メニュー
Angerona's toolkit — regime matrix (GDPR, CCPA/CPRA, APPI, PIPEDA, UK GDPR), DPIA and TIA templates, SCC selection tree, APPI Article 16 analysis, breach-response clocks, and the anonymization honesty test.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
Cato's instruments — board memo and resolution formats, minutes discipline, fiduciary-duty analysis frames (care/loyalty/BJR), committee charter skeleton, delegation-of-authority matrix, conflict screens, and board-grade AI-oversight reporting.
Tribonian's pipeline — verification tiers, authority ranking, jurisdiction and temporal tagging, the fabrication-breach protocol, and the honest statement of Phase-1 limits (no live legal databases). Enforces Table III: no fabricated citations, ever.
Gaius's method — CUAD-style clause taxonomy, four-tier risk classification, playbook positions (primary/fallback/walk-away), alternative-language drafting rules, and the missing-clause checklist. Drives /contract-review and all commercial paper.
The Senate's shared operating protocol — output templates (Legal Opinion, Redline Report, DPIA/TIA, Diligence Report, Case Assessment, Risk Memo, Research Memo, Board Memo, Decision Record), the privilege banner, the Law-of-Citations deliberation procedure, dissent format, and the Tribune's-Veto render format. Every Senate output conforms to a template here.
Minerva's protocols — FTO analysis structure, trademark clearance search ladder, the OSS license compatibility matrix with copyleft-boundary analysis, copyright/work-for-hire chains, and creative-asset clearance for the Garland. Search before clearing; epistemic status always stated.
The Twelve Tables in practice — ABA Formal Opinion 512 duties operationalized, UPL boundaries, privilege discipline, the HITL trigger table (the Tribune's Veto thresholds), disclaimer discipline, and the refusal taxonomy for Table XI. Every jurist carries this skill's constraints.
| name | privacy-frameworks |
| description | Angerona's toolkit — regime matrix (GDPR, CCPA/CPRA, APPI, PIPEDA, UK GDPR), DPIA and TIA templates, SCC selection tree, APPI Article 16 analysis, breach-response clocks, and the anonymization honesty test. |
| allowed-tools | ["Read","Write","Glob","Grep"] |
| Question | GDPR/UK GDPR | CCPA/CPRA | APPI (Japan) | PIPEDA (Canada) |
|---|---|---|---|---|
| Lawful basis required | Yes (Art. 6; Art. 9 special) | No (opt-out model) | Purpose specification + consent for sensitive | Consent-centric |
| Transfer mechanism | Ch. V: adequacy / SCCs / BCRs + TIA | n/a (service-provider terms) | Art. 24/28: consent, equivalency, or safeguards (Art. 16 framework) | Comparable-protection accountability |
| DPIA trigger | Art. 35: high-risk processing | Risk assessments (CPRA regs) | PIA recommended | PIA expected (public sector mandatory) |
| Breach clock | 72h to authority (Art. 33) | "Expedient" + AG thresholds | PPC report + subject notice for defined breaches | RROSH test → report |
| Sanctions scale | 4% global turnover | Per-violation civil penalties | Administrative orders, criminal in egregious cases | CAD$100k/violation (reform pending) |
Rule: the strictest applicable regime sets the floor. State which regime drives each requirement.
[ASSESSMENT REQUIRED] where current country analysis is
needed (Phase-1 limits).Exporter is controller?
├── Importer controller → Module 1 (C2C)
└── Importer processor → Module 2 (C2P)
Exporter is processor?
├── Importer (sub)processor → Module 3 (P2P)
└── Importer controller → Module 4 (P2C)
+ Docking clause for multi-party; UK: IDTA or UK Addendum; CH: FDPIC adaptations.
| Hour | Action |
|---|---|
| 0 | Contain; preserve evidence; open privileged channel (route litigation-hold to Cicero) |
| 0–24 | Scope: data categories, subjects, jurisdictions affected → regime matrix |
| 24–48 | Notification analysis per regime (GDPR 72h clock is running); draft authority notice |
| 48–72 | Authority notifications as triggered; subject-notice severity analysis; insurer notice |
"Anonymized" is claimed constantly and true rarely. Before accepting the label: singling-out possible? linkability to other datasets? inference of attributes? If any yes ⇒ it is pseudonymized (still personal data). Aggregation with small cells (< ~10) ⇒ still re-identifiable. Write the test result, not the label.
Every assessment records: regimes applied and which drove each requirement,
data-map gaps ([UNMAPPED]), the verdict with residual scores, and re-
assessment triggers. Feeds gdpr-art-25-privacy-by-design@1.