Data processing systems for fulfilling data subject access requests and related methods

• US 10,585,968 B2
• Filed: 05/13/2019
• Issued: 03/10/2020
• Est. Priority Date: 06/10/2016
• Status: Active Grant

• Current Assignee: OneTrust LLC
• Original Assignee: OneTrust LLC
• Inventors: Barday, Kabir A., Sabourin, Jason L., Brannon, Jonathan Blake, Karanjkar, Mihir S., Jones, Kevin
• Primary Examiner(s): Khatri, Anil
• Application Number:
  US16/410,296
• Publication Number:
  US 20190266201A1
• Time in Patent Office: 302 Days
• Field of Search: 717101-108, 717120-122
• CPC Class Codes: G06F 16/958 Organisation or management of web site content, e.g. publishing, maintaining pages or automatic linking
• CPC Class Codes: G06F 40/174 Form filling; Merging

Abstract

Various Data Subject Access Request (DSAR) processing systems are adapted for presenting a first webform on a first web site, the first webform being adapted to receive DSAR'"'"'s and to route the requests to a first designated individual for processing; presenting a second webform on a second web site, the second webform being adapted to receive DSAR'"'"'s and to route the requests to a second designated individual for processing; receiving, via the first webform, a first DSAR; at least partially in response to the receiving the first DSAR, automatically routing the first DSAR to the first designated individual for handling; receiving, via the second webform, a second DSAR; at least partially in response to the receiving the second DSAR, automatically routing the second DSAR to the second designated individual for handling; and communicating a status of both the first DSAR and the second DSAR via a single user interface.

Claims

1. A computer-implemented method for managing a plurality of data subject access requests, the method comprising:

obtaining, by at least one computer processor,

a plurality of data subject access requests for processing,

wherein each of the plurality of data subject access requests are submitted via one or more websites; and

for each of the plurality of data subject access requests;

determining, by at least one computer processor,

a designated individual to handle the data subject access request based at least in part on the particular website of the one or more websites that the data subject access request was submitted, and

in response to determining the designated individual to handle the data subject access request, processing the data subject access request by automatically routing, by at least one computer processor, the data subject access request to the designated individual for handling.

2. The computer-implemented method of claim 1, wherein the computer-implemented method further comprises:

for each of the plurality of data subject access requests,

receiving the data subject access request via a webform provided on a particular website of the one or more websites that the data subject access request was submitted through.

3. The computer-implemented method of claim 1, wherein the computer-implemented method further comprises:

at least partially in response to routing the data subject access request to the designated individual for handling, facilitating, by at least one computer processor, at least one action selected from a group consisting of;

(a) verifying that the data subject access request was submitted by a data subject associated with the data subject access request;

(b) assigning the data subject access request to a third designated individual for handling;

(c) requesting an extension to fulfill the data subject access request;

(d) rejecting the data subject access request; and

(e) suspending the data subject access request.

4. The computer-implemented method of claim 1, wherein the computer-implemented method further comprises:

communicating, by at least one computer processor, via a single user interface, a status of each of the plurality of data subject access requests.

5. The computer-implemented method of claim 1, wherein the computer-implemented method further comprises:

for each of the plurality of data subject access requests;

determining, by at least one computer processor, whether one or more portions of the data subject access request is configured for automatic handling;

in response to determining that one or more portions of the data subject access request is configured for automatic handling, automatically handling the one or more portions of the data subject access request,

includes one or more a designated individual to handle the data subject access request based at least in part on the particular website of the one or more websites that the data subject access request was submitted, and

at least partially in response to determining the designated individual to handle the data subject access request, automatically routing, by at least one computer processor, the data subject access request to the designated individual for handling.

6. The computer-implemented method of claim 5, wherein the computer-implemented method further comprises:

for each of the plurality of data subject access requests;

in response to automatically handling the one or more portions of the data subject access request, determining whether one or more portions of the data subject access request remain to be handled;

determining, by at least one computer processor, the designated individual to handle the one or more portions of the data subject access request that remain to be handled based at least in part on the particular website of the one or more websites that the data subject access request was submitted, and

at least partially in response to determining the designated individual to handle the data subject access request, automatically routing, by at least one computer processor, at least the one or more portions of the data subject access request that remain to be handled to the designated individual for handling.

7. A computer-implemented data processing method for managing a data subject access requests the method comprising:

receiving a data subject access request (DSAR);

in response to receiving the data subject access request, obtaining metadata regarding a data subject of the data subject access request;

using the metadata to determine a priority of the DSAR based on the obtained metadata, wherein the metadata is selected from a group consisting of;

(1) a request type associated with the data subject access request;

(2) the location from which the data subject access request is being made;

(3) one or more current sensitivities to world events; and

(4) a status of the data subject issuing the data subject access request; and

processing the DSAR according to the determined priority of the DSAR by;

determining a designated individual to handle the data subject access request based at least in part on the determined priority; and

in response to determining the designated individual to handle the data subject access request, automatically routing, by at least one computer processor, the data subject access request to the designated individual for handling.

8. The computer-implemented data processing method of claim 7, wherein the metadata comprises the request type associated with the data subject access request.

9. The computer-implemented data processing method of claim 7, wherein the metadata comprises the location from which the data subject access request is being made.

10. The computer-implemented data processing method of claim 7, wherein the metadata comprises the one or more current sensitivities to world events.

11. The computer-implemented data processing method of claim 7, wherein the metadata comprises the status of the data subject issuing the data subject access request.

12. A non-transitory computer-readable medium storing computer-executable instructions for receiving data subject access requests via multiple websites and managing the data subject access requests, the computer-executable instructions comprising computer-executable instructions for:

presenting a first webform on a first website, the first webform being structured to receive data subject access requests that are to be routed to a first designated individual for processing;

presenting a second webform on a second website, the second webform being structured to receive data subject access requests that are to be routed to a second individual for processing;

receiving, via the first webform, a first data subject access request;

in response to the receiving the first data subject access request, automatically routing the first data subject access request to the first designated individual for handling; and

in response to the receiving the second data subject access request, automatically routing the second data subject access request to the second designated individual for handling,

wherein the computer-executable instructions further comprise computer-executable instructions for;

after receiving the first data subject access request, processing the first data subject access request by taking at least one action selected from a group consisting of;

(a) verifying that the first data subject access request was submitted by a data subject associated with the first data subject access request;

(b) assigning the first data subject access request to a third designated individual for handling;

(c) requesting an extension to fulfill the first data subject access request;

(d) rejecting the first data subject access request; and

(e) suspending the first data subject access request.

13. The non-transitory computer-readable medium of claim 12, wherein the computer-readable medium stores computer-executable instructions for:

providing a webform creation tool that is adapted for receiving webform creation criteria from a particular user, the webform creation criteria comprising at least one criterion from a group consisting of;

(1) a language that the form will be displayed in;

(2) what information is to be requested from data subjects who use the webform to initiate a data subject access request; and

(3) who any data subject access requests that are received via the webform will be routed to; and

executing the webform creation tool to create both the first webform and the second webform.

14. The non-transitory computer-readable medium of claim 13, wherein the webform creation criteria comprises who any data subject access requests that are received via the webform will be routed to.

15. The non-transitory computer-readable medium of claim 14, wherein the computer-readable medium stores computer-executable instructions for:

automatically verifying an identity of a particular data subject access requestor placing the first data subject access request;

at least partially in response to verifying the identity of the particular data subject access requestor, automatically obtaining at least a portion of information requested in the first data subject access request; and

after obtaining the at least a portion of the requested information, displaying the obtained information to a user as part of a fulfillment of the first data subject access request.

16. The non-transitory computer-readable medium of claim 15, wherein:

the particular data subject access requestor is a first particular data subject access requestor; and

the computer-readable medium further stores computer-executable instructions for;

automatically verifying an identity of a second particular data subject access requestor placing the second data subject access request; and

at least partially in response to verifying the identity of the second particular data subject access requestor, automatically retrieving at least a portion of particular information requested in the second data subject access request; and

after retrieving the at least a portion of the requested particular information requested in the second data subject access request, displaying the retrieved portion of the requested particular information to a user as part of a fulfillment of the second data subject access request.

17. The non-transitory computer-readable medium of claim 12, wherein the computer-readable medium further stores computer-executable instructions for:

automatically verifying an identity of a particular data subject access requestor placing the first data subject access request; and

at least partially in response to verifying the identity of the particular data subject access requestor, automatically facilitating the update of personal data that an organization associated with the first webform is processing regarding the particular data subject access requestor.

18. The non-transitory computer-readable medium of claim 12, wherein the computer-readable medium further stores computer-executable instructions for:

automatically verifying an identity of a particular data subject access requestor placing the first data subject access request; and

at least partially in response to verifying the identity of the particular data subject access requestor, automatically processing a request, made by the particular data subject access requestor, to opt out of having an organization that is associated with the first webform use the particular data subject access requestor'"'"'s personal information in one or more particular ways.

19. The non-transitory computer-readable medium of claim 12, wherein the computer-readable medium further stores computer-executable instructions for:

automatically verifying an identity of a particular data subject access requestor placing the first data subject access request; and

at least partially in response to verifying the identity of the particular data subject access requestor, automatically facilitating the deletion of personal data of the particular data subject access requestor that is being stored by an organization associated with the first webform.

20. The non-transitory computer-readable medium of claim 12, wherein the computer-readable medium stores computer-executable instructions for requesting an extension to fulfill the first data subject access request.

21. The non-transitory computer-readable medium of claim 12, wherein the computer-readable medium stores computer-executable instructions for suspending the first data subject access request.