Data processing systems for generating and populating a data inventory for processing data access requests

• US 10,181,051 B2
• Filed: 06/01/2018
• Issued: 01/15/2019
• Est. Priority Date: 06/10/2016
• Status: Active Grant

• Current Assignee: OneTrust LLC
• Original Assignee: OneTrust LLC
• Inventors: Barday, Kabir A., Karanjkar, Mihir S., Finch, Steven W., Browne, Ken A., Heard, Nathan W., Patel, Aakash H., Sabourin, Jason L., Daniel, Richard L., Patton-Kuhl, Dylan D., Brannon, Jonathan Blake
• Primary Examiner(s): Deng, Anna C
• Application Number:
  US15/996,208
• Publication Number:
  US 20180276415A1
• Time in Patent Office: 228 Days
• Field of Search: 717101
• CPC Class Codes: G06F 15/76 Architectures of general purpose stored program computers with program plugboard G06F15/08; multicomputers G06F15/16
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 21/6254 by anonymising data, e.g. decorrelating personal data from the owner's identification
• CPC Class Codes: G06N 20/00 Machine learning

Abstract

In particular embodiments, a data processing data inventory generation system is configured to: (1) generate a data model (e.g., a data inventory) for one or more data assets utilized by a particular organization; (2) generate a respective data inventory for each of the one or more data assets; and (3) map one or more relationships between one or more aspects of the data inventory, the one or more data assets, etc. within the data model. In particular embodiments, a data asset (e.g., data system, software application, etc.) may include any entity that collects, processes, contains, and/or transfers personal data (e.g., a software application, database, website, server, etc.). A data asset may include any software or device (e.g., server or servers) utilized by a particular entity for such data collection, processing, transfer, storage, etc. The system may then utilize the generated model to fulfill a data subject access request.

Claims

1. A computer-implemented data processing method for identifying one or more pieces of personal data associated with a data subject within a data system in order to fulfill a data subject access request, the method comprising:

receiving, by one or more processors, from a data subject, a data subject access request;

processing, by the one or more processors, the data subject access request by identifying the one or more pieces of personal data associated with the data subject, wherein identifying the one or more pieces of personal data associated with the data subject comprises scanning one or more data inventories stored within the data system for the one or more pieces of personal data, and wherein scanning the one or more data inventories stored within the data system for the one or more pieces of personal data comprises;

accessing, via one or more computer networks, the one or more data inventories,

generating a catalog of one or more pieces of personal information associated with the data subject based at least in part on the data subject access request,

storing the catalog in computer memory,

scanning the one or more data inventories based at least in part on the generated catalog to identify one or more attributes of data associated with the data subject by searching one or more data fields in the one or more data inventories for the one or more pieces of personal information,

analyzing and correlating the one or more attributes and metadata for the scanned one or more data inventories,

using one or more machine learning techniques to categorize one or more data elements from the generated catalog,

analyzing a flow of the data elements among the one or more data inventories,

categorizing the one or more data elements based on a confidence score,

receiving input from one or more users confirming or denying a categorization of the one or more data elements, and

in response to receiving the input, modifying the confidence score;

in response to identifying the one or more pieces of personal data, taking one or more actions selected from the group consisting of;

deleting the one or more pieces of personal data from the data system,

modifying at least one of the one or more pieces of personal data and storing the modified at least one of the one or more pieces of personal data in the data system, and

generating a report comprising the one or more pieces of personal data and providing the report to the data subject.

2. The computer-implemented data processing method of claim 1, wherein:

the data subject access request comprises a request to be forgotten; and

the one or more actions comprise deleting the one or more pieces of personal data from the data system.

3. The computer-implemented data processing method of claim 2, wherein deleting the one or more pieces of personal data from the data system comprises overwriting the one or more pieces of personal data within computer memory associated with the data system.

4. The computer-implemented data processing method of claim 1, wherein scanning the one or more data inventories stored within the data system for the one or more pieces of personal data comprises:

analyzing each of the one or more data inventories to identify one or more data inventory attributes associated with each respective one of the one or more data inventories;

scanning the one or more data inventory attributes; and

analyzing the one or more data inventory attributes to identify the one or more pieces of personal data based at least in part on one or more pieces of identifying information associated with the data subject submitted along with the data subject access request.

5. The computer-implemented data processing method of claim 4, wherein the one or more pieces of identifying information comprise a first name of the data subject, a last name of the data subject, and an e-mail address of the data subject.

6. The computer-implemented data processing method of claim 5, wherein analyzing the one or more data inventory attributes to identify the one or more pieces of personal data based at least in part on one or more pieces of identifying information comprises:

identifying each of the one or more pieces of identifying information in the one or more data inventory attributes;

identifying one or more pieces of data associated with the one or more pieces of identifying information in the one or more data inventory attributes; and

in response to identifying the one or more pieces of data associated with the one or more pieces of identifying information in the one or more data inventory attributes, at least temporarily storing the one or more pieces of data as the one or more pieces of personal data associated with the data subject.

7. The computer-implemented method of claim 1, further comprising:

determining the one or more pieces of personal data associated with the data subject from the one or more data elements based at least in part on the confidence score.

8. The computer-implemented data processing method of claim 1, further comprising:

using an application programming interface to access a third party information technology system;

receiving one or more pieces of data from the third party information technology system; and

determining the one or more pieces of personal data based at least in part on the received one or more pieces of data and the data subject access request.

9. The computer-implemented data processing method of claim 1, wherein:

the one or more data inventories comprise a first data inventory;

the first data inventory is associated with a first data asset; and

the method further comprises;

identifying the first data asset, the first data asset being an asset that collects or stores personal data of one or more data subjects;

generating the first data inventory for the first data asset, the data inventory storing one or more first data asset inventory attributes comprising;

a type of personal data collected or stored by the first data asset; and

first transfer data associated with the personal data and the first data asset;

identifying a transfer data asset based at least in part on the first transfer data;

modifying the first data inventory to include the transfer data asset, the transfer data asset storing one or more transfer data asset inventory attributes comprising the first transfer data;

digitally storing the first data inventory in the computer memory; and

electronically linking the first data asset to the transfer data asset in the first data inventory.

10. A computer-implemented data processing method for responding to a data subject access request, the method comprising:

receiving, by one or more processors, a data subject access request from a requestor comprising one or more request parameters;

processing the request by identifying, by the one or more processors, one or more pieces of personal data associated with the requestor, the one or more pieces of personal data being stored in one or more data repositories associated with a particular organization, wherein identifying the one or more pieces of personal data associated with the requestor comprises;

scanning one or more databases to generate a catalog of one or more individuals and one or more pieces of personal information associated with the one or more individuals,

scanning one or more data repositories based at least in part on the generated catalog to identify one or more attributes of data associated with the one or more individuals,

analyzing and correlating the one or more attributes and metadata for the scanned one or more data repositories,

using one or more machine learning techniques to categorize one or more data elements from the generated catalog,

analyzing a flow of the data elements among the one or more data repositories,

classifying the one or more data elements based on a confidence score,

receiving input from one or more users confirming or denying a categorization of the one or more data elements, and

identifying the one or more pieces of personal data based at least in part on the confirmed categorization; and

taking, by the one or more processors, one or more actions based at least in part on the data subject access request, the one or more actions including one or more actions related to the one or more pieces of personal data.

11. The computer-implemented data processing method of claim 10, wherein the one or more actions comprise at least one action selected from the group consisting of:

deleting the one or more pieces of personal data;

modifying at least one of the one or more pieces of personal data; and

displaying the one or more pieces of personal data to the requestor.

12. The computer-implemented data processing method of claim 10, wherein identifying the one or more pieces of personal data associated with the requestor comprises:

accessing a data model that stores one or more data inventories for one or more data assets;

scanning each of the one or more data inventories to identify one or more data attributes associated with each of the one or more data inventories; and

analyzing each of the one or more data attributes to identify the one or more pieces of personal data.

13. The computer-implemented data processing method of claim 12, wherein the data model is generated by:

generating the data model for the one or more data assets used in the collection or storage of personal data;

digitally storing the data model in computer memory;

identifying a first data asset of the one or more data assets;

modifying the data model to include the first data asset;

generating the first data inventory for the first data asset in the data model, the first data inventory comprising one or more inventory attributes comprising one or more pieces of personal data associated with the first data asset;

associating the data inventory with the first data asset in computer memory; and

mapping the first data asset to at least one of the one or more data assets in the data model.

14. The computer-implemented data processing method of claim 13, the method further comprising:

identifying the one or more pieces of personal data in the first inventory; and

in response to identifying the one or more pieces of personal data in the first inventory, scanning the at least one of the one or more data sets that are mapped to the first data set.

15. The computer-implemented data processing method of claim 10, wherein:

the one or more request parameters comprise one or more identifying characteristics associated with the requestor; and

identifying the one or more pieces of personal data associated with the requestor comprises using one or more intelligent identify scanning means based on the one or more identifying characteristics to identify the one or more pieces of personal data.

16. The computer-implemented data processing method of claim 10, wherein the requestor is a data subject for whom a particular entity has collected the one or more pieces of personal data.

17. The computer-implemented data processing method of claim 10, wherein the requestor is a requestor on behalf of a data subject for whom the particular entity has collected the one or more pieces of personal data.

18. The computer-implemented data processing method of claim 10, wherein identifying the one or more pieces of personal data associated with the requestor comprises generating a data model based on personal data stored by a particular entity using one or more data modeling means.