legitimate-interest

What it does

Guides users through a comprehensive Art. 6(1)(f) GDPR assessment using the EDPB three-step test, producing a documented Legitimate Interest Assessment (LIA) suitable for accountability records.

How it works

• Provides a session initialization disclaimer and prompts to proceed.
• Informs when to search for recent developments and how to choose an assessment mode (Full LIA, Quick Check, Legal Basis Comparison, Right to Object Response).
• Performs Pre-Assessment Gate checks (G1–G4) to determine availability of Art. 6(1)(f).
• Guides through Three-Step Test:
  • Step 1: Pursuit of a Legitimate Interest — outputs a clearly articulated interest, classifies as Controller/Third-party/Both, confirms lawfulness and presence, and yields a PASS/FAIL/REQUIRES REFINEMENT verdict.
  • Step 2: Necessity of Processing — lists data categories, assesses less intrusive alternatives, data minimisation, proportionality, and whether third-party interests affect necessity; outputs a verdict (PASS/FAIL/REQUIRES SCOPE REDUCTION).
  • Step 3: Balancing Test — core assessment to weigh controller interests against data subject interests, rights, and freedoms (full methodology and examples are referenced in the prompts).

When to use it

• Use when the user needs to assess whether legitimate interest is appropriate (Art. 6(1)(f)).
• Use to document a legitimate interest assessment for accountability records and regulatory alignment.
• Applicable when evaluating necessity, proportionality, or balancing in contexts such as direct marketing, IT security, AI training, web scraping, or cross-border data sharing.

What it can touch

• References to data categories, processing activities, controller/third-party interests, and data subject rights as part of the three-step process. The skill directs the agent to collect context and justify each step using the cited legal framework.

Caveats

• Emphasizes that the tool provides guidance based on regulatory sources and does not constitute legal advice.
• Requires up-to-date web search during activation for recent developments (EDPB, CNIL, ICO, etc.).
• Excludes use for consent assessments, contract performance, DPIA workflows, or pure ePrivacy/cookie questions (with some overlap notes).