privacy-check

Privacy Check Skill

Privacy by Design assessment.

Workflow

7 Foundational Principles (Cavoukian)

1. Proactive not Reactive: Are privacy measures built in from the start?
2. [ ] Privacy considered in design phase, not bolted on
3. [ ] Risks identified before implementation

1. Privacy as Default: Is the most private option the default?
2. [ ] Data collection opt-in, not opt-out
3. [ ] Minimum data collected by default
4. [ ] Sharing disabled by default

1. Privacy Embedded in Design: Is privacy integral to the system?
2. [ ] Privacy controls are core features, not add-ons
3. [ ] Architecture supports data minimization

1. Positive-Sum, not Zero-Sum (originally "Full Functionality"): Privacy without trade-offs?
2. [ ] Privacy features don't degrade user experience
3. [ ] Not a false choice between privacy and functionality
4. [ ] Avoid false dichotomies: privacy vs. security, privacy vs. business value

1. End-to-End Security: Data protected throughout its lifecycle?
2. [ ] Encryption at rest and in transit
3. [ ] Secure deletion when no longer needed
4. [ ] Access controls throughout the data lifecycle

1. Visibility and Transparency: Is data processing transparent?
2. [ ] Users know what data is collected and why
3. [ ] Processing purposes documented and communicated
4. [ ] Third-party sharing disclosed

1. Respect for User Privacy: Are user interests centered?
2. [ ] Users can access their data
3. [ ] Users can correct their data
4. [ ] Users can delete their data
5. [ ] Consent is informed, specific, and revocable

Data Protection Assessment

• What data is collected? List all personal data fields.
• Why? Lawful basis for each data element.
• How long? Retention period for each data type.
• Who accesses it? List all parties with access.
• Where is it stored? Data residency and cross-border transfers.
• How is it protected? Encryption, access control, monitoring.
• What if breached? Incident response plan exists?

Output

## Privacy Assessment: [Feature/System]

### PbD Principles
| Principle | Status | Notes |
|-----------|--------|-------|
| Proactive | Pass/Fail | ... |
| Default privacy | Pass/Fail | ... |
| Embedded | Pass/Fail | ... |
| Full functionality | Pass/Fail | ... |
| End-to-end security | Pass/Fail | ... |
| Transparency | Pass/Fail | ... |
| User respect | Pass/Fail | ... |

### Data Inventory
| Data | Purpose | Basis | Retention | Protection |
|------|---------|-------|-----------|-----------|
| ... | ... | ... | ... | ... |

### Risks and Recommendations
1. [risk and recommended action]

Decision Log (MANDATORY per G-P4)

APPEND a ### Privacy Assessment entry to .claude/harness/decision-log.md with: principles assessed, data flows identified, risks found, GDPR compliance status.

Theory Citations

• Cavoukian: Privacy by Design (7 principles)
• GDPR: Data protection regulation