Add EU GDPR Pack (7 assistant workflows) - #16
Conversation
New assistant workflow pack for EU practice, in English: - gdpr-breach-notification - Articles 33-34 decision tree, 72-hour clock - gdpr-dpia - Article 35 threshold test and Article 35(7) draft - gdpr-data-subject-requests - Articles 12 and 15-22 handling - gdpr-records-of-processing - Article 30 RoPA, controller and processor - contract-clause-checklist - 41 CUAD categories, present/absent/risky - legal-syllogism - rule-facts-application-conclusion scaffold - legal-citation-extraction - ECLI, CELEX, OJ and provision citations Each workflow drafts and stops there. Notification, filing, signing, erasure and sending remain human acts. Overlap checked against existing workflows: the Article 28 processor contract is already covered by dpa-draft and dpa-review, so this pack ships only the Article 30 records side and points to those for the contract itself. The Finnish Law Pack covers data subject requests and DPIA screening in Finnish under Finnish law; this pack covers the same regulation in English with EU-level framing. Attribution kept inside the workflows: the clause taxonomy comes from CUAD (The Atticus Project, CC BY 4.0); legal-citation-extraction follows the architecture of eyecite (Free Law Project, BSD-2-Clause) as a design pattern only, with no code reused. validate-workflows.py passes. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
willchen96
left a comment
willchen96
left a comment
There was a problem hiding this comment.
Inline review comments from the workflow and legal-accuracy review.
|
|
||
| Start with the red flags, then the full table: | ||
|
|
||
| - RED FLAGS: each absent category with why it is a risk in this deal, and each risky category with how it is one-sided. |
There was a problem hiding this comment.
[P1] CUAD defines extraction categories, not safeguards that every agreement should contain. Several categories are mutually exclusive or deal-specific—for example, capped versus uncapped liability and limited versus unlimited licences. Requiring every absent category to become a red flag will produce many false positives. Please add an applicable/not applicable assessment and flag absence only when the deal context establishes that the clause is needed.
|
|
||
| ## Processor register (Article 30(2)) | ||
|
|
||
| The processor's register is narrower: the categories of processing carried out on behalf of each controller, transfers with safeguards, and a general description of security measures. Record the controllers and any sub-processors by name. |
There was a problem hiding this comment.
[P1] The processor RoPA omits mandatory Article 30(2)(a) fields: the names and contact details of the processor or processors, every controller, applicable representatives, and the DPO. Mentioning controller and subprocessor names alone allows the workflow to mark a legally incomplete register as complete. Please include the complete statutory field list.
|
|
||
| ## Step 3 - Draft the response and the register entry | ||
|
|
||
| Draft the response in clear and plain language (Article 12(1)), a list of the data and its sources drawn from the records of processing, and a register entry recording receipt date, request type, deadline, and outcome. |
There was a problem hiding this comment.
[P1] A RoPA contains processing categories and metadata, not the requesting person’s actual data or necessarily its sources. An Article 15 response must include a copy of the personal data undergoing processing and, where applicable, available source information. Please require retrieval from operational systems and tailor the response to the right invoked; the RoPA should support only the general processing information.
|
|
||
| ## Step 0 - Identity and deadline | ||
|
|
||
| - Identity verification (Article 12(6)): where reasonable doubt exists, request further information. This pauses the clock until identity is confirmed, but must not be used to obstruct the request. |
There was a problem hiding this comment.
[P2] Requesting identity information does not unconditionally pause the deadline. EDPB Guidelines 01/2022 state that there may be a suspension when the information is necessary and the controller asks for it without undue delay. Please preserve the original receipt date and state these conditions explicitly so a late or disproportionate identity request cannot incorrectly extend the deadline.
| ## Cross-checks | ||
|
|
||
| - Flag every activity whose description meets a DPIA trigger (profiling, large-scale special-category data, systematic monitoring) so it can be taken through a DPIA. | ||
| - Test the Article 30(5) exemption honestly: it applies only to organisations under 250 employees whose processing is occasional, low-risk, and involves no special categories. In practice it rarely applies - most organisations process employee or customer data regularly. |
There was a problem hiding this comment.
[P2] The Article 30(5) exemption is also unavailable when processing includes personal data relating to criminal convictions and offences under Article 10. The current test mentions only special-category data, so it could incorrectly exempt an organisation that processes Article 10 data. Please add this as a separate disqualifier.
| | 18 | Restriction | a freeze instead of erasure | | ||
| | 20 | Portability | consent or contract basis plus automated processing only; structured, machine-readable format | | ||
| | 21 | Objection | legitimate interest or direct marketing - the marketing objection is absolute | | ||
| | 22 | Automated decisions | right to human intervention | |
There was a problem hiding this comment.
[P2] Article 22’s primary right is not to be subject to a solely automated decision that produces legal or similarly significant effects. Human intervention is a safeguard for certain exceptions, rather than the complete or universally applicable right. Please state the threshold, exceptions, and corresponding safeguards so Article 22 requests are classified correctly.
|
|
||
| ## Aggregation - short references | ||
|
|
||
| Resolve each short reference to the full citation given earlier: `ibid.`, `id.`, `supra`, `op. cit.`, `the cited judgment`, `the above-cited`, `loc. cit.`. Each points to the nearest matching antecedent in the text - count it as the same citation, but record where it occurs. |
There was a problem hiding this comment.
[P2] These short citation forms have different resolution rules. Ibid. generally refers to the immediately preceding authority, while supra and op. cit. may contain an author, title, or note pointer that overrides proximity. Resolving all of them to the nearest antecedent can silently merge distinct authorities. Please use pointer-aware rules and mark ambiguous references unresolved for manual review.
2 participants
Add EU GDPR Pack (7 assistant workflows)
What
A new assistant workflow pack,
eu-gdpr-pack, with seven English-languageworkflows for EU data protection practice:
gdpr-breach-notification- Articles 33-34 breach decision tree with the72-hour clock; drafts the supervisory authority notification, the data
subject communication, and the internal register entry.
gdpr-dpia- Article 35 threshold test (EDPB WP248 criteria, Article 35(3)cases, national blacklists) plus a draft to the Article 35(7) structure and
the Article 36 prior-consultation decision.
gdpr-data-subject-requests- Articles 12 and 15-22 request handling:classification, deadlines with the extension rules, exemption gates,
response draft, register entry.
gdpr-records-of-processing- Article 30 RoPA, controller and processorside, validated field by field, with DPIA and contract flags.
contract-clause-checklist- a 41-category presence/absence/risk sweep ofa single contract, extractive by design.
legal-syllogism- an explicit rule-facts-application-conclusion scaffoldwith a weak-link test, mapping to subsumption and IRAC/CREAC.
legal-citation-extraction- mechanical extraction of ECLI, CELEX, OJ,case, and provision citations with short-reference resolution, as the
front-end to verification.
Every workflow drafts and stops there: notification, filing, signing,
erasure, and sending remain human acts.
Where it comes from
The workflows are adapted from the open-source collection at
awesome-matematic-skills-en
and rewritten for this repository: harness-neutral wording, no CLI commands,
Mike frontmatter,
add-onavailability. All text is original work byWieslaw Mazur / MateMatic Solutions, contributed under MIT.
Two workflows build on third-party material, with attribution kept inside
the workflow: the clause taxonomy in
contract-clause-checklistcomes fromCUAD (The Atticus Project, CC BY 4.0), and
legal-citation-extractionfollows the extraction-aggregation-annotation architecture of eyecite
(Free Law Project, BSD-2-Clause) as a design pattern only, with no code
reused and the US reporter patterns dropped.
Overlap with existing workflows
ground is already covered by
dpa-review, so the pack ships only theArticle 30 records side (
gdpr-records-of-processing), which points usersto the existing DPA workflows for the contract itself.
Finnish under Finnish law; this pack covers the same regulation in English
with EU-level framing, so the two do not compete.
How it was validated
workflow-schema/validate-workflows.pypasses with the pack in place: 141workflows, 16 column files, 5 packs. That covers the frontmatter and metadata
schema,
nameagainst the folder, the folder againstmike-display-name,semantic versioning,
mike-type, and the rule that workflows inside a pack useadd-onavailability.The validator does not check for harness-specific commands, so I checked that
by hand: no CLI blocks, no
claudeinvocations, no tool names from our ownstack in any of the seven files.