--- name: assess-australian-privacy-issues-l0cka title: Assess Australian Privacy Issues description: Identify and structure Australian privacy, data protection and cybersecurity legal issues from facts, contracts, policies, data maps or proposed activities; map each issue to potentially applicable Commonwealth, State or Territory legislation; perform change-safe Australian Privacy Principles verification; verify Commonwealth and NSW legislation with the corresponding legislation skills; and prepare a source-linked issue matrix for lawyer review. Use for privacy scoping, applicability analysis, privacy-policy or DPA issue spotting, data-flow reviews, cyber regulatory scoping and preliminary legal research. Do not use for case law, foreign law, final legal opinions, autonomous compliance decisions or external notifications. author: l0cka author_url: https://github.com/l0cka/legal-skills/tree/main/plugins/australian-privacy-cybersecurity/skills/assess-australian-privacy-issues license: MIT version: 0.1.0 execution_mode: open jurisdiction: au practice: data-protection language: en sources: - title: Current Commonwealth Privacy Map path: references/current-commonwealth-privacy-map.md - title: Source And Issue Method path: references/source-and-issue-method.md --- # Assess Australian Privacy Issues Produce a preliminary issue-and-law map for an Australian lawyer. Do not state that a duty applies until its threshold facts and current legislative text have been checked. Read [references/source-and-issue-method.md](references/source-and-issue-method.md) before starting. It defines the source hierarchy, legislation routing, issue taxonomy and treatment of Harvey Labs patterns. Read [references/current-commonwealth-privacy-map.md](references/current-commonwealth-privacy-map.md) when Commonwealth privacy law is potentially relevant. Treat its dated entries as prompts requiring current verification. ## Workflow 1. Protect the material and fix scope. - Ask for de-identified facts or the minimum necessary extracts. Do not request credentials, exploit code, unnecessary identifiers or complete client files. - Record the Australian jurisdiction or jurisdictions, relevant dates, entity types, sector, data subjects, data types, conduct and requested deliverable. Use today's `Australia/Sydney` date when no as-at date is given and say so. - State that case law is outside scope. Do not search for, cite, summarise or rely on cases, tribunal decisions or case-derived tests. Mark a request requiring them `OUTSIDE SCOPE` for that component. 2. Build a fact and applicability map. - Separate supplied facts, reasonable inferences, assumptions and missing facts. Never invent an entity, data flow, contract term or jurisdiction. - Identify possible roles and thresholds without deciding them silently: APP entity or exemption; Commonwealth, State or Territory body; health or other sector; controller-like or service-provider role; overseas actor; critical-infrastructure or regulated-entity status. - Identify collection, use, disclosure, security, access/correction, retention/destruction, direct marketing, automated decision-making, cross-border, vendor and incident-response issues raised by the facts. - Invoke `$route-australian-privacy-jurisdiction` whenever a State or Territory nexus is possible. Preserve its public/private, health, government-contractor, breach and surveillance distinctions. 3. Identify candidate law. - Use the trigger table in the reference. Treat it as an issue-spotting aid, not authority or a statement that every listed law applies. - Distinguish legislation, delegated legislation, regulator guidance, contractual requirements and voluntary standards. Do not present guidance or standards as legislation. - Keep foreign-law analysis outside scope. Record a foreign nexus only as a referral or separate-workstream issue. 4. Verify legislation. - For each Commonwealth candidate, invoke `$check-commonwealth-legislation` with the title, relevant provision and as-at date. Preserve its Register IDs, version period, currency flags and qualifications. - If the question spans legislative change, a future deployment date or more than one applicable compilation, invoke `$trace-commonwealth-legislative-change` and keep future or transitional law separate from law in force at the as-at date. - For each NSW candidate, invoke `$check-nsw-legislation` in the same way. - Whenever an APP may apply, invoke `$check-australian-privacy-principles` for the as-at date and decision horizon. Do not use a static APP list as authority. - If the APP result is `APP FRAMEWORK CHANGE DETECTED – LEGAL CONTENT REVIEW REQUIRED`, stop reuse of earlier APP analysis and identify each affected mapping for lawyer refresh. If it is `APP FRAMEWORK NOT VERIFIED – DO NOT RELY`, make no APP conclusion. - Invoke `$assess-statutory-privacy-tort` independently of APP coverage for surveillance, recording, scraping, profiling, inference, deepfakes, disclosure, publication or intimate, location, health or financial data. - Invoke `$assess-automated-decision-transparency` for automated or AI-assisted decisions, including any horizon crossing 10 December 2026. - Invoke `$map-australian-cyber-incident-obligations` for a suspected incident, cyber-extortion payment, outage or material control weakness. - If a legislation skill or official source is unavailable, do not fill the gap from memory, a search snippet or secondary commentary. Label it `NOT VERIFIED` and identify the exact follow-up check. 5. Analyse and report. - Apply verified text to stated facts provisionally. Expose threshold uncertainty and plausible alternatives. - Give each issue a practical consequence, missing fact and concrete next step. Do not assign false numerical risk scores. - Include favourable or compliant features as well as gaps when reviewing a document or program. ## Result contract Lead with `PRELIMINARY LAW AND ISSUE MAP — HUMAN REVIEW REQUIRED`, followed by: ```text Scope: Jurisdiction: As at: Materials reviewed: Facts, assumptions and gaps: Applicability matrix: Entity/conduct | Candidate regime | Threshold facts | Preliminary status | Evidence needed APP framework layers: Jurisdiction route: Statutory privacy tort: Automated decisions: Issue matrix: Priority | Issue | Material fact | Candidate legislation/provision | Legislation-check status | Analysis | Missing fact | Recommended next step | Source Non-legislative material: Case law: Outside scope and not considered Immediate actions: Limitations and lawyer review: ``` Use these legislation-check statuses only: `VERIFIED`, `VERIFIED WITH QUALIFICATIONS`, `NOT VERIFIED`, `PRIMARY TEXT CHECK REQUIRED`, or `OUTSIDE SCOPE`. Link every legal proposition to the official material actually inspected. Do not imply that issue identification replaces professional judgment. ## Other plugins This skill names skills from other Legal Skills plugins. Install a required plugin alongside this one; install a hand-off plugin when the matter needs that depth. - `australian-legal-research` (required): `check-commonwealth-legislation`, `check-nsw-legislation`, `trace-commonwealth-legislative-change`. Verifies the Commonwealth, state and territory legislation the privacy, breach and cyber workflows rely on. If a named skill is not available in this session, say so and name the plugin to install. Treat the step it would have performed as not done: record the affected proposition as not verified, or the hand-off as not made. Never perform that step from memory or substitute a different skill.