DATA PRIVACY ENGINE

• US 20130269035A1
• Filed: 04/09/2012
• Published: 10/10/2013
• Est. Priority Date: 04/09/2012
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: BAJAJ, RIMA, CHANTZ, HYMAN D., CHAPIN, DAVID A., CRESWICK, AMY E., DA SILVA, EDUARDO M., GRAHAM, ALISON L., LIM, CHEE YEN, NELSON, ADAM C., NORRIS, NICHOLAS J., RICHE, GREGORY J., SHARMA, VARUN, ZUNIC, NEVENKO
• Granted Patent: US 8,695,101 B2
• Time in Patent Office: Days
• US Class Current: 726/26
• CPC Class Codes: G06Q 10/00 Administration; Management

Abstract

A computer hardware-implemented method, system, and/or computer program product determines an applicability of a data privacy regulation when transmitting data used with an enterprise project. A data privacy regulation describes regulatory restrictions on data being transmitted from a first geopolitical entity to a second geopolitical entity. A set of categorized data is used by an enterprise project, and the data privacy regulation establishes limitations on a transmission of at least one category of data, from the set of categorized data, from the first geopolitical entity to the second geopolitical entity. A first set of binary data and a second set of binary data are processed to determine if transmission of said at least one category of data from the first geopolitical entity to the second geopolitical entity is regulated by the data privacy regulation.

Claims

1. A computer hardware-implemented method of determining an applicability of a data privacy regulation when transmitting data used with an enterprise project, the computer hardware-implemented method comprising:

receiving a first set of binary data that describes a data privacy regulation, wherein the data privacy regulation describes regulatory restrictions on data being transmitted from a first country to a second country;

receiving a second set of binary data that describes a set of categorized data, wherein the set of categorized data is used by an enterprise project, and wherein the data privacy regulation establishes limitations on a transmission of at least one category of data, from the set of categorized data, from the first country to the second country; and

processing, by computer hardware, the first set of binary data and the second set of binary data to determine if transmission of said at least one category of data from the first country to the second country is regulated by the data privacy regulation.

2. The computer hardware-implemented method of claim 1, further comprising:

generating and displaying a recommended procedure to modify the enterprise project, wherein the recommended procedure, when implemented, brings the transmission of said at least one category of data from the first country to the second country into compliance with the data privacy regulation.

3. The computer hardware-implemented method of claim 2, wherein the recommended procedure is a contractual agreement between the first country and the second country to satisfy the data privacy regulation.

4. The computer hardware-implemented method of claim 2, wherein the recommended procedure is a contractual waiver from a resident of the first country to satisfy the data privacy regulation.

5. The computer hardware-implemented method of claim 2, wherein the recommended procedure is compliance with a certification process that has been established by the second country.

6. The computer hardware-implemented method of claim 2, further comprising:

generating a recommendation to modify enterprise policies such that all future enterprise projects comply with the recommended procedure to modify the enterprise project.

7. The computer hardware-implemented method of claim 1, further comprising:

in response to determining that transmission of said at least one category of data from the first country to the second country triggers the data privacy regulation, visually coding and displaying said at least one category of data to describe the data privacy regulation.

8. The computer hardware-implemented method of claim 1, wherein the first set of binary data describes multiple components of the data privacy regulation.

9. The computer hardware-implemented method of claim 8, further comprising:

identifying a currently implemented enterprise data privacy procedure; and

generating and displaying a matrix of the set of categorized data, wherein the matrix is visually coded to indicate a non-binary level of compliance, due to the currently implemented enterprise data privacy procedure, by a particular category from said at least one category of data with a particular component of said multiple components of the data privacy regulation.

10. The computer hardware-implemented method of claim 8, further comprising:

in response to a change to the data privacy regulation changing a non-binary compliance level of said at least one category of data with said particular component of said multiple components of the data privacy regulation, automatically adjusting visual coding of blocks in the matrix in order to reflect said change to the data privacy regulation.

11. The computer hardware-implemented method of claim 1, wherein the set of categorized data is created by the enterprise project.

12. The computer hardware-implemented method of claim 1, wherein said data privacy regulation regulates transmissions of personally identifiable information (PII), and wherein the computer hardware-implemented method further comprises:

determining that said at least one category of data from the set of categorized data is PII according to a context of said at least one category of data from set of categorized data.

13. The computer hardware-implemented method of claim 12, wherein the context of said at least one category of data is defined by use and availability of another category of data from the set of categorized data.

14. A computer program product for identifying an applicability of a data privacy regulation when transmitting data used with an enterprise project, the computer program product comprising:

a computer readable storage media;

first program instructions to receive a first set of binary data that describes a data privacy regulation, wherein the data privacy regulation describes regulatory restrictions on data being transmitted from a first state to a second state;

second program instructions to receive a second set of binary data that describes a set of categorized data, wherein the set of categorized data is created by an enterprise project, and wherein the data privacy regulation establishes limitations on a transmission of at least one category of data, from the set of categorized data, from the first state to the second state; and

third program instructions to process the first set of binary data and the second set of binary data to determine if transmission of said at least one category of data from the first state to the second state is regulated by the data privacy regulation; and

wherein the first, second, and third program instructions are stored on the computer readable storage media.

15. The computer program product of claim 14, further comprising:

fourth program instructions to generate and display a recommended procedure to modify the enterprise project, wherein the recommended procedure, when implemented, brings the transmission of said at least one category of data from the first state to the second state into compliance with the data privacy regulation; and

wherein the fourth program instructions are stored on the computer readable storage media.

16. The computer program product of claim 14, wherein the first set of binary data describes multiple components of the data privacy regulation, and wherein the computer program product further comprises:

fourth program instructions to identify a currently implemented enterprise data privacy procedure; and

fifth program instructions to generate and display a matrix of the set of categorized data, wherein the matrix is visually coded to indicate a level of compliance, due to the currently implemented enterprise data privacy procedure, by a particular category from said at least one category of data with a particular component of said multiple components of the data privacy regulation; and

wherein

the fourth and fifth program instructions are stored on the computer readable storage media.

17. A system comprising:

a processor, a computer readable memory, and a computer readable storage media;

first program instructions to receive a first set of binary data that describes a data privacy regulation, wherein the data privacy regulation describes regulatory restrictions on data being transmitted from a first geopolitical entity to a second geopolitical entity;

second program instructions to receive a second set of binary data that describes a set of categorized data, wherein the set of categorized data is created by an enterprise project, and wherein the data privacy regulation establishes limitations on a transmission of at least one category of data, from the set of categorized data, from the first geopolitical entity to the second geopolitical entity; and

third program instructions to process the first set of binary data and the second set of binary data to determine if transmission of said at least one category of data from the first geopolitical entity to the second geopolitical entity is regulated by the data privacy regulation; and

wherein

the first, second, and third program instructions are stored on the computer readable storage media for execution by the processor via the computer readable memory.

18. The system of claim 17, further comprising:

fourth program instructions to generate and display a recommended procedure to modify the enterprise project, wherein the recommended procedure, when implemented, brings the transmission of said at least one category of data from the first geopolitical entity to the second geopolitical entity into compliance with the data privacy regulation; and

wherein the fourth program instructions are stored on the computer readable storage media for execution by the processor via the computer readable memory.

19. The system of claim 17, wherein the first set of binary data describes multiple components of the data privacy regulation, and wherein the system further comprises:

fourth program instructions to identify a currently implemented enterprise data privacy procedure; and

fifth program instructions to generate and display a matrix of the set of categorized data, wherein the matrix is visually coded to indicate a level of compliance, due to the currently implemented enterprise data privacy procedure, by a particular category from said at least one category of data with a particular component of said multiple components of the data privacy regulation; and

wherein

the fourth and fifth program instructions are stored on the computer readable storage media for execution by the processor via the computer readable memory.

20. The system of claim 17, wherein said data privacy regulation regulates transmissions of personally identifiable information (PII), and wherein the system further comprises:

fourth program instructions to determine that said at least one category of data from the set of categorized data is PII according to a context of said at least one category of data from set of categorized data; and

wherein

the fourth program instructions are stored on the computer readable storage media for execution by the processor via the computer readable memory.