Mode d’emploi
- Copiez la commande et examinez le paquet avant de l’installer dans votre environnement agent.
- Consultez le document original pour les outils, identifiants et environnements requis.
- Décrivez les entrées et le livrable souhaité ; comparez la sortie aux sources.
npx skills add https://github.com/mukul975/privacy-data-protection-skills --skill pia-threshold-screeningAvant de commencer
- L’installation n’inclut ni abonnement au modèle, ni quota API, ni accès aux fichiers.
- Étoiles et installations reflètent l’activité, pas un test indépendant de qualité ou de sécurité.
Document Skill original
Rendu depuis le dépôt source en conservant titres, exemples, code, tableaux, liens et images.
PIA Threshold Screening
Overview
Article 35(1) GDPR requires a DPIA when processing is "likely to result in a high risk to the rights and freedoms of natural persons." This skill provides a structured screening methodology to make that determination before committing to a full DPIA.
Screening Criteria
EDPB Nine-Criteria Test (WP248rev.01)
Processing that meets two or more of the following criteria generally requires a DPIA:
| # | Criterion | GDPR Reference |
|---|---|---|
| 1 | Evaluation or scoring | Art. 35(3)(a) |
| 2 | Automated decision-making with legal/similar effect | Art. 35(3)(a) |
| 3 | Systematic monitoring | Art. 35(3)(c) |
| 4 | Sensitive data or data of highly personal nature | Art. 9, Art. 10 |
| 5 | Data processed on a large scale | Recital 91 |
| 6 | Matching or combining datasets | WP248 |
| 7 | Data concerning vulnerable data subjects | WP248 |
| 8 | Innovative use or applying new technological solutions | WP248 |
| 9 | Processing that prevents data subjects from exercising a right | Art. 22, Art. 35(3)(b) |
Mandatory DPIA Triggers (Art. 35(3))
A DPIA is always required for:
- (a) Systematic and extensive evaluation of personal aspects based on automated processing, including profiling, producing legal effects or similarly significant effects
- (b) Large-scale processing of special categories of data (Art. 9(1)) or criminal conviction data (Art. 10)
- (c) Systematic monitoring of a publicly accessible area on a large scale
National Supervisory Authority Blacklists (Art. 35(4))
Each EU/EEA supervisory authority publishes a list of processing operations requiring a DPIA. The screening must check the relevant national blacklist based on the controller establishment.
Screening Process
- Identify processing activity -- Describe the proposed or changed processing
- Check mandatory triggers -- Evaluate against Art. 35(3)(a)-(c)
- Check national blacklist -- Consult the relevant SA published list
- Apply nine-criteria test -- Score each WP248 criterion as met/not met
- Document rationale -- Record the screening decision with justification
- Escalate or close -- Route to full DPIA or document exemption
Decision Logic
IF any Art. 35(3) mandatory trigger is met → DPIA REQUIRED
ELSE IF processing appears on national SA blacklist → DPIA REQUIRED
ELSE IF 2+ WP248 criteria are met → DPIA REQUIRED
ELSE IF 1 WP248 criterion is met → DPIA RECOMMENDED (risk-based decision)
ELSE → DPIA NOT REQUIRED (document exemption)Integration Points
- RoPA linkage: Screening results attach to the corresponding RoPA entry
- Change management: New processing or material changes trigger re-screening
- DPIA register: Positive screening decisions feed the DPIA pipeline
