From data-subject-rights-skills
Implements GDPR Article 17 right to erasure workflow covering six grounds, five exceptions, deletion vs anonymization decisions, and Article 19 third-party notifications. Use for erasure requests.
npx claudepluginhub mukul975/privacy-data-protection-skills --plugin data-subject-rights-skillsThis skill uses the workspace's default tool permissions.
The right to erasure under GDPR Article 17 allows data subjects to request the deletion of their personal data. This right is not absolute — it is subject to specific grounds for erasure and a set of exceptions. This skill provides the complete operational procedure for receiving, assessing, executing, and confirming erasure requests.
Conducts multi-round deep research on GitHub repos via API and web searches, generating markdown reports with executive summaries, timelines, metrics, and Mermaid diagrams.
Dynamically discovers and combines enabled skills into cohesive, unexpected delightful experiences like interactive HTML or themed artifacts. Activates on 'surprise me', inspiration, or boredom cues.
Generates images from structured JSON prompts via Python script execution. Supports reference images and aspect ratios for characters, scenes, products, visuals.
The right to erasure under GDPR Article 17 allows data subjects to request the deletion of their personal data. This right is not absolute — it is subject to specific grounds for erasure and a set of exceptions. This skill provides the complete operational procedure for receiving, assessing, executing, and confirming erasure requests.
The data subject has the right to obtain erasure where one of the following grounds applies:
Erasure does NOT apply to the extent that processing is necessary for:
The controller shall communicate any erasure of personal data to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. The controller shall inform the data subject about those recipients if the data subject requests it.
For each ground identified, evaluate whether any of the five exceptions under Art. 17(3)(a)-(e) apply:
| Exception | Assessment Question | Common Scenarios at Meridian Analytics Ltd |
|---|---|---|
| Freedom of expression (a) | Is this data published as part of journalism or public discourse? | Published research reports, public-facing analytics |
| Legal obligation (b) | Is there a statutory retention requirement? | Financial records under Companies Act 2006 (6 years), tax records under HMRC requirements (6 years), anti-money laundering records under MLR 2017 (5 years) |
| Public health (c) | Is this data necessary for public health purposes? | Rare — applies to health data processors |
| Archiving/research (d) | Would erasure render research impossible or seriously impaired? | Anonymised datasets used in published research |
| Legal claims (e) | Are there pending or anticipated legal proceedings involving this data? | Active disputes, regulatory investigations, litigation hold data |
[Erasure Ground Established & No Exception Applies]
│
▼
[Can data be permanently deleted from all systems?]
│
├── Yes ──► [PERMANENT DELETION]
│ - Remove from primary databases
│ - Remove from backup systems within next backup cycle
│ - Remove from third-party processors (Art. 19)
│ - Purge from caches, logs, and temporary storage
│ - Verify deletion across all systems
│
└── No ──► [Assess why deletion is not possible]
│
├── Technical constraint (embedded in backup tapes)
│ └── [ANONYMIZE + schedule deletion at next backup rotation]
│ [Maximum retention of backup: 90 days at Meridian Analytics Ltd]
│
├── Partial exception applies (some data needed for legal obligation)
│ └── [PARTIAL DELETION + ANONYMIZATION]
│ [Delete data not subject to exception]
│ [Retain excepted data with restricted access]
│ [Anonymize where possible]
│
└── Data is intermingled with other subjects' data
└── [TARGETED ANONYMIZATION]
[Replace identifiers with irreversible pseudonyms]
[Remove all direct identifiers]
[Verify re-identification risk < 0.05%]