Data processing systems and methods for auditing data request compliance

• US 10,318,761 B2
• Filed: 08/20/2018
• Issued: 06/11/2019
• Est. Priority Date: 06/10/2016
• Status: Active Grant

• Current Assignee: OneTrust LLC
• Original Assignee: OneTrust LLC
• Inventors: Barday, Kabir A., Brannon, Jonathan Blake, Sabourin, Jason L., Karanjkar, Mihir S., Jones, Kevin, Beaumont, Richard A.
• Primary Examiner(s): Zaidi, Syed A
• Application Number:
  US16/105,602
• Publication Number:
  US 20190102575A1
• Time in Patent Office: 295 Days
• Field of Search: 726 27
• CPC Class Codes: G06F 15/76 Architectures of general purpose stored program computers with program plugboard G06F15/08; multicomputers G06F15/16
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 63/0407 wherein the identity of one or more communicating identities is hidden cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/108 when the policy decisions are valid for a limited amount of time

Abstract

A privacy management system that is configured to process one or more data subject access requests and further configured to: (1) enable a data protection officer to submit an audit request; (2) perform an audit based on one or more parameters provided as part of the request (e.g., one or more parameters such as how long an average request takes to fulfill, one or more parameters related to logging and/or tracking data subject access requests and/or complaints from one or more particular customer advocacy groups, individuals, NGOs, etc.); and (3) provide one or more audit results to the officer (e.g., by displaying the results on a suitable display screen).

Claims

1. A privacy management computer system for auditing one or more responses to one or more data subject access requests received by a particular entity, the system comprising:

one or more computer processors; and

computer memory operatively coupled to the one or more processors, wherein the one or more computer processors are adapted for;

receiving a plurality of data subject access requests via a plurality of webforms on respective computing devices from a plurality of data subject access requestors;

automatically determining a type of each data subject access request, the determined type of data subject access request being selected from a group consisting of;

(1) a request to delete personal data of the requestor that is being stored by a particular organization;

(2) a request to provide, to the requestor, personal data of the requestor that is being stored by the particular organization;

(3) a request to update personal data of the requestor that is being stored by the particular organization; and

(4) a request to opt out of having the particular organization use the requestor'"'"'s personal information in one or more particular ways;

determining, based at least partially on the determined type of each data subject access request, a workflow that is to be used to process each request;

facilitating the processing of each of the plurality of data subject access requests via the workflow;

providing a data subject access request compliance portal;

receiving an audit request, via the data subject access request compliance portal, to audit compliance, by the particular entity with one or more data subject access request requirements, the audit request comprising one or more request parameters;

perform the audit based on the one or more request parameters;

generate a report of one or more results of the audit; and

provide the report to a privacy officer associated with the particular entity.

2. The privacy management computer system of claim 1, wherein the workflow is a workflow for validating the identity of an individual before the system facilitates completion of the data subject access request.

3. The privacy management computer system of claim 1, wherein the workflow is a workflow that specifies, based at least partially on the determined type of each data subject access request, that the system will facilitate at least a partial manual processing of at least a particular data subject access request of the plurality of data subject access requests.

4. The privacy management computer system of claim 1, wherein:

the one or more data subject access request requirements comprise a respective time constraint for responding to each of the plurality of data subject access requests.

5. The privacy management computer system of claim 4, wherein:

the one or more request parameters comprise one or more parameters related to a timing of the processing of each of the plurality of data subject access requests; and

performing the audit comprises analyzing the timing of the processing of each of the plurality of data subject access requests and comprising the analysis to each respective time constraint.

6. The privacy management computer system of claim 1, wherein:

the one or more request parameters comprise one or more parameters related to a particular group of data subjects; and

performing the audit comprises;

analyzing the plurality of data subject access requestors to identify one or more members of the particular group of data subjects;

identifying particular associated data subject access requests of the plurality of data subject access requests that are associated with the one or more members of the particular group of data subjects; and

analyzing the particular associated data subject access request to determine a compliance level with the one or more data subject access request requirements.

7. The privacy management computer system of claim 1, wherein performing the audit comprises:

analyzing the plurality of data subject access requestors to identify a particular group associated with at least a particular number of the plurality of data subject access requestors; and

generate the report to include the identified particular group.

8. A computer-implemented data processing method for receiving and facilitating the processing of data subject access requests and subsequently auditing a plurality of processed data subject access requests, the method comprising:

receiving, by at least one computer processor, a data subject access request from a data subject access requestor;

automatically determining, by at least one computer processor, a type of the data subject access request, the determined type of data subject access request being selected from a group consisting of;

(1) a request to delete personal data of the requestor that is being stored by a particular organization;

(2) a request to provide, to the requestor, personal data of the requestor that is being stored by the particular organization;

(3) a request to update personal data of the requestor that is being stored by the particular organization; and

(4) a request to opt out of having the particular organization use the requestor'"'"'s personal information in one or more particular ways;

determining, by at least one processor, based at least partially on the determined type of data subject access request, a workflow that is to be used to process the request;

after determining the workflow, facilitating, by at least one processor, the processing of the request via the computer-implemented workflow;

providing a data subject access request compliance portal;

receiving an audit request, via the data subject access request compliance portal, to audit compliance, by the particular organization with one or more data subject access request requirements, the audit request comprising one or more request parameters;

perform the audit based on the one or more request parameters;

generate a report of one or more results of the audit; and

provide the report to a privacy officer associated with the particular organization.

9. The computer-implemented data processing method of claim 8, wherein the computer-implemented workflow is a workflow for validating the identity of an individual.

10. The computer-implemented data processing method of claim 9, wherein the computer-implemented method further comprises analyzing a timing of the plurality of processed data subject access requests.

11. The computer-implemented data processing method of claim 10, wherein the one or more data subject access request requirements comprise a respective time constraint for responding to each of the plurality of processed data subject access requests.

12. The computer-implemented data processing method of claim 11, wherein performing the audit comprises analyzing the timing of the processing of each of the plurality of processed data subject access requests and comprising the analysis to each respective time constraint.

13. The computer-implemented data processing method of claim 11, wherein performing the audit comprises analyzing each of the plurality of processed data subject access requests to identify whether any particular data subject access request of the plurality of processed data subject access requests utilized one or more time extensions during processing.

14. The computer-implemented data processing method of claim 13, further comprising:

in response to determining that a particular data subject access request of the plurality of processed data subject access requests utilized the one or more time extensions during processing, modifying the report of one or more results of the audit.

15. The computer-implemented data processing method of claim 8, wherein performing the audit comprises determining, for each of the plurality of processed data subject access requests, whether the processing was substantially automatic or required at least a partial manual processing.

16. The computer-implemented data processing method of claim 8, the method further comprising:

receiving a complaint from the data subject access requestor regarding the processing of the data subject access request; and

in response to receiving the complaint, modifying the report of one or more results of the audit.

17. The computer-implemented data processing method of claim 16, wherein the workflow is a workflow that specifies, based at least partially on the determined type of data subject access request, that the system will facilitate at least a partial manual processing of the data subject access request.

18. The computer-implemented data processing method of claim 17, wherein the workflow is a computer-implemented workflow for automatically deleting at least substantially all of the personal data for the requestor on one or more computer systems of the particular organization.

19. The computer-implemented data processing method of claim 18, wherein performing the audit comprises scanning the one or more computer systems of the particular organization using one or more intelligent identity scanning means to identify at least one piece of personal data associated with the requestor that is stored on the one or more computer systems of the particular organization.

20. The computer-implemented data processing method of claim 8, wherein performing the audit comprises analyzing a plurality of open data subject access requests to determine, for each of the plurality of open data subject access requests, a number of days remaining before a respective deadline for responding.