Data processing systems for webform crawling to map processing activities and related methods

• US 10,452,864 B2
• Filed: 05/10/2019
• Issued: 10/22/2019
• Est. Priority Date: 06/10/2016
• Status: Active Grant

• Current Assignee: OneTrust LLC
• Original Assignee: OneTrust LLC
• Inventors: Barday, Kabir A., Karanjkar, Mihir S., Finch, Steven W., Browne, Ken A., Heard, Nathan W., Patel, Aakash H., Sabourin, Jason L., Daniel, Richard L., Patton-Kuhl, Dylan D., Jones, Kevin, Brannon, Jonathan Blake
• Primary Examiner(s): Deng, Anna C
• Application Number:
  US16/409,673
• Publication Number:
  US 20190266348A1
• Time in Patent Office: 165 Days
• Field of Search: 717101
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: G06F 16/955 using information identifiers, e.g. uniform resource locators [URL]
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 40/174 Form filling; Merging
• CPC Class Codes: G06F 40/186 Templates

Abstract

In particular embodiments, a Data Access Webform Crawling System is configured to: (1) identify a webform used to collect one or more pieces of personal data; (2) robotically complete the identified webform; (3) analyze the completed webform to determine one or more processing activities that utilize the one or more pieces of personal data collected by the webform; (4) identify a first data asset in the data model that is associated with the one or more processing activities; (5) modify a data inventory for the first data asset in the data model to include data associated with the webform; and (6) modify the data model to include the modified data inventory for the first data asset.

Claims

1. A computer-implemented data processing method for modifying a data model based on one or more pieces of personal data submitted via a webform used to collect one or more pieces of personal data, the method comprising:

identifying the webform by one or more computer processors;

robotically, by the one or more processors, populating the identified webform with virtual profile data;

after robotically populating the identified webform, determining, by the one or more processors, a storage location of the virtual profile data received via the webform, the storage location being a storage location of a first data asset in the data model that is associated with one or more processing activities;

identifying, by the one or more processors, a first data inventory from a plurality of data inventories, each of the plurality of data inventories being associated with a respective data asset, wherein the first data inventory is associated with the first data inventory and comprises a plurality of fields that each define a respective inventory attribute for the first data asset;

modifying, by the one or more processors, the first data inventory for the first data asset in the data model, wherein modifying the first data inventory comprises;

determining, for each respective one of the plurality of fields of the first data inventory, whether the respective field is an unpopulated inventory attribute field not containing an attribute value for one of the plurality of inventory attributes,

determining one or more attribute values for each of the one or more unpopulated inventory attribute fields based at least in part on the one or more pieces of personal data collected by the webform, and

modifying the first data inventory to include an indication that the one or more processing activities utilize at least one piece of the virtual profile data by modifying the first data inventory to include the one or more attribute values for each of the one or more unpopulated inventory attributes fields by populating each of the plurality of unpopulated inventory attribute fields with a respective one of the one or more attribute values; and

modifying the data model to include the modified first data inventory by mapping the first data asset to the one or more processing activities that utilize the at least one piece of the virtual profile data.

2. The computer-implemented data processing method of claim 1, wherein identifying the webform used to collect the one or more pieces of personal data comprises using, by one or more processors, one or more website scanning tools to identify the webform by scanning a plurality of websites associated with an entity.

3. The computer-implemented data processing method of claim 2, wherein the webform is hosted on a particular website of the plurality of websites.

4. The computer-implemented data processing method of claim 3, wherein the webform comprises a contact form.

5. The computer-implemented data processing method of claim 1, wherein:

the virtual profile data comprises an e-mail address; and

the method further comprises monitoring an e-mail account associated with the e-mail address for a confirmation e-mail related to the completion of the identified webform.

6. The computer-implemented data processing method of claim 5, the method further comprising scraping, by one or more processors, the confirmation e-mail for data associated with the webform.

7. The computer-implemented data processing method of claim 1, the method further comprising adding, by one or more processors, the first data asset to a third-party data repository with an electronic link to the webform.

8. A data processing data inventory population system comprising:

one or more computer processors;

computer memory; and

a computer-readable medium storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising;

accessing a data model of a plurality of data assets used in a collection or a storage of personal data, the data model;

(a) defining one or more electronic links between the plurality of data assets, and (b) storing a plurality of data inventories that define a plurality of inventory attributes for each of the plurality of data assets;

identifying a first data inventory from the plurality of data inventories, each of the plurality of data inventories being associated with a respective data asset, wherein the first data inventory comprises a plurality of fields that each define a respective inventory attribute for a first data asset associated with the first data inventory;

determining, for each respective one of the plurality of fields of the first data inventory, whether the respective field is a populated inventory attribute field containing an attribute value for one of the plurality of inventory attributes, or an unpopulated inventory attribute field not containing an attribute value for one of the plurality of inventory attributes;

determining, for each respective one of the one or more unpopulated inventory attribute fields of the first data inventory, one or more attribute values for use in populating the respective unpopulated inventory attribute field of the first data inventory by;

identifying a webform used to collect one or more pieces of personal data;

robotically populating the identified webform;

analyzing the populated webform to determine one or more processing activities that utilize the one or more pieces of personal data collected by the webform;

determining that the first data asset is associated with the one or more processing activities; and

determining a respective attribute value for each of the one or more unpopulated inventory attribute fields of the first data inventory based at least in part on the one or more pieces of personal data collected by the webform;

in response to determining the one or more attribute values for each of the one or more unpopulated inventory attribute fields of the first data inventory, modifying the first data inventory to include the one or more attribute values for each of the one or more unpopulated inventory attributes fields by populating each of the plurality of unpopulated inventory attribute fields with a respective one of the one or more attribute values; and

storing the modified first data inventory in computer memory.

9. The data processing data inventory population system of claim 8, wherein robotically completing the identified webform comprises populating the identified webform with the virtual profile data.

10. The data processing data inventory population system of claim 9, wherein determining that the first data asset is associated with the one or more processing activities comprises discovering at least one piece of the virtual profile data stored on the first data asset.

11. The data processing data inventory population system of claim 8, wherein analyzing the webform to determine the one or more processing activities that utilize the one or more pieces of personal data collected by the webform comprises analyzing one or more pieces of computer code associated with the webform after the webform has been robotically populated.

12. The data processing data inventory population system of claim 8, wherein the computer-readable medium further stores computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising electronically mapping the first data asset to the one or more processing activities that utilize the one or more pieces of personal data collected by the webform.

13. The data processing data inventory population system of claim 12, wherein modifying the first data inventory comprises modifying the first data inventory to include an indication that the one or more processing activities operate with data stored by the first data asset.

14. A computer-implemented data processing method for modifying a data model based on one or more pieces of personal data submitted via a webform, the method comprising:

accessing, by one or more computer processors, the data model of a plurality of data assets used in a collection or a storage of personal data, the data model defining one or more electronic links between the plurality of data assets and storing a plurality of data inventories that define a plurality of inventory attributes for each of the plurality of data assets;

identifying, by the one or more processors, a first data inventory from the plurality of data inventories, each of the plurality of data inventories being associated with a respective data asset of the plurality of data assets, wherein the first data inventory comprises a plurality of fields that each define a respective inventory attribute for a first data asset associated with the first data inventory;

determining, by the one or more processors, for each respective one of the plurality of fields of the first data inventory, whether the respective field is a populated inventory attribute field containing an attribute value for one of the plurality of inventory attributes, or an unpopulated inventory attribute field not containing an attribute value for one of the plurality of inventory attributes;

determining, by the one or more processors, for each respective one of the one or more unpopulated inventory attribute fields of the first data inventory, one or more attribute values for use in populating the respective unpopulated inventory attribute field of the first data inventory by;

identifying the webform used to collect the one or more pieces of personal data;

robotically completing the identified webform;

analyzing the completed webform to determine one or more processing activities that utilize the one or more pieces of personal data collected by the webform;

identifying the first data asset, in the data model, the first data asset being associated with the one or more processing activities;

modifying the first data inventory for the first data asset in the data model to include data associated with the webform; and

determining one or more attribute values for each of the one or more unpopulated inventory attribute fields of the first data inventory based at least in part on the one or more pieces of personal data collected by the webform;

in response to determining the one or more attribute values for each of the one or more unpopulated inventory attribute fields of the first data inventory, modifying the first data inventory to include the one or more attribute values for each of the one or more unpopulated inventory attributes fields by populating each of the plurality of unpopulated inventory attribute fields with a respective one of the one or more attribute values; and

modifying the data model to include the modified first data inventory for the first data asset.

15. The computer-implemented data processing method of claim 14, wherein:

analyzing the completed webform to determine the one or more processing activities that utilize the one or more pieces of personal data collected by the webform comprises analyzing one or more pieces of computer code associated with the webform.

16. The computer-implemented data processing method of claim 15, wherein analyzing the one or more pieces of computer code associated with the webform comprises analyzing the one or more pieces of computer code to identify a storage location to which the one or more pieces of personal data collected by the webform are routed.

17. The computer-implemented data processing method of claim 16, wherein analyzing the one or more pieces of computer code associated with the webform comprises analyzing the one or more pieces of computer code to identify the first data asset based on the storage location.

18. The computer-implemented data processing method of claim 15, wherein modifying the data model to include the modified data inventory for the first data asset comprises mapping the first data asset to the one or more processing activities that utilize the one more pieces of personal data based at least in part on the analysis of the computer code associated with the webform.

19. The computer-implemented data processing method of claim 14, wherein:

robotically completing the identified webform comprises robotically completing the identified webform using a virtual profile comprising an e-mail address.

20. The computer-implemented data processing method of claim 19, wherein identifying the first data asset in the data model that is associated with the one or more processing activities comprises discovering the e-mail address stored on the first data asset.