GDPR Compliance Skill

🔴 AI FIRST Quality Principle

Apply the AI FIRST principle: never accept first-pass quality. Minimum 2 iterations. Read all output, improve every section. No shortcuts.

Purpose

Ensure GDPR compliance for political data processing in Riksdagsmonitor while maintaining democratic transparency.

Legal Basis for Political Data

GDPR Article 6(1) - Lawful Processing

• Article 6(1)(e): Processing for public interest task
• Application: Democratic transparency and accountability monitoring
• Justification: Offentlighetsprincipen (Swedish Public Access Principle)

GDPR Article 9 - Special Category Data

• Political Opinions: Special category requiring explicit legal basis
• Exemption 9(2)(e): Data manifestly made public by data subject
• Exemption 9(2)(g): Processing for substantial public interest

Data Subject Rights

1. Right to Access (Article 15)

• Individuals can request their data
• Provide copy in machine-readable format
• Limited for public figures in official capacity

2. Right to Rectification (Article 16)

• Correct inaccurate data promptly
• Update records from official sources

3. Right to Erasure (Article 17)

• Limited for public officials
• Historical records retained for research

4. Right to Object (Article 21)

• Clear objection mechanisms
• Case-by-case assessment

Privacy-by-Design

• Data Minimization: Only necessary political data
• Purpose Limitation: Transparency purposes only
• Storage Limitation: Documented retention policy
• Integrity: HTTPS-only, secure headers
• No Tracking: No cookies, analytics, or user tracking

ISMS Compliance

ISO 27001:2022

• A.5.34: Privacy and protection of PII

NIST CSF 2.0

• ID.GV-3: Legal requirements understood

References

• GDPR: https://gdpr-info.eu/
• Swedish DPA: https://www.imy.se/
• ISMS: https://github.com/Hack23/ISMS-PUBLIC