Data processing systems and methods for performing privacy assessments and monitoring of new versions of computer code for privacy compliance

• US 9,729,583 B1
• Filed: 09/01/2016
• Issued: 08/08/2017
• Est. Priority Date: 06/10/2016
• Status: Active Grant

• Current Assignee: OneTrust LLC
• Original Assignee: OneTrust LLC
• Inventors: Barday, Kabir A.
• Primary Examiner(s): Hailu, Teshome
• Application Number:
  US15/254,901
• Time in Patent Office: 341 Days
• Field of Search: 726 26
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Data processing systems and methods, according to various embodiments, perform privacy assessments and monitor new versions of computer code for updated features and conditions that relate to compliance with privacy standards. The systems and methods may obtain a copy of computer code (e.g., a software application or a website) that collects and/or uses personal data, and then automatically analyzes the computer code to identify one or more privacy-related attributes that may impact privacy assessment standards. In various embodiments, the system is adapted to monitor one or more locations (e.g., an online software application marketplace, and/or a specified website) to determine whether the application or website has changed. The system may, after analyzing the computer code, display the privacy-related attributes, collect information regarding the attributes, and automatically notify one or more designated individuals (e.g., privacy office representatives) regarding the attributes and information collected.

Claims

1. A computer system for electronically performing one or more privacy assessments of computer code, the computer system comprising:

at least one processor; and

memory;

wherein the computer system is configured for;

displaying an instruction for a particular user to provide a location of the computer code;

electronically obtaining the computer code based on the location provided by the particular user;

automatically electronically analyzing the computer code to determine one or more privacy-related attributes of the computer code, each of the privacy-related attributes indicating one or more types of personal information that the computer code collects or accesses; and

in response to determining that the computer code has a particular one of the one or more privacy-related attributes;

(A) executing the steps of;

(i) electronically displaying one or more prompts to a first individual requesting that the first individual input information regarding the particular privacy-related attribute;

(ii) receiving input information from the first individual regarding the particular privacy-related attribute; and

(iii) communicating the information regarding the particular privacy-related attribute to one or more second individuals for use in conducting a privacy assessment of the computer code;

(B) changing an indicator associated with the code to indicate that, before the code is launched, the particular attribute should be reviewed by one or more designated individuals; and

(C) changing an indicator associated with the code to indicate that, before the code is launched, the code should be modified to not include the particular attribute.

2. The computer system of claim 1, wherein a particular one of the one or more privacy-related related attributes is that the computer code collects information regarding the location of users of the computer code.

3. The computer system of claim 1, wherein a particular one of the one or more privacy-related related attributes is that the computer code collects information regarding the web browsing habits of users of the computer code.

4. The computer system of claim 1, wherein the particular user and the first individual are the same person.

5. The computer system of claim 4, wherein the first individual is a software developer and the one or more second individuals is a privacy officer.

6. The computer system of claim 1, wherein the computer code is code associated with a website, and the location is a URL of the website.

7. The computer system of claim 1, wherein the computer code is a software application and the location indicates where the software application is stored in computer memory.

8. The computer system of claim 1, wherein at least one of the one or more prompts asks the first individual the reason for including at least one of the one or more privacy-related attributes of the code.

9. The computer system of claim 1, wherein at least one of the one or more prompts asks whether at least one of the one or more privacy-related attributes of the code could be omitted.

10. A computer-implemented data processing method for electronically performing one or more privacy assessments of computer code, the method comprising:

displaying, on a graphical user interface, an instruction for a particular individual to provide the location of computer code;

electronically obtaining the computer code based on the location provided by the particular individual;

automatically electronically analyzing the computer code to determine whether the computer code has any one of a specified plurality of privacy-related attributes; and

in response to determining that the computer code has a particular one of the plurality of privacy-related attributes;

(A) executing the steps of;

(i) electronically displaying one or more prompts to a user requesting that the user input information regarding the particular privacy-related attribute;

(ii) receiving input information from the user regarding the particular privacy-related attribute; and

(iii) communicating the input information to a second user for use in a privacy assessment of the computer code;

(B) changing an indicator associated with the code to indicate that, before the code is launched, the attribute should be reviewed by one or more designated individuals; and

(C) changing an indicator associated with the code to indicate that, before the code is launched, the code should be modified to not include the attribute.

11. The computer-implemented data processing method of claim 10, further comprising, in response to determining that the computer code does not have any one of the specified plurality of privacy-related attributes, communicating this fact to a user for use in the context of a privacy assessment of the computer code.

12. The computer-implemented data processing method of claim 10, wherein at least one of the specified plurality of privacy-related attributes is that the computer code collects sensitive personal information from users of the computer code.

13. The computer-implemented data processing method of claim 10, wherein at least one of the specified plurality of privacy-related attributes is that the computer code collects information regarding the web browsing habits of users of the computer code.

14. The computer-implemented data processing method of claim 10, wherein the particular user and the first individual are the same person.

15. The computer-implemented data processing method of claim 10, wherein the first individual is a software developer and the one or more second individuals is a privacy officer.

16. The computer-implemented data processing method of claim 10, wherein the computer code is code associated with a website, and the location is a URL of the website.

17. The computer-implemented data processing method of claim 10, wherein the computer code is a software application and the location indicates where the software application is stored in computer memory.

18. The computer-implemented data processing method of claim 10, wherein at least one of the one or more prompts asks the first individual the reason for including at least one of the one or more privacy-related attributes of the code.

19. The computer-implemented data processing method of claim 10, wherein at least one of the one or more prompts asks whether at least one of the one or more privacy-related attributes of the code could be omitted.