Using a rules model to improve handling of personally identifiable information

• US 20030014654A1
• Filed: 06/19/2001
• Published: 01/16/2003
• Est. Priority Date: 06/19/2001
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Camenisch, Jan, Gilbert, Arthur M., McCullough, Michael Robert, Waidner, Michael, Brown, Nigel Howard Julian, Adler, Steven B., Kesdogan, Dogan, Palmer, Charles Campbell, Schnyder, Michael, Karjoth, Guenter, Bangerter, Endre Felix, Nelson, Adam Charles, Presler-Marshall, Martin Joseph Clayton, Herreweghen, Elsie Van
• Granted Patent: US 7,069,427 B2
• Time in Patent Office: Days
• US Class Current: 713/200
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 21/6254 by anonymising data, e.g. decorrelating personal data from the owner's identification

Abstract

The present invention is a system and method for handling personally identifiable information, using a rules model. The invention involves defining a limited number of privacy-related actions regarding personally identifiable information; constructing a rule for each circumstance in which one of said privacy-related actions may be taken or must be taken; allowing for the input of dynamic contextual information to precisely specify the condition for evaluation of a rule; creating a programming object containing at least one of said rules; associating the programming object with personally identifiable information; processing a request; and providing an output. The invention does not merely give a “yes-or-no answer. The invention has the advantage of being able to specify additional actions that must be taken. The invention may use a computer system and network. One aspect of the present invention is a method for handling personally identifiable information. Another aspect of the present invention is a system for executing the method of the present invention. A third aspect of the present invention is as a set of instructions on a computer-usable medium, or resident in a computer system, for executing the method of the present invention.

Claims

1. A method of handling personally identifiable information, said method comprising:

defining a limited number of privacy-related actions regarding said personally identifiable information;

constructing a rule for each circumstance in which one of said privacy-related actions may be taken or must be taken;

allowing for the input of dynamic contextual information to precisely specify the condition for evaluation of said rule;

creating a programming object containing at least one of said rules;

associating said programming object with said personally identifiable information;

processing a request; and

providing an output.

2. The method of claim 1, wherein said output is selected from the group consisting of

authorizing said privacy-related action,

authorizing said privacy-related action, plus specifying one or more tasks,

and denying said request but also suggesting what must be done to have said request approved.

3. The method of claim 1, wherein said output includes the specification of at least one additional action that must be taken.

4. A system for handling personally identifiable information, said system comprising:

means for defining a limited number of privacy-related actions regarding said personally identifiable information;

means for constructing a rule for each circumstance in which one of said privacy-related actions may be taken or must be taken;

means for allowing for the input of dynamic contextual information to precisely specify the condition for evaluation of said rule;

means for creating a programming object containing at least one of said rules;

means for associating said programming object with said personally identifiable information;

means for processing a request; and

means for providing an output.

5. The system of claim 4, wherein said output is selected from the group consisting of

authorizing said privacy-related action,

authorizing said privacy-related action, plus specifying one or more tasks,

and denying said request but also suggesting what must be done to have said request approved.

6. The system of claim 4, wherein said output includes the specification of at least one additional action that must be taken.

7. A computer-usable medium having computer-executable instructions for handling personally identifiable information, said computer-executable instructions comprising:

means for defining a limited number of privacy-related actions regarding said personally identifiable information;

means for constructing a rule for each circumstance in which one of said privacy-related actions may be taken or must be taken;

means for allowing for the input of dynamic contextual information to precisely specify the condition for evaluation of said rule;

means for creating a programming object containing at least one of said rules;

means for associating said programming object with said personally identifiable information;

means for processing a request; and

means for providing an output.

8. The computer-usable medium of claim 7, wherein said output is selected from the group consisting of

authorizing said privacy-related action,

authorizing said privacy-related action, plus specifying one or more tasks,

and denying said request but also suggesting what must be done to have said request approved.

9. The computer-usable medium of claim 7, wherein said output includes the specification of at least one additional action that must be taken.