Guides three-part Legitimate Interest Assessment (LIA) under GDPR Article 6(1)(f): purpose test, necessity test, and balancing test. Use for evaluating lawful basis, LIA reviews, or proportionality analysis.
npx claudepluginhub mukul975/privacy-data-protection-skills --plugin gdpr-compliance-skillsThis skill uses the workspace's default tool permissions.
When a controller relies on Art. 6(1)(f) as the lawful basis for processing, a Legitimate Interest Assessment (LIA) must be conducted and documented before processing begins. The LIA consists of three sequential tests derived from the wording of Art. 6(1)(f) and elaborated in WP29 Opinion 06/2014. If any test fails, legitimate interest cannot be relied upon, and an alternative lawful basis must...
Acquire memory dumps from live systems/VMs and analyze with Volatility 3 for processes, networks, DLLs, injections in incident response or malware hunts.
Provides x86-64/ARM disassembly patterns, calling conventions, control flow recognition for static analysis of executables and compiled binaries.
Identifies anti-debugging checks like IsDebuggerPresent, NtQueryInformationProcess in Windows binaries; suggests bypasses via patches/hooks/scripts for malware analysis, CTFs, authorized RE.
When a controller relies on Art. 6(1)(f) as the lawful basis for processing, a Legitimate Interest Assessment (LIA) must be conducted and documented before processing begins. The LIA consists of three sequential tests derived from the wording of Art. 6(1)(f) and elaborated in WP29 Opinion 06/2014. If any test fails, legitimate interest cannot be relied upon, and an alternative lawful basis must be found or processing must not proceed.
The purpose test establishes whether the controller (or a third party) has a legitimate interest that is real, lawful, and clearly articulated.
Identify the interest: What specific interest does the controller or third party pursue? The interest must be concrete and articulated, not vague or hypothetical.
Verify legitimacy: The interest must be:
Common legitimate interests recognised by the GDPR:
Document the interest: State the interest in a single clear sentence that could be understood by a non-expert.
The necessity test determines whether the specific processing is necessary to achieve the identified legitimate interest. This is not a test of whether the interest itself is necessary, but whether the processing is necessary for the interest.
Could the interest be achieved without processing personal data? If the same outcome can be reached without personal data, the processing fails the necessity test.
Could the interest be achieved with less personal data? Apply data minimisation — only the minimum data necessary should be processed.
Could the interest be achieved with a less intrusive method? Consider alternatives:
Is the processing proportionate to the interest? The scope and intensity of processing should be proportionate to the significance of the interest.
The balancing test weighs the controller's legitimate interest against the interests, fundamental rights, and freedoms of data subjects. This is the most complex and contextual part of the LIA.
Assess the nature of the interest: How important is the controller's interest? Rate from routine (low) to essential (high).
Assess the impact on data subjects: What is the likely effect? Consider:
Consider reasonable expectations: Would data subjects expect their data to be used this way? The closer the processing is to the original context and the existing relationship, the more likely it meets expectations.
Evaluate additional safeguards: Do safeguards sufficiently mitigate the impact? Effective safeguards can tip the balance in the controller's favour.
Consider the possibility of objection: Is there a mechanism for data subjects to object under Art. 21? The right to object is a mandatory counterbalance when relying on Art. 6(1)(f).
The completed LIA must document: