European-Parliament-MCP-Server: Skill for Claude Code

GDPR Compliance Skill

Context

This skill applies when:

• Processing personal data from European Parliament (MEP information)
• Implementing data minimization strategies
• Supporting GDPR rights (access, rectification, erasure)
• Implementing audit logging for personal data access
• Designing privacy-by-design features
• Handling data retention and deletion
• Implementing consent mechanisms
• Creating data protection impact assessments

GDPR (EU Regulation 2016/679) applies to all processing of EU citizens' personal data. Even though MEP data is public, GDPR principles still apply.

Rules

1. Data Minimization: Only collect necessary personal data fields
2. Purpose Limitation: Use data only for stated purpose (parliamentary information)
3. Storage Limitation: Cache personal data for max 24 hours
4. Accuracy: Maintain data integrity, support corrections
5. Lawful Basis: Public interest (GDPR Art. 6(1)(e)) for MEP data
6. Audit Logging: Log all personal data access
7. Right to Rectification: Support data correction requests
8. Right to Erasure: Limited for public figures (GDPR Art. 17(3)(e))
9. Data Protection by Design: Build privacy into architecture
10. Transparency: Document all data processing activities

Examples

✅ Good Pattern: Data Minimization

// GOOD: Only public information
interface MEPPublicData {
  id: number;
  fullName: string;
  country: string;
  partyGroup: string;
  active: boolean;
  // DO NOT collect: private addresses, personal phones, family data
}

// Define data purpose
const DATA_PURPOSE = 'Providing public parliamentary information via MCP protocol';

✅ Good Pattern: Audit Logging

/**
 * GDPR-compliant audit logging
 * Requirement: GDPR Art. 30 (Records of processing activities)
 */
function logPersonalDataAccess(
  actor: string,
  subject: string,
  purpose: string
): void {
  auditLog.record({
    timestamp: new Date().toISOString(),
    eventType: 'personal_data_access',
    actor,
    subject,
    purpose,
    legalBasis: 'GDPR_Art_6_1_e_Public_Interest',
  });
}

// Usage
logPersonalDataAccess(
  'mcp_client',
  'mep:12345',
  'Parliamentary information query'
);