assess-australian-privacy-issues-l0cka · v0.1.0 · 2026-10-08 · sha256 3b4c6700909169f6

assess-australian-privacy-issues-l0cka v0.1.0A

Immutable. This exact content never changes and is served at /api/v1/blob/3b4c6700909169f6.

---
name: assess-australian-privacy-issues-l0cka
title: Assess Australian Privacy Issues
description: Identify and structure Australian privacy, data protection and cybersecurity legal issues from facts, contracts, policies, data maps or proposed activities; map each issue to potentially applicable Commonwealth, State or Territory legislation; perform change-safe Australian Privacy Principles verification; verify Commonwealth and NSW legislation with the corresponding legislation skills; and prepare a source-linked issue matrix for lawyer review. Use for privacy scoping, applicability analysis, privacy-policy or DPA issue spotting, data-flow reviews, cyber regulatory scoping and preliminary legal research. Do not use for case law, foreign law, final legal opinions, autonomous compliance decisions or external notifications.
author: l0cka
author_url: https://github.com/l0cka/legal-skills/tree/main/plugins/australian-privacy-cybersecurity/skills/assess-australian-privacy-issues
license: MIT
version: 0.1.0
execution_mode: open
jurisdiction: au
practice: data-protection
language: en
sources:
- title: Current Commonwealth Privacy Map
path: references/current-commonwealth-privacy-map.md
- title: Source And Issue Method
path: references/source-and-issue-method.md
---

# Assess Australian Privacy Issues

Produce a preliminary issue-and-law map for an Australian lawyer. Do not state
that a duty applies until its threshold facts and current legislative text have
been checked.

Read [references/source-and-issue-method.md](references/source-and-issue-method.md)
before starting. It defines the source hierarchy, legislation routing, issue
taxonomy and treatment of Harvey Labs patterns.

Read [references/current-commonwealth-privacy-map.md](references/current-commonwealth-privacy-map.md)
when Commonwealth privacy law is potentially relevant. Treat its dated entries
as prompts requiring current verification.

## Workflow

1. Protect the material and fix scope.
- Ask for de-identified facts or the minimum necessary extracts. Do not
request credentials, exploit code, unnecessary identifiers or complete
client files.
- Record the Australian jurisdiction or jurisdictions, relevant dates,
entity types, sector, data subjects, data types, conduct and requested
deliverable. Use today's `Australia/Sydney` date when no as-at date is
given and say so.
- State that case law is outside scope. Do not search for, cite, summarise or
rely on cases, tribunal decisions or case-derived tests. Mark a request
requiring them `OUTSIDE SCOPE` for that component.
2. Build a fact and applicability map.
- Separate supplied facts, reasonable inferences, assumptions and missing
facts. Never invent an entity, data flow, contract term or jurisdiction.
- Identify possible roles and thresholds without deciding them silently:
APP entity or exemption; Commonwealth, State or Territory body; health or
other sector; controller-like or service-provider role; overseas actor;
critical-infrastructure or regulated-entity status.
- Identify collection, use, disclosure, security, access/correction,
retention/destruction, direct marketing, automated decision-making,
cross-border, vendor and incident-response issues raised by the facts.
- Invoke `$route-australian-privacy-jurisdiction` whenever a State or
Territory nexus is possible. Preserve its public/private, health,
government-contractor, breach and surveillance distinctions.
3. Identify candidate law.
- Use the trigger table in the reference. Treat it as an issue-spotting aid,
not authority or a statement that every listed law applies.
- Distinguish legislation, delegated legislation, regulator guidance,
contractual requirements and voluntary standards. Do not present guidance
or standards as legislation.
- Keep foreign-law analysis outside scope. Record a foreign nexus only as a
referral or separate-workstream issue.
4. Verify legislation.
- For each Commonwealth candidate, invoke
`$check-commonwealth-legislation` with the title, relevant provision and
as-at date. Preserve its Register IDs, version period, currency flags and
qualifications.
- If the question spans legislative change, a future deployment date or
more than one applicable compilation, invoke
`$trace-commonwealth-legislative-change` and keep future or transitional
law separate from law in force at the as-at date.
- For each NSW candidate, invoke `$check-nsw-legislation` in the same way.
- Whenever an APP may apply, invoke
`$check-australian-privacy-principles` for the as-at date and decision
horizon. Do not use a static APP list as authority.
- If the APP result is `APP FRAMEWORK CHANGE DETECTED – LEGAL CONTENT REVIEW
REQUIRED`, stop reuse of earlier APP analysis and identify each affected
mapping for lawyer refresh. If it is `APP FRAMEWORK NOT VERIFIED – DO NOT
RELY`, make no APP conclusion.
- Invoke `$assess-statutory-privacy-tort` independently of APP coverage for
surveillance, recording, scraping, profiling, inference, deepfakes,
disclosure, publication or intimate, location, health or financial data.
- Invoke `$assess-automated-decision-transparency` for automated or
AI-assisted decisions, including any horizon crossing 10 December 2026.
- Invoke `$map-australian-cyber-incident-obligations` for a suspected
incident, cyber-extortion payment, outage or material control weakness.
- If a legislation skill or official source is unavailable, do not fill the
gap from memory, a search snippet or secondary commentary. Label it `NOT
VERIFIED` and identify the exact follow-up check.
5. Analyse and report.
- Apply verified text to stated facts provisionally. Expose threshold
uncertainty and plausible alternatives.
- Give each issue a practical consequence, missing fact and concrete next
step. Do not assign false numerical risk scores.
- Include favourable or compliant features as well as gaps when reviewing a
document or program.

## Result contract

Lead with `PRELIMINARY LAW AND ISSUE MAP — HUMAN REVIEW REQUIRED`, followed by:

```text
Scope: <task and expressly excluded components>
Jurisdiction: <Commonwealth and each State or Territory considered>
As at: <YYYY-MM-DD, Australia/Sydney>
Materials reviewed: <de-identified list>
Facts, assumptions and gaps: <separate lists>

Applicability matrix:
Entity/conduct | Candidate regime | Threshold facts | Preliminary status | Evidence needed

APP framework layers: <text, application perimeter, instruments, future changes and guidance>
Jurisdiction route: <Commonwealth, State and Territory candidates and boundaries>
Statutory privacy tort: <separate Schedule 2 screen or reason not triggered>
Automated decisions: <current/future status or reason not triggered>

Non-legislative material: <guidance, standards and contracts, clearly labelled>
Case law: Outside scope and not considered
Immediate actions: <bounded, reviewable actions>
Limitations and lawyer review: <unresolved currency, scope and interpretation points>
```

Use these legislation-check statuses only: `VERIFIED`, `VERIFIED WITH
QUALIFICATIONS`, `NOT VERIFIED`, `PRIMARY TEXT CHECK REQUIRED`, or `OUTSIDE
SCOPE`. Link every legal proposition to the official material actually
inspected. Do not imply that issue identification replaces professional
judgment.

## Other plugins

This skill names skills from other Legal Skills plugins. Install a required
plugin alongside this one; install a hand-off plugin when the matter needs
that depth.

- `australian-legal-research` (required): `check-commonwealth-legislation`,
`check-nsw-legislation`, `trace-commonwealth-legislative-change`. Verifies
the Commonwealth, state and territory legislation the privacy, breach and
cyber workflows rely on.

If a named skill is not available in this session, say so and name the plugin
to install. Treat the step it would have performed as not done: record the
affected proposition as not verified, or the hand-off as not made. Never
perform that step from memory or substitute a different skill.