Help us improve
Share bugs, ideas, or general feedback.
Conducts GDPR DPIA for large-scale systematic monitoring under Article 35(3)(c), covering CCTV, video surveillance, employee monitoring, location tracking, internet monitoring, and behavioural analytics.
npx claudepluginhub mukul975/privacy-data-protection-skills --plugin privacy-skills-completeHow this skill is triggered — by the user, by Claude, or both
Slash command
/privacy-skills-complete:pia-large-scale-monitorThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
GDPR Article 35(3)(c) mandates a DPIA for systematic monitoring of a publicly accessible area on a large scale. The EDPB in WP248rev.01 identifies systematic monitoring as criterion C3, which often combines with other criteria (large scale C4, vulnerable data subjects C7, innovative technology C8) to trigger mandatory DPIA. This skill covers PIA methodology for CCTV/video surveillance, employee...
Guides DPIA for workplace monitoring including email surveillance, internet usage, CCTV, GPS tracking, and keystroke logging. Covers GDPR Art. 88 and WP29 Opinion 2/2017.
Conducts Data Protection Impact Assessments for employee monitoring systems per EDPB Guidelines 3/2019. Covers video surveillance, email monitoring, GPS tracking, keystroke logging, productivity tools under GDPR Art. 35.
Triages data processing activities to determine if a PIA or mandatory GDPR DPIA is needed, surfaces privacy policy conflicts, and routes to next steps.
Share bugs, ideas, or general feedback.
GDPR Article 35(3)(c) mandates a DPIA for systematic monitoring of a publicly accessible area on a large scale. The EDPB in WP248rev.01 identifies systematic monitoring as criterion C3, which often combines with other criteria (large scale C4, vulnerable data subjects C7, innovative technology C8) to trigger mandatory DPIA. This skill covers PIA methodology for CCTV/video surveillance, employee monitoring, location tracking, internet/communications monitoring, and behavioural analytics systems.
| Provision | Relevance to Large-Scale Monitoring |
|---|---|
| Art. 35(3)(c) | Mandatory DPIA for systematic monitoring of publicly accessible area on a large scale |
| Art. 35(1) | DPIA required when processing is likely to result in a high risk to rights and freedoms |
| Art. 6(1)(f) | Legitimate interests as typical lawful basis for monitoring; requires balancing test |
| Art. 5(1)(c) | Data minimisation: collect only what is necessary for the monitoring purpose |
| Art. 5(1)(e) | Storage limitation: retain monitoring data only as long as necessary |
| Art. 12-14 | Transparency obligations: informing data subjects about monitoring |
| Art. 21 | Right to object to processing based on legitimate interests |
| Art. 22 | Automated decision-making restrictions applicable to behavioural analytics |
Scope: Fixed and mobile cameras in public spaces, retail premises, transport hubs, workplaces. Key risks: Mass surveillance of individuals in publicly accessible areas; facial recognition enabling biometric identification; disproportionate retention creating behavioural profiles; function creep from security to performance monitoring. EDPB Guidelines 3/2019 requirements:
Scope: Email monitoring, internet usage logging, keystroke logging, screen recording, GPS tracking of company vehicles, badge access tracking. Key risks: Chilling effect on employee behaviour and communications; disproportionate intrusion into private life at work; monitoring of protected activities (trade union, whistleblowing); covert monitoring without transparency. Legal constraints:
Scope: GPS vehicle tracking, mobile device tracking, Wi-Fi positioning, Bluetooth beacons. Key risks: Continuous tracking creating comprehensive movement profiles; tracking extending beyond working hours; combination with other data revealing private activities; disproportionate monitoring intensity. Mitigation: Disable tracking outside working hours; use geofencing rather than continuous tracking; inform employees and obtain consent where required; provide option for personal use of vehicles with tracking disabled.
Scope: Web browsing logs, email content scanning, instant messaging monitoring, social media monitoring. Key risks: Interception of private communications; monitoring of legally privileged communications; chilling effect on freedom of expression; access to special category data through content analysis. Legal constraints: ePrivacy Directive Article 5 (confidentiality of communications); national interception laws (e.g., UK Regulation of Investigatory Powers Act 2000, Investigatory Powers Act 2016).
Scope: Customer behaviour tracking in retail (heat mapping, dwell time), website analytics, social media sentiment analysis, predictive analytics for security. Key risks: Profiling without awareness; automated decision-making affecting individuals; combining data from multiple sources to create comprehensive profiles; targeting vulnerable individuals.