Data processing systems for calculating and communicating cost of fulfilling data subject access requests and related methods

• US 10,430,740 B2
• Filed: 08/06/2018
• Issued: 10/01/2019
• Est. Priority Date: 06/10/2016
• Status: Active Grant

• Current Assignee: OneTrust LLC
• Original Assignee: One Trust LLC
• Inventors: Barday, Kabir A., Sabourin, Jason L., Brannon, Jonathan Blake, Karanjkar, Mihir S., Jones, Kevin
• Primary Examiner(s): Wu, Daxin
• Application Number:
  US16/055,984
• Publication Number:
  US 20180374030A1
• Time in Patent Office: 421 Days
• Field of Search: None
• CPC Class Codes: G06F 15/76 Architectures of general purpose stored program computers with program plugboard G06F15/08; multicomputers G06F15/16
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06Q 10/063118 Staff planning in a project environment
• CPC Class Codes: G06Q 10/06313 Resource planning in a project environment
• CPC Class Codes: G06Q 10/1091 Recording time for administrative or management purposes
• CPC Class Codes: G06Q 10/1097 Task assignment

Abstract

In various embodiments, fulfilling a data subject access request may be particularly costly. In some embodiments, a company may store data regarding a particular data subject in multiple different locations for a plurality of different reasons as part of a plurality of different processing and other business activities. For example, a particular data subject may be both a customer and an employee of a particular company or organization. Accordingly, in some embodiments, fulfilling a data subject access request for a particular data subject may involve a plurality of different information technology (IT) professionals in a plurality of different departments of a particular company or organization. As such, it may be useful to determine a cost of a particular data subject access request (e.g., particularly because, in some cases, a data subject is entitled to a response to their data subject access request as a matter of right at no charge).

Claims

1. A computer-implemented data processing method for responding to a data subject access request, the method comprising:

receiving, from a requestor on a remote computing device, a data subject access request that is a request for a particular organization to perform one or more actions with regard to one or more pieces of personal data the particular organization has obtained on the requestor, wherein the data subject access request comprises one or more request parameters;

assigning the data subject access request to at least one privacy team member;

identifying one or more information technology (IT) teams required to fulfill the data subject access request based at least in part on the one or more request parameters;

fulfilling the data subject access request by;

delegating one or more subtasks of the data subject access request to each of the one or more IT teams;

accessing a plurality of data models that comprise a respective data inventory for each of a plurality of data storage locations and map one or more relationships between one or more aspects of the data inventory and one or more data storage locations of the plurality of data storage locations;

identifying, based at least in part on one or more data model of the plurality of data models, one or more storage locations of the plurality of data storage locations that comprise each of the one or more pieces of personal data the particular organization has obtained on the requestor; and

retrieving each of the one or more pieces of personal data the particular organization has obtained on the requestor from the one or more storage locations of the plurality of data storage locations;

receiving one or more time logs from each individual involved in processing and fulfillment of the data subject access request, the one or more time logs comprising at least one time log from each of the one or more IT teams;

calculating a respective effective charge rate for each individual;

calculating an effective cost of fulfilling the data subject access request based at least in part on the one or more time logs and the effective charge rate;

applying an adjustment to the calculated effective cost that accounts for one or more external factors in order to calculate a total cost of fulfilling the data subject access request; and

digitally storing the total cost in computer memory.

2. The computer-implemented data processing method of claim 1, further comprising:

automatically determining time log data for each respective individual based at least in part on a respective open time and close time for a ticket assigned to each respective individual for the data subject access request.

3. The computer-implemented data processing method of claim 1, further comprising:

receiving a plurality of data subject access requests, each of the plurality of data subject access requests comprising one or more request parameters;

for each of the plurality of data subject access requests, determining an estimated total cost associated with fulfilling the data subject access request, comprising;

identifying one or more previously fulfilled data subject access request that are similar to the data subject access request based at least in part on a similarity between the one or more request parameters of the data subject access request and one or more request parameters of the previously fulfilled data subject access requests; and

calculating the estimated total cost associated with fulfilling the data subject access request based at least in part on the total cost for each of the identified one or more previously fulfilled data subject access requests; and

prioritizing the plurality of data subject access requests for fulfillment based at least in part on the estimated total cost associated with fulfilling each of the plurality of data subject access requests.

4. The computer-implemented data processing method of claim 3, wherein the plurality of data subject access requests is prioritized for fulfillment in order of lowest estimated total cost to highest estimated total cost.

5. The computer-implemented data processing method of claim 3, wherein the plurality of data subject access requests is prioritized for fulfillment in order of highest estimated total cost to lowest estimated total cost.

6. The computer-implemented data processing method of claim 3, wherein the one or more request parameters include one or more parameters selected from a group consisting of:

a requestor for the data subject access request; and

a type for the data subject access request.

7. The computer-implemented data processing method of claim 6, where one of the one or more request parameters of the data subject access request comprises a type of data subject access request, and wherein the type of data subject access request is selected from a group consisting of:

a subject'"'"'s rights request, and

a data subject deletion request.

8. The computer-implemented data processing method of claim 3, further comprising:

for each of the plurality of data subject access requests,

assigning the data subject access request to at least one privacy team member based at least in part on the estimated total cost of the data subject access request;

identifying one or more information technology (IT) teams required to fulfill the data subject access requests based at least in part on the one or more request parameters; and

delegating one or more subtasks of the data subject access request to each of the one or more IT teams for fulfilling the data subject access request.

9. The computer-implemented data processing method of claim 1, further comprising:

generating a data subject access request invoice for the total cost associated with the data subject access request; and

providing the data subject access request to one or more recipients selected from a group consisting of the requestor and a third party associated with the requestor.

10. The computer-implemented data processing method of claim 1, wherein the one or more external factors is an organization overhead adjustment that is applied as the adjustment to the calculated effective cost.