age estimation, digital ID verification, self-declaration with risk assessment, AI-based age estimation, and the accuracy versus privacy tradeoff. Includes ICO guidance and euCONSENT framework. Keywords: age verification, age estimation, facial analysis, digital ID, children, online safety.

日本語の概要は準備中です。原文の説明を表示しています。

mukul975/Privacy-Data-Protection-Skills3032026年3月17日 更新

Preparing EU AI Act compliance documentation for high-risk AI systems. Covers Annex III classification, technical documentation under Art. 11, conformity assessment, risk management systems, and CE marking requirements. Keywords: EU AI Act, high-risk AI, Annex III, conformity assessment, CE marking.

日本語の概要は準備中です。原文の説明を表示しています。

mukul975/Privacy-Data-Protection-Skills3032026年3月17日 更新

Implements GDPR Art. 22 automated decision-making and AI Act Art. 14 human oversight requirements for AI systems. Covers identification of solely automated decisions, meaningful human intervention design, logic explanation mechanisms, and contestation procedures. Keywords: Art. 22, automated decision, human oversight, AI Act, profiling, contestation.

日本語の概要は準備中です。原文の説明を表示しています。

mukul975/Privacy-Data-Protection-Skills3032026年3月17日 更新

mukul975 のスキルをすべて見る

このスキルの問題を報告する