From privacy-impact-assessment-skills
Guides DPIA for marketing analytics including profiling, behavioral targeting, cross-device tracking, and adtech. Covers GDPR Art. 22, ePrivacy cookie consent, PECR, legitimate interest balancing.
npx claudepluginhub mukul975/privacy-data-protection-skills --plugin privacy-impact-assessment-skillsThis skill uses the workspace's default tool permissions.
Marketing analytics processing — including customer profiling, behavioural targeting, cross-device tracking, programmatic advertising, and conversion attribution — triggers multiple DPIA criteria under WP248rev.01: evaluation/scoring (C1), systematic monitoring (C3), matching or combining datasets (C6), and potentially innovative technology (C8). This skill provides a DPIA methodology for marke...
Guides Next.js Cache Components and Partial Prerendering (PPR) with cacheComponents enabled. Implements 'use cache', cacheLife(), cacheTag(), revalidateTag(), static/dynamic optimization, and cache debugging.
Guides building MCP servers enabling LLMs to interact with external services via tools. Covers best practices, TypeScript/Node (MCP SDK), Python (FastMCP).
Generates original PNG/PDF visual art via design philosophy manifestos for posters, graphics, and static designs on user request.
Marketing analytics processing — including customer profiling, behavioural targeting, cross-device tracking, programmatic advertising, and conversion attribution — triggers multiple DPIA criteria under WP248rev.01: evaluation/scoring (C1), systematic monitoring (C3), matching or combining datasets (C6), and potentially innovative technology (C8). This skill provides a DPIA methodology for marketing analytics processing, integrating GDPR obligations with ePrivacy Directive requirements for cookie-based tracking and PECR compliance for UK-based operations.
Storing or accessing information on a user's terminal equipment (cookies, device fingerprinting, local storage) requires:
| Aspect | Assessment |
|---|---|
| Description | Aggregating customer data to create profiles for segmentation and targeting |
| WP248 criteria | C1 (evaluation/scoring), C6 (matching datasets) |
| Lawful basis | Consent (Art. 6(1)(a)) for new prospects; legitimate interest (Art. 6(1)(f)) for existing customers with LIA |
| Key risks | Discriminatory profiling, unexpected inferences, purpose creep |
| Mitigation | Transparency about profiling logic; opt-out mechanism; regular profiling accuracy review |
| Aspect | Assessment |
|---|---|
| Description | Tracking online behaviour to serve targeted advertisements |
| WP248 criteria | C1 (scoring), C3 (systematic monitoring), C6 (matching), C8 (innovative tech) |
| Lawful basis | Consent required (ePrivacy Art. 5(3) for cookies + GDPR Art. 6(1)(a) for processing) |
| Key risks | Pervasive tracking, opaque adtech supply chain, data leakage to multiple parties |
| Mitigation | Consent management platform; vendor due diligence; real-time bidding data minimisation |
| Aspect | Assessment |
|---|---|
| Description | Linking user activity across multiple devices (desktop, mobile, tablet, smart TV) |
| WP248 criteria | C1, C3, C6, C8 |
| Lawful basis | Consent required — cross-device tracking exceeds reasonable expectations |
| Key risks | Comprehensive behavioural profiling; re-identification of pseudonymous profiles; tracking beyond user awareness |
| Mitigation | Explicit consent for cross-device linking; device-level opt-out mechanisms; limited retention |
| Aspect | Assessment |
|---|---|
| Description | Tracking user journey from ad impression to purchase to attribute marketing ROI |
| Lawful basis | Consent for cookie-based attribution; legitimate interest may apply for first-party server-side attribution |
| Key risks | Extended tracking windows; cross-site tracking; data sharing with attribution platforms |
Assess marketing-specific risks:
| Risk | Description | Typical Level |
|---|---|---|
| MK-R1 | Opaque adtech supply chain — personal data shared with multiple parties without transparency | High |
| MK-R2 | Cross-site tracking building comprehensive browsing profiles beyond user expectation | High |
| MK-R3 | Discriminatory targeting — excluding or disadvantaging groups based on inferred characteristics | High |
| MK-R4 | Consent fatigue leading to uninformed consent | Medium |
| MK-R5 | Data leakage through real-time bidding bid requests | High |
| MK-R6 | Dark patterns in consent interfaces undermining genuine choice | High |
| MK-R7 | Children encountering targeted advertising | High |
| MK-R8 | Re-identification of pseudonymous marketing profiles | Medium |