Consent receipt management systems and related methods

• US 10,592,648 B2
• Filed: 02/15/2019
• Issued: 03/17/2020
• Est. Priority Date: 06/10/2016
• Status: Active Grant

• Current Assignee: OneTrust LLC
• Original Assignee: OneTrust LLC
• Inventors: Barday, Kabir A., Brannon, Jonathan Blake, Beaumont, Richard A., Mannix, John
• Primary Examiner(s): Zhao, Don G
• Application Number:
  US16/277,715
• Publication Number:
  US 20190180012A1
• Time in Patent Office: 396 Days
• CPC Class Codes: G06F 11/3438 monitoring of user actions tracking the activity of the user H04L67/535
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 2201/81 Threshold
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS

Abstract

A consent receipt management system may include one or more consent validity scoring systems. In various embodiments, a consent validity scoring system may be configured to detect a likelihood that a user is correctly consenting via a web form. The system may be configured to determine such a likelihood based at least in part on one or more data subject behaviors while the data subject is completing the web form in order to provide consent. In various embodiments, the system is configured to monitor the data subject behavior based on, for example: mouse speed; mouse hovering; mouse position; keyboard inputs; an amount of time spent completing the web form; etc. The system may be further configured to calculate a consent validity score for each generated consent receipt based at least in part on an analysis of the data subject'"'"'s behavior.

Claims

1. A computer-implemented data processing method for generating a consent receipt under a transaction and determining a consent validity score for the transaction, the method comprising:

electronically providing, by one or more processors of an entity system, a data subject interface for initiating a transaction between an entity and a data subject;

automatically monitoring, by one or more processors of the entity system, one or more data subject inputs by the data subject while the data subject is accessing the data subject interface, wherein the one or more data subject inputs are one or more electronic inputs electronically provided by the data subject as the data subject is accessing the data subject interface;

receiving, by one or more processors of the entity system, a request to initiate the transaction between the entity and the data subject;

in response to receiving the request, electronically communicating, by the one or more processors of the entity system, with a third-party consent receipt management system for receipt of a unique consent receipt key, wherein the method further comprises;

generating, by the third-party consent receipt management system, a unique consent receipt key; and

providing, via electronic communication, the unique consent receipt key, by the third-party consent receipt management system, to the one or more processors of the entity system;

determining, by the one or more processors of the entity system and based at least in part on the one or more data subject inputs, the consent validity score for the transaction;

determining, by one or more processors of the entity system, a unique data subject identifier associated with the data subject;

electronically storing, by one or more processors of the entity system, the unique data subject identifier, the unique consent receipt key, the consent validity score, and a unique transaction identifier associated with the transaction in computer memory; and

electronically associating, by one or more processors of the entity system, the unique data subject identifier, the unique consent receipt key, the consent validity score, and the unique transaction identifier.

2. The computer-implemented data processing method of claim 1, wherein:

the transaction comprises processing, by the entity, one or more pieces of personal data associated with the data subject.

3. The computer-implemented data processing method of claim 1, wherein:

monitoring the one or more data subject inputs comprises monitoring an amount of time the data subject takes to provide each of the one or more data subject inputs; and

the one or more inputs comprise the request to initiate the transaction between the entity and the data subject.

4. The computer-implemented data processing method of claim 3, wherein determining, the consent validity score for the transaction comprises determining the consent validity score for the transaction based at least in part on the amount of time the data subject takes to provide each of the one or more data subject inputs.

5. The computer-implemented data processing method of claim 1, the method further comprising:

determining, based at least in part on the consent validity score, whether the request to initiate the transaction between the entity and the data subject was a valid request; and

in response to determining that the request to initiate the transaction between the entity and the data subject was not a valid request, automatically prompting the data subject to consent to the transaction.

6. The computer-implemented data processing method of claim 1, wherein the request to initiate the transaction between the entity and the data subject comprises an explicit request based at least in part on the one or more data subject inputs.

7. The computer-implemented data processing method of claim 1, wherein the request to initiate the transaction between the entity and the data subject comprises an implicit request based at least in part on the one or more data subject inputs.

8. The computer-implemented data processing method of claim 7, wherein:

the one or more data subject inputs comprise scrolling within the data subject interface;

the request to initiate the transaction between the entity and the data subject comprises an implicit request based at least in part on the scrolling within the data subject interface.

9. The computer-implemented data processing method of claim 8, wherein:

the scrolling within the data subject interface comprises scrolling at least a particular scrolling speed for at least a particular length of time;

determining, based at least in part on the one or more data subject inputs, the consent validity score for the transaction comprises determining the consent validity score based at least in part on the particular scrolling speed.

10. The computer-implemented data processing method of claim 1, the method further comprising:

receiving, by one or more processors of the entity system, an indication that the entity system has processed a piece of personal data associated with the data subject as part of the transaction;

determining, based at least in part on the consent validity score, whether the request to initiate the transaction between the entity and the data subject was a valid request;

in response to determining that the request to initiate the transaction between the entity and the data subject was a valid request, storing the piece of personal data in computer memory;

in response to determining that the request to initiate the transaction between the entity and the data subject was not a valid request, deleting the piece of personal data.