Data processing systems for webform crawling to map processing activities and related methods

• US 10,289,867 B2
• Filed: 10/13/2018
• Issued: 05/14/2019
• Est. Priority Date: 07/27/2014
• Status: Active Grant

• Current Assignee: OneTrust LLC
• Original Assignee: OneTrust LLC
• Inventors: Barday, Kabir A., Karanjkar, Mihir S., Finch, Steven W., Browne, Ken A., Heard, Nathan W., Patel, Aakash H., Sabourin, Jason L., Daniel, Richard L., Patton-Kuhl, Dylan D., Jones, Kevin, Brannon, Jonathan Blake
• Primary Examiner(s): Deng, Anna C
• Application Number:
  US16/159,635
• Publication Number:
  US 20190050597A1
• Time in Patent Office: 213 Days
• Field of Search: 717101, 717110
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: G06F 16/955 using information identifiers, e.g. uniform resource locators [URL]
• CPC Class Codes: G06F 16/957 Browsing optimisation, e.g. caching or content distillation
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 40/174 Form filling; Merging
• CPC Class Codes: G06F 40/186 Templates

Abstract

In particular embodiments, a Data Access Webform Crawling System is configured to: (1) identify a webform used to collect one or more pieces of personal data; (2) robotically complete the identified webform; (3) analyze the completed webform to determine one or more processing activities that utilize the one or more pieces of personal data collected by the webform; (4) identify a first data asset in the data model that is associated with the one or more processing activities; (5) modify a data inventory for the first data asset in the data model to include data associated with the webform; and (6) modify the data model to include the modified data inventory for the first data asset.

Claims

1. A computer-implemented data processing method for modifying a data model based on one or more pieces of personal data submitted via a webform, the method comprising:

identifying a webform used to collect one or more pieces of personal data;

robotically completing the identified webform;

analyzing the completed webform to determine one or more processing activities that utilize the one or more pieces of personal data collected by the webform, wherein analyzing the completed webform to determine one or more processing activities comprises analyzing one or more pieces of computer code associated with the webform;

using an asset map of a plurality of data assets to identify a first data asset in the data model that is associated with the one or more processing activities, wherein the asset map defines a respective model attribute related to a storage location of the first data asset;

modifying a data inventory for the first data asset in the data model to include data associated with the webform, wherein modifying the data inventory for the first data asset in the data model comprises modifying the data inventory to include an indication that the one or more processing activities utilize the data associated with the webform in the first data asset; and

modifying the data model to include the modified data inventory for the first data asset by mapping the first data asset, based at least in part on the analysis of the computer code associated with the webform, to the one or more processing activities that utilize the one more pieces of personal data.

2. The computer-implemented data processing method of claim 1, wherein analyzing the one or more pieces of computer code associated with the webform comprises analyzing the one or more pieces of computer code to identify a storage location to which the one or more pieces of personal data collected by the webform are routed.

3. The computer-implemented data processing method of claim 2, wherein analyzing the one or more pieces of computer code associated with the webform comprises analyzing the one or more pieces of computer code to identify the first data asset based on the storage location.

4. The computer-implemented data processing method of claim 1, wherein:

robotically completing the identified webform comprises robotically completing the identified webform using a virtual profile comprising an e-mail address; and

the method further comprises monitoring an e-mail account associated with the e-mail address for a confirmation e-mail related to the completion of the identified webform.

5. The computer-implemented data processing method of claim 4, further comprising scraping the confirmation e-mail for the data associated with the webform.

6. The computer-implemented data processing method of claim 1, further comprising adding the first data asset to a third-party data repository with an electronic link to the webform.

7. A computer-implemented data processing method for modifying a data model based on one or more pieces of personal data submitted via a webform, the method comprising:

identifying a webform used to collect one or more pieces of personal data;

robotically completing the identified webform;

analyzing the completed webform to determine one or more processing activities that utilize the one or more pieces of personal data collected by the webform, wherein analyzing the completed webform to determine one or more processing activities comprises analyzing one or more pieces of computer code associated with the webform;

using an asset map of a plurality of data assets to identify a first data asset in the data model that is associated with the one or more processing activities, wherein the asset map defines a respective model attribute related to a storage location of the first data asset;

modifying a data inventory for the first data asset in the data model to include data associated with the webform, wherein modifying the data inventory for the first data asset in the data model comprises modifying the data inventory to include an indication that the one or more processing activities utilize the data associated with the webform in the first data asset; and

modifying the data model to include the modified data inventory for the first data asset by mapping the first data asset, based at least in part on the analysis of the computer code associated with the webform, to the one or more processing activities that utilize the one more pieces of personal data; and

adding the first data asset to a third-party data repository with an electronic link to the webform.

8. The computer-implemented data processing method of claim 7, wherein analyzing the one or more pieces of computer code associated with the webform comprises analyzing the one or more pieces of computer code to identify a storage location to which the one or more pieces of personal data collected by the webform are routed.

9. The computer-implemented data processing method of claim 7, wherein analyzing the one or more pieces of computer code associated with the webform comprises analyzing the one or more pieces of computer code to identify the first data asset based on the storage location.

10. The computer-implemented data processing method of claim 7, wherein:

robotically completing the identified webform comprises robotically completing the identified webform using a virtual profile comprising an e-mail address; and

the method further comprises monitoring an e-mail account associated with the e-mail address for a confirmation e-mail related to the completion of the identified webform.

11. The computer-implemented data processing method of claim 10, further comprising scraping the confirmation e-mail for the data associated with the webform.

12. A computer-implemented data processing method for managing a plurality of data assets of an organization with a third-party data repository, the method comprising:

identifying a webform used to collect one or more pieces of personal data;

identifying a particular data asset to which input data of the webform is transmitted, the particular data asset being one of a plurality of data assets of the organization where input data of the webform is transmitted;

adding the particular data asset to the third-party data repository with an electronic link to the webform;

in response to a user submitting the webform, creating a unique subject identifier to submit, along with form data provided by the user in the webform, to both the third-party data repository and the particular data asset, wherein the unique subject identifier identifies the user;

submitting the unique subject identifier and the form data provided by the user in the webform to both the third-party data repository and the particular data asset;

digitally storing, in both the third-party data repository and the data asset, both the unique subject identifier and the form data provided by the user in the webform;

receiving a data subject access request from the user to update personal data;

in response to receiving the data subject access request, accessing the third-party data repository to identify the unique subject identifier of the user;

after identifying the subject matter identifier, determining which specific data assets of the plurality of data assets of the organization include the unique subject identifier;

accessing personal data of the user stored in each of the specific data assets of the plurality of data assets of the organization that include the unique subject identifier; and

updating the personal data of the user stored in each of the specific data assets according to the user'"'"'s data subject access request.

13. The computer-implemented data processing method of claim 12, further comprising:

receiving a data subject access request from the user that is a data subject deletion request;

in response to receiving the data subject access request;

accessing the third-party data repository to identify the unique subject identifier of the user;

determining which data assets of the plurality of data assets of the organization include the unique subject identifier;

accessing personal data of the user stored in each of the data assets of the plurality of data assets of the organization that include the unique subject identifier; and

deleting the personal data of the user stored in each of the data assets of the plurality of data assets of the organization that include the unique subject identifier.

14. The computer-implemented data processing method of claim 12, further comprising:

receiving a data subject access request from the user that is a data subject rights request;

in response to receiving the data subject rights request;

accessing the third-party data repository to identify the unique subject identifier of the user;

determining which data assets of the plurality of data assets of the organization include the unique subject identifier; and

accessing personal data of the user stored in each of the data assets of the plurality of data assets of the organization that include the unique subject identifier.

15. The computer-implemented data processing method of claim 14, further comprising:

generating a data subject rights request report that includes the accessed personal data of the user stored in each of the data assets of the plurality of data assets of the organization that include the unique subject identifier; and

transmitting the data subject rights request report to the user.

16. The computer-implemented data processing method of claim 15, wherein the data subject rights request report is transmitted to the user via an electronic secure link.