use-case-triage

/use-case-triage

Read ~/.claude/plugins/config/claude-for-legal-zh/privacy-legal/CLAUDE.md. Confirm that privacy practices have been configured — if not configured, stop and direct to setup.
Execute the following workflow. If the activity description is vague, clarify first.
Internal trigger check → statutory assessment check (the four categories of circumstances under Article 55 of the Personal Information Protection Law) → personal information processing rule conflict check.
Output: classification (can proceed directly / impact assessment required / statutory assessment mandatory trigger / stop), rationale, conditions table (if needed), cross-plugin handoff.
If an assessment is needed, propose proceeding to personal information protection impact assessment generation.

/privacy-legal:use-case-triage "新功能：使用行为数据为用户个性化推荐内容"

Personal Information Processing Activity Triage

Matter Context

Matter context. Check the practice-level CLAUDE.md for ## 事项工作区. If 已启用 is ✗(the default for legal users), skip this paragraph — the skill uses practice-level context and the matter mechanism is not visible. If enabled and there is no active matter, ask: "Which matter is this? Run /privacy-legal:matter-workspace switch <slug> or say 实践级." Load the active matter's matter.md to obtain matter-specific context and overrides. Write output to the matter folder ~/.claude/plugins/config/claude-for-legal-zh/privacy-legal/matters/<matter-slug>/. Never read files from other matters unless 跨事项上下文 is 开启.

Destination Check

Before generating output, check the output destination. If the user specifies a destination (channel, distribution list, opposing party, "everyone"), ask whether it is within the confidentiality circle. Public channels, company-wide lists, opposing parties/opposing counsel, vendors, and customers (with respect to work product) waive protection. When the destination is suspected to be outside the circle, flag it and offer (a) a legal-only confidential version, (b) a sanitized version for broader channels, or (c) both — do not silently add a confidentiality header and then help paste it somewhere that header cannot protect. See ## 共享护栏 → 目的地检查。

Purpose

Answer the question that comes before any PIA: "Does this actually need an assessment?" If so, what type, and where is the blocker?

Privacy triage is faster than PIA generation, but upstream of it. It does not write the assessment report — it determines whether an assessment is needed and what conditions are required. The PIA generation skill does the deep work.

The output is one of four classifications:

Can proceed directly — no impact assessment needed. Apply standard safeguards.
Impact assessment required — an assessment is needed before deployment or in parallel.
Statutory assessment mandatory trigger — statutory assessment obligations such as Article 55 of the Personal Information Protection Law are triggered (cite the primary source provision). The threshold is higher, and the personal information protection officer/legal lead may need to be involved.
Stop — the processing activity conflicts with personal information processing rules or lacks a legal basis. It must be redesigned before it can proceed.

Jurisdiction Assumptions

This triage assumes the jurisdictional scope specified in your configuration. Privacy rules, assessment triggers, and legal bases vary by jurisdiction (PIPL vs. GDPR vs. other jurisdictions). If the processing activity, the processor, or the affected personal information subjects fall under a different jurisdiction, this classification may not directly apply.

Read the configuration first

Before triage, always read ~/.claude/plugins/config/claude-for-legal-zh/privacy-legal/CLAUDE.md. The PIA trigger criteria, regulatory coverage scope, and personal information processing rules commitments in it are the authoritative source. Generic privacy law reasoning cannot replace the commitments the company has actually made.

If the file is missing or contains [占位符], surface this prompt:

I notice you have not yet configured a practice profile—I use it to tailor PIA trigger criteria, regulatory coverage scope, and personal information processing rules commitments.

Two options:

Run /privacy-legal:cold-start-interview(2 minutes) to configure your profile, and then I will tailor the triage to your practice.

Say "provisional mode" and I will triage using generic defaults—China jurisdiction, medium risk appetite, lawyer role, no playbook—and mark every output with [临时模式 — 请配置实践档案以获取定制输出], so you can see my capabilities before formal use.

Provisional mode

If the user says "provisional mode", perform normal triage using the following generic defaults: medium risk appetite, lawyer role, China jurisdiction (PIPL + Data Security Law + Cybersecurity Law), no playbook (classify according to generic privacy law principles rather than matching configured commitments). Mark the review notes and every finding block with [临时模式]. Append at the end of the output:

"The above is a generic run result based on default assumptions. Run /privacy-legal:cold-start-interview to get output tailored to your practice—your regulatory coverage scope, your personal information processing rules commitments, your risk appetite. It only takes 2 minutes."

Triage process

Step 1: Understand the activity

If the description is vague, clarify before classifying. Find out specifically:

What data is collected or processed? Which categories?
Who are the personal information subjects—customers, employees, third parties?
What is the purpose? What problem does it solve?
Is it new data collection, or reuse of existing data?
Are any third-party vendors involved? New vendors or existing vendors?
Does it involve automated decision-making—will the output affect anyone?
What is the deployment scenario—internal only, customer-facing, public?

"New feature" and "data processing activity" are not sufficient for accurate triage.

Step 2: Check internal trigger criteria

Read ~/.claude/plugins/config/claude-for-legal-zh/privacy-legal/CLAUDE.md → ## PIA 内部规范 → trigger criteria. Apply these criteria.

If internal trigger conditions are met → at minimum requires impact assessment。

If internal trigger conditions are not met, continue to Step 3 before concluding "can proceed directly." Some activities require assessment regardless of internal policy.

Step 3: Statutory assessment check

Before checking statutory trigger conditions one by one, first ask the industry regulatory overlay question. If the processing activity touches data categories subject to special regulation, industry regulation is often the governing framework rather than general data protection law, and triage needs to surface this early rather than as an afterthought.

Industry regulatory overlay—ask first:

Does this processing activity involve:

Financial account data or a consumer's "personal financial information"(Personal Financial Information Protection Technical Specification JR/T 0171-2020 + Regulations on the Administration of the Credit Reporting Industry — applicable to financial institutions and their non-affiliated third parties; imposes substantive restrictions on financial information sharing)?

Health and medical data, held by medical institutions or health and medical data processors(Measures for the Administration of Population Health Information (Trial) + PIPL + relevant provisions on the administration of health and medical big data — imposes substantive restrictions on use and disclosure, involving medical record data, health records, etc.)?

Education-related personal information, processed by schools or education informatization service providers that provide services to schools(PIPL — informed consent requirements, combined with relevant provisions in the education field)?

Personal information of minors under the age of fourteen, collected by operators that target minors or actually know that minors use their services(Provisions on the Cyber Protection of Children's Personal Information + Article 31 of the PIPL — guardian informed consent, notification obligations, strict retention and sharing restrictions)? [法条原文]

Other sector-specific regulatory regimes(e.g., automobile data processing under the Several Provisions on the Administration of Automobile Data Security (Trial), credit reporting data under the Regulations on the Administration of the Credit Reporting Industry, CII data under the Regulations on the Security Protection of Critical Information Infrastructure, etc.)?

If any item is yes: sector regulation usually provides the dominant substantive restrictions, not merely an exemption from the PIPL. Please research and cite the specific provisions before proceeding.

Then, for ~/.claude/plugins/config/claude-for-legal-zh/privacy-legal/CLAUDE.md → ## 监管覆盖范围 each jurisdiction insearch for the currently effective statutory personal information protection impact assessment trigger conditions. Cite currently effective laws, administrative regulations, departmental rules, or Cyberspace Administration guidelines, with precise citations. Note the effective dates — national standards and departmental rules are updated frequently, and a static list must not be relied upon. When uncertain, flag it for attorney verification rather than guessing.

Statutory assessment trigger circumstances under Article 55 of the PIPL (four categories + catch-all) [法条原文]：

Processing sensitive personal information(as defined in Article 28 of the PIPL [法条原文]: personal information that, once leaked or illegally used, may easily cause harm to the dignity of natural persons or endanger the safety of their persons or property, including biometric identification, religious beliefs, specific identity, medical health, financial accounts, whereabouts and trajectories, and other information, as well as the personal information of minors under the age of fourteen)
Using personal information to conduct automated decision-making(Article 24 of the PIPL [法条原文]: when using personal information to conduct automated decision-making, the transparency of the decision-making and the fairness and justice of the results shall be ensured, and unreasonable differential treatment of individuals in transaction prices and other transaction conditions shall not be implemented)
Entrusting the processing of personal information, providing personal information to other personal information processors, or publicly disclosing personal information(Articles 21-23 and Article 25 of the PIPL [法条原文]）
Providing personal information overseas(Articles 38-40 of the PIPL [法条原文] + Measures for the Security Assessment of Data Export / Measures for the Standard Contract for Personal Information Export)
Other personal information processing activities that have a major impact on the rights and interests of individuals

Ifanystatutory trigger condition of an applicable regime is met → the statutory assessment is mandatorily triggered, regardless of the internal trigger criteria.

Strong indicators (not necessarily triggering a statutory obligation, but an assessment is strongly recommended):

Application of new technology or innovative use of existing technology
Data of minors
Combining data sets originally collected separately
Data that may lead to discrimination
Processing activities that personal information subjects would not expect
Cross-context behavioral advertising or tracking-based advertising technology activities (a common issue for consumer-facing companies, often giving rise to conflicts with processing rule commitments and overlapping industry regulation)

One or more strong indicators present but no statutory trigger condition retrieved → escalate to Impact assessment required(not statutorily mandatory, but flagged in the output).

Step 4: Personal information processing rule conflict check

Read ~/.claude/plugins/config/claude-for-legal-zh/privacy-legal/CLAUDE.md → ## 个人信息处理规则承诺. Check item by item whether the proposed activity is consistent with each declared commitment.

Common conflicts to capture:

The processing rules say "we collect X, Y, Z" — this activity collects W. The processing rules must be updated first, or collection of W must stop.
The processing rules say "we will not sell or share data with third parties" — this activity passes data to a vendor for the vendor's own purposes. It is necessary to examine whether this data flow falls within the regulated "provision" or "sharing" categories under each applicable regime.
The processing rules specify a retention period — this activity retains the data longer.
The processing rules say "we use the data only for [a certain purpose]" — this activity uses it for a new purpose without re-obtaining consent or assessing the legal basis.
The processing rules list the personal information subject rights provided — this activity creates new categories of data that existing rights processes cannot cover.

If there is a direct conflict → Stop. It is not "proceed cautiously" — the processing rule conflict must be resolved first (update the processing rules or redesign the activity) before proceeding.

Step 5: Classification and output

Conclusion

[Impact assessment required / Statutory assessment mandatory trigger / Can proceed directly — one-sentence explanation of the reason]

Activity description: [State the processing activity as you understand it]

Classification: [Can proceed directly / Impact assessment required / Statutory assessment mandatory trigger / Stop]

Internal trigger criteria met? [Yes / No] Article 55 of the Personal Information Protection Law statutory assessment trigger? [Yes — [triggering circumstance] / No / Not applicable] Personal information processing rule conflict? [None / Yes — [specific conflict]]

Reasoning: [1-3 sentences. Can proceed directly: the reason it is safe under the current processing rules. Impact assessment required/Statutory assessment: the reason the obligation arises. Stop: the specific processing rule commitment or principle that is in conflict.]

If impact assessment required or statutory assessment mandatory trigger — prerequisites for proceeding:

Requirement	Owner	Completed?
[e.g.: Personal information protection impact assessment — full format]	[Privacy legal]	☐
[e.g.: Legal basis assessment (if needed)]	[Privacy legal]	☐
[e.g.: Consultation with the personal information protection officer (statutory assessment path)]	[Personal information protection officer]	☐
[e.g.: Vendor data processing agreement signed]	[Privacy / Legal]	☐
[e.g., updated before the privacy policy goes live]	[Privacy Legal]	☐
[e.g., consent mechanism has been built and tested]	[Product]	☐
[e.g., data subject rights process covers new data categories]	[Privacy / Product]	☐

Legal basis (PIPL Article 13) [法条原文]: [notice and consent / necessary for contract / legal obligation / human resources management / reasonable processing of publicly disclosed information / emergency / other — or "not yet clear — to be determined in the impact assessment"]

Next step — proposed continuation:

After presenting a "requires impact assessment" or "statutory assessment mandatory trigger" result, always end as follows:

"Do you need me to start the personal information protection impact assessment now? I can run the intake questions and generate the assessment document, without you running a separate command."

If they say yes, load the pia-generation skill and continue in the same conversation — passing the activity description and any identified triggers.

If they say no, the triage result remains unchanged. The assessment can be run at any time with the following command: /privacy-legal:pia-generation [活动]

If Stop:

Conflict: [the specific privacy policy commitment or principle that conflicts]

To proceed, one of the following must change:

[Option A — redesign the activity to avoid creating the conflict]
[Option B — update the privacy policy to cover this processing activity (the update itself must be reviewed for consistency with the legal basis)]

If there is no viable path, do not offer one. If the processing activity simply cannot be reconciled with the stated commitments or legal basis, say so directly.

Step 6: Cross-plugin handoff

AI governance handoff: If the activity involves an AI system making or influencing decisions about individuals:

"This activity involves AI decision-making. In addition to the personal information protection impact assessment, an algorithm security assessment and a science and technology ethics review may also be required. Use /ai-governance-legal:aia-generation [活动] to run them in parallel — neither can substitute for the other."

Product legal handoff: If this is a new product feature or launch:

"If this is part of a product launch, please coordinate with product legal. Use /product-legal:launch-review— it will detect privacy components and route to this plugin."

Only flag a handoff when it is genuinely meaningful. Do not attach both as templated content.

Batch triage

If the user submits a feature list, product roadmap, or to-do list — first output a summary table, then expand each non-"can proceed directly" item:

#	Activity	Category	Key conditions / blockers
1	[Activity]	🟢 Can proceed directly	—
2	[Activity]	🟡 Requires impact assessment	Requires legal basis assessment; supplier data processing agreement not in place
3	[Activity]	🟠 Statutory assessment mandatory trigger	Large-scale sensitive personal information (PIPL Article 55, Item 1)
4	[Activity]	🔴 Stop	Privacy policy conflict — purpose limitation

Edge cases and failure modes

"Data has been anonymized" does not automatically mean "can proceed directly." Ask how the anonymization was done and whether re-identification is actually feasible with the given dataset. Pseudonymized data remains personal information under the Personal Information Protection Law.

"We are already doing something similar" cannot replace triage. An existing processing activity that has never been assessed cannot provide a "grandfather clause" for a new processing activity. If the new activity differs materially in scale, purpose, or data categories, re-triage.

"It's just a pilot" cannot skip triage. Pilots involving real user or employee data are equally subject to the trigger conditions. The same classification applies; if assessment is required, the pilot should also complete the assessment.

"The vendor is responsible for all privacy matters." The vendor handles the infrastructure. You are still the personal information processor that determines the purpose. If personal information flows to the vendor, a data processing agreement is needed, and triage still applies to the purpose.

Inferred data and derived attributes also count. If the activity generates inferred data about individuals (such as behavioral scores or preference predictions), triage the inferred attributes as personal information. Do not let "we are just calculating a score" obscure what the score represents.

End with a next-step decision tree

End with a next-step decision tree consistent with CLAUDE.md ## 输出 . Customize the options based on what this skill just produced—the five default branches (draft X, escalate, get more facts, monitor and wait, other) are a starting point, not locked in. The decision tree is the output; the lawyer chooses.