Data processing systems for fulfilling data subject access requests and related methods

• US 10,169,609 B1
• Filed: 08/03/2018
• Issued: 01/01/2019
• Est. Priority Date: 06/10/2016
• Status: Active Grant

• Current Assignee: OneTrust LLC
• Original Assignee: OneTrust LLC
• Inventors: Barday, Kabir A., Sabourin, Jason L., Brannon, Jonathan Blake, Karanjkar, Mihir S., Jones, Kevin
• Primary Examiner(s): Deng, Anna C
• Application Number:
  US16/054,672
• Publication Number:
  US 20180373889A1
• Time in Patent Office: 151 Days
• Field of Search: 717101
• CPC Class Codes: G06F 15/76 Architectures of general purpose stored program computers with program plugboard G06F15/08; multicomputers G06F15/16
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 2221/2103 Challenge-response
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06F 2221/2137 Time limited access, e.g. to a computer or data
• CPC Class Codes: H04L 41/5029 Service quality level-based billing, e.g. dependent on measured service level customer is charged more or less
• CPC Class Codes: H04L 41/5064 Customer relationship management
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/108 when the policy decisions are valid for a limited amount of time
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/53 using third party service providers

Abstract

Responding to a data subject access request includes receiving the request and validating an identity of the requestor. In response to validating the identity of the requestor, a computer processor determines whether the data subject access request is subject to fulfillment constraints. If so, then the computer processor notifies the requestor that the data subject access request is subject to one or more limitations and the computer processor takes action based on those limitations. Fulfillment constraint data is updated and maintained in a database or server.

Claims

1. A computer-implemented data processing method for responding to a data subject access request, the method comprising:

receiving, by one or more computer processors, a data subject access request from a requestor comprising one or more request parameters, wherein the one or more request parameters comprise one or more pieces of personal data associated with the requestor;

validating, by the one or more computer processors, an identity of the requestor based at least in part on the one or more request parameters;

in response to validating the identity of the requestor, determining, by the one or more computer processors, based on fulfillment constraint data, whether the data subject access request is subject to one or more response fulfillment constraints associated with the requestor, wherein determining whether the data subject access request is subject to one or more response fulfillment constraints comprises determining whether the data subject request comprises one of a threshold quantity of data subject access requests from the requestor within a threshold time period;

in response to determining that the data subject access request is subject to one or more response fulfillment constraints, notifying, by the one or more computer processors, the requestor that the data subject access request is subject to one or more limitations, and taking at least one action based on the data subject access request and the one or more limitations, wherein the at least one action comprises denying the data subject access request, or requesting one or more processing fees prior to fulfilling the request; and

in response to determining that the data subject access request is not subject to one or more response fulfillment constraints;

(1) identifying, by one or more computer processors, the one or more pieces of personal data associated with the requestor, the one or more pieces of personal data being stored in one or more data repositories associated with a particular organization, and

(2) data using the one or more pieces of personal data to fulfill the data subject access request; and

updating the fulfillment constraint data, in computer memory, to reflect that the data subject access request has been made.

2. The computer-implemented data processing method of claim 1, wherein the threshold time period comprises a single day.

3. The computer-implemented data processing method of claim 1, wherein determining whether the data subject access request is subject to one or more response fulfillment constraints comprises determining, by one or more computer processors, whether the requestor was previously and not currently employed by an entity receiving the data subject access request.

4. The computer-implemented data processing method of claim 1, wherein the one or more response fulfillment constraints are associated with a source of the data subject access request.

5. The computer-implemented data processing method of claim 4, wherein the source is selected from the group consisting of:

a particular IP address; and

a particular domain.

6. The computer-implemented data processing method of claim 5, wherein the source is selected from the group consisting of:

a particular IP address associated with a competitor; and

a particular domain associated with a competitor.

7. The computer-implemented data processing method of claim 5, wherein the source is selected from the group consisting of:

a particular IP address or a particular domain associated with a particular geographic region;

a particular IP address or a particular domain associated with a particular political group; and

a particular IP address or a particular domain associated with a particular protesting group.

8. The computer-implemented data processing method of claim 1, wherein determining whether the one or more limitations comprise denying the data subject access request or requesting one or more processing fees prior to fulfilling the request comprises analyzing, by one or more computer processors, a customer history associated with the requestor.

9. The computer-implemented data processing method of claim 8, wherein the customer history associated with the requestor comprises one or more spending characteristics of the requestor.

10. The computer-implemented data processing method of claim 9, wherein if the one or more spending characteristics comprise an amount spent over a reference time period that exceeds a spending threshold, then the one or more limitations comprise requesting, by one or more computer processors, one or more processing fees prior to fulfilling the data subject access request.

11. The computer-implemented data processing method of claim 9, wherein if the one or more spending characteristics comprise an amount spent over a reference time period that does not exceed a spending threshold, then the one or more limitations comprise denying, by one or more computer processors, the data subject access request.

12. The computer-implemented data processing method of claim 1, wherein determining whether the one or more limitations comprise denying the data subject access request or requesting one or more processing fees prior to fulfilling the request comprises analyzing, by one or more computer processors, a complaint history associated with the requestor.

13. The computer-implemented data processing method of claim 1, wherein notifying the requestor that the data subject access request is subject to one or more limitations comprises:

providing, by one or more computer processors, the requestor with a reason for the one or more limitations;

informing, by one or more computer processors, the requestor of their right to communicate with a supervisory authority regarding the one or more limitations; and

informing, by one or more computer processors, the requestor of their right to judicial remedy without delay.

14. The computer-implemented data processing method of claim 13, further comprising identifying or storing, by one or more computer processors, documentation supporting the reason for the one or more limitations.

15. The computer-implemented data processing method of claim 1, wherein the one or more data repositories storing the one or more pieces of personal data associated with the particular organization comprises a third party repository server associated with and accessible by a plurality of organizations.

16. A computer-implemented data processing method for responding to a data subject access request, the method comprising:

storing, by one or more computer processors, fulfillment constraint data in one or more databases or servers, the fulfillment constraint data corresponding to a plurality of data subject access requests from a plurality of requestors;

receiving, by the one or more computer processors, a particular data subject access request from a particular one of the requestors, the particular data subject access request comprising one or more request parameters, wherein the one or more request parameters comprise one or more pieces of personal data associated with the particular requestor;

retrieving, by the one or more computer processors, fulfillment constraint data associated with the data subject access request from the one or more databases or servers based on the one or more request parameters, wherein the fulfillment constraint data associated the data subject access request comprises at least one of;

a quantity of data subject access requests associated with the requestor within a threshold time period, a threshold quantity of data subject access requests within the threshold period of time, or a determination as to whether the quantity of data subject access requests associated with the requestor within the threshold period of time exceeds the threshold quantity of data subject access requests;

taking, by the one or more computer processors, one or more actions based at least in part on the data subject access request and the fulfillment constraint data, the one or more actions being related to the one or more pieces of personal data associated with the requestor, wherein the one or more actions comprises denying the data subject access request or requesting one or more processing fees prior to fulfilling the request based at least in part on the data subject access request; and

updating, by the one or more computer processors, the fulfillment constraint data in one or more databases or servers to store information associated with the data subject access request received from the requestor.

17. The computer-implemented data processing method of claim 16, wherein the fulfillment constraint data comprises data identifying the requestor as a previous and not current employee of an entity receiving the data subject access request.

18. The computer-implemented data processing method of claim 16, wherein the fulfillment constraint data comprises a source of the data subject access request.

19. The computer-implemented data processing method of claim 16, wherein the one or more databases or servers comprises a third party repository server associated with and accessible by a plurality of organizations.

20. The computer-implemented data processing method of claim 16, wherein the one or more actions comprise denying, by the one or more processors, the data subject access request.

21. The computer-implemented data processing method of claim 16, wherein the one or more actions comprise requesting, by the one or more processors, one or more processing fees prior to fulfilling the request based at least in part on the data subject access request.

22. A computer-implemented data processing method for responding to a data subject access request, the method comprising:

receiving, by one or more computer processors, a data subject access request from a requestor, the request comprising one or more request parameters, wherein the one or more request parameters comprise one or more pieces of personal data associated with the requestor;

validating, by the one or more computer processors, an identity of the requestor based at least in part on the one or more request parameters;

in response to validating the identity of the requestor, retrieving, by the one or more computer processors, fulfillment constraint data associated with the data subject access request from a third party repository server storing information regarding a plurality of data subject access requests from a plurality of requestors and a plurality of data subject access request sources, wherein the fulfillment constraint data comprises at least one of;

a quantity of data subject access requests associated with the requestor within a threshold time period, a threshold quantity of data subject access requests within the threshold period of time, or a determination as to whether the quantity of data subject access requests associated with the requestor within the threshold period of time exceeds the threshold quantity of data subject access requests;

determining, by the one or more computer processors, that the data subject access request is subject to one or more response fulfillment constraints based on the fulfillment constraint data;

in response to determining that the data subject access request is subject to one or more response fulfillment constraints based on the fulfillment constraint data;

(1) notifying, by the one or more computer processors, the requestor that the data subject access request is subject to one or more limitations; and

(2) denying, by the one or more computer processors, the data subject access request or requesting one or more processing fees prior to fulfilling the request by taking one or more actions based at least in part on the data subject access request.

23. The computer-implemented data processing method of claim 22, further comprising identifying or storing, by one or more computer processors, documentation supporting the reason for the one or more limitations.

24. The computer-implemented data processing method of claim 22, wherein the one or more response fulfillment constraints are associated with a source of the data subject access request.

25. The computer-implemented data processing method of claim 22, wherein the method comprises denying, by the one or more processors, the data subject access request.

26. The computer-implemented data processing method of claim 22, wherein the method comprises requesting one or more processing fees prior to fulfilling the request by taking one or more actions based at least in part on the data subject access request.

27. The computer-implemented data processing method of claim 26, wherein the step of taking one or more actions based at least in part on the data subject access request comprises deleting stored personal data of a data subject associated with the data subject access request.