Data processing systems for measuring privacy maturity within an organization

• US 10,586,072 B2
• Filed: 10/14/2019
• Issued: 03/10/2020
• Est. Priority Date: 06/10/2016
• Status: Active Grant

• Current Assignee: OneTrust LLC
• Original Assignee: OneTrust LLC
• Inventors: Barday, Kabir A., Brannon, Jonathan Blake
• Primary Examiner(s): Lynch, Sharon S
• Application Number:
  US16/600,879
• Publication Number:
  US 20200042740A1
• Time in Patent Office: 148 Days
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 3/04842 Selection of displayed objects or displayed text elements G06F3/0482 takes precedence
• CPC Class Codes: G06Q 50/01 Social networking
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]

Abstract

A privacy compliance measurement system, according to particular embodiments, is configured to determine compliance with one or more privacy compliance requirements by an organization or sub-group of the organization. In various embodiments, the system is configured to determine a privacy maturity rating for each of a plurality of sub-groups within an organization. In some embodiments, the privacy maturity rating is based at least in part on: (1) a frequency of risks or issues identified with Privacy Impact Assessments (PIAs) performed or completed by the one or sub-groups; (2) a relative training level of members of the sub-groups with regard to privacy related matters; (3) a breadth and amount of personal data collected by the sub-groups; and/or (4) etc. In various embodiments, the system is configured to automatically modify one or more privacy campaigns based on the determined privacy maturity ratings.

Claims

1. A computer-implemented data processing method for measuring compliance of a particular organization with one or more requirements associated with one or more pieces of computer code originating from the particular organization, the method comprising:

electronically obtaining, by one or more processors, each of the one or more pieces of computer code from one or more websites associated with the particular organization;

automatically electronically analyzing each of the one or more pieces of computer code to determine one or more privacy-related attributes of each of the one or more pieces of computer code, each of the privacy-related attributes indicating one or more types of personal data collected or accessed by the computer code;

in response to determining that the computer code has a particular attribute of the one or more privacy-related attributes, executing the steps of (i) electronically displaying one or more prompts to a first individual associated with the organization requesting that the first individual input additional information describing the particular privacy-related attribute;

(ii) receiving the additional information describing the particular privacy-related attribute from the first individual; and

(iii) communicating the additional information describing the particular privacy-related attribute to one or more second individuals associated with the organization for use in conducting a privacy assessment of the computer code;

scanning one or more publicly-available data sources for one or more pieces of credit data corresponding to the particular organization, one or more social networking websites associated with the particular organization and one or more privacy notices for the particular organization comprising one or more privacy disclaimers corresponding to the one or more websites, wherein the one or more pieces of credit data are obtained from accessing one or more credit bureau databases;

calculating, by one or more processors, based at least in part on the one or more types of personal data collected or accessed by the computer code, the one or more pieces of credit data, one or more social networking websites and the one or more privacy notices, a privacy maturity score for the particular organization indicating compliance of the organization with one or more privacy-related requirements; and

displaying, by one or more processors, the privacy maturity score for the particular organization on a display screen associated with a computing device.

2. The computer-implemented data processing method of claim 1, further comprising:

analyzing a website of the one or more websites associated with the particular organization to identify the one or more privacy notices;

analyzing one or more contents of the one or more privacy notices; and

electronically calculating the privacy maturity score based, at least in part, on the one or more contents of the one or more privacy notices.

3. The computer-implemented data processing method of claim 1, further comprising:

analyzing the one or more websites associated with the particular organization;

identifying one or more industry certifications associated with the particular organization based on the analysis of the one or more websites; and

electronically calculating the privacy maturity score by electronically calculating the privacy maturity score based, at least in part, on the identification of the one or more industry certifications.

4. The computer-implemented data processing method of claim 1, further comprising:

analyzing one or more public record databases associated with the particular organization;

identifying one or more industry certifications associated with the particular organization from the one or more public record databases; and

electronically calculating the privacy maturity score by electronically calculating the privacy maturity score based, at least in part, on the identification of the one or more industry certifications.

5. The computer-implemented data processing method of claim 1, further comprising:

determining one or more respective job titles of one or more employees of the particular organization; and

calculating the privacy maturity score based, at least in part, on the one or more respective job titles of the one or more employees of the particular organization.

6. The computer-implemented data processing method of claim 1 further comprising:

receiving one or more privacy impact assessments associated with each of the one or more pieces of computer code;

wherein determining the privacy maturity score for the particular organization comprises determining the privacy maturity score based at least in part on the one or more privacy impact assessments.

7. The computer-implemented data processing method of claim 6, wherein the one or more privacy impact assessments are one or more privacy impact assessments performed prior to execution of the one or more pieces of computer code as part of a privacy campaign.

8. A non-transitory computer-readable medium storing computer-executable instructions for determining a privacy maturity of a plurality of individuals associated with an organization, the non-transitory computer-readable medium storing computer-executable instructions for:

electronically obtaining, by one or more processors, one or more pieces of computer code from one or more websites associated with the plurality of individuals;

automatically electronically analyzing each of the one or more pieces of computer code to determine one or more privacy-related attributes of each of the one or more pieces of computer code, each of the privacy-related attributes indicating one or more types of personal data collected or accessed by the computer code;

in response to determining that the computer code has a particular attribute of the one or more privacy-related attributes, executing the steps of (i) electronically displaying one or more prompts to a first individual of the plurality of individuals requesting that the first individual input additional information describing the particular privacy-related attribute;

(ii) receiving the additional information describing the particular privacy-related attribute from the first individual; and

(iii) communicating the additional information describing the particular privacy-related attribute to one or more second individuals of the plurality of individuals for use in conducting a privacy assessment of the computer code;

analyzing, by one or more processors, for at least one of the plurality of individuals, pieces of publicly available data associated with the at least one of the plurality of individuals, the pieces of publicly available data comprising one or more public record databases comprising one or more social network websites, one or more pieces of credit data corresponding to an organization to which the plurality of individuals belong, and one or more privacy notices for the particular organization comprising one or more privacy disclaimers corresponding to the one or more websites associated with the plurality of individuals, wherein the one or more pieces of credit data are obtained from accessing one or more credit bureau databases;

calculating, by one or more processors, based at least in part on the one or more types of personal data collected or accessed by the computer code and the pieces of publicly available data comprising the one or more pieces of credit data and the one or more privacy notices, a privacy maturity score for the plurality of individuals indicating compliance of the plurality of individuals with one or more privacy-related requirements; and

displaying, by one or more processors, the privacy maturity score for the plurality of individuals on a display screen associated with a computing device.

9. The non-transitory computer-readable medium of claim 8, wherein the one or more websites associated the plurality of individuals comprise one or more websites that host the one or more pieces of computer code.

10. The non-transitory computer-readable medium of claim 8, wherein

the one or more privacy disclaimers associated with the one or more pieces of computer code comprise one or more privacy disclaimers associated with one or more software applications published by the plurality of individuals that are available to one or more customers of the plurality of individuals.

11. The non-transitory computer-readable medium of claim 8, wherein analyzing the one or more privacy disclaimers further comprises:

analyzing one or more contents of the one or more privacy disclaimers; and

calculating the privacy maturity score based at least in part on the one or more contents of the one or more privacy disclaimers.

12. The non-transitory computer-readable medium of claim 11, wherein the non-transitory computer-readable medium further stores computer-executable instructions for:

determining whether the one or more contents of the one or more privacy disclaimers comprise one or more pieces of language required by one or more regulations;

in response to determining that the one or more contents of the one or more privacy disclaimers comprise the one or more pieces of language, calculating a first privacy awareness score; and

in response to determining that that the one or more contents of the one or more privacy disclaimers do not comprise the one or more pieces of language, calculating a second privacy awareness score.

13. The non-transitory computer-readable medium of claim 8, wherein:

the pieces of publicly available data comprise one or more security certifications associated with the plurality of individuals;

the non-transitory computer-readable medium further stores computer-executable instructions for;

determining whether the at least one of the plurality of individuals holds a particular security certification based on the pieces of publicly available data; and

calculating the privacy maturity score based on whether the at least one of the plurality of individuals holds the particular security certification.

14. The non-transitory computer-readable medium of claim 8, wherein the non-transitory computer-readable medium further stores computer-executable instructions for:

analyzing a website associated with the one or more pieces of computer code to identify the one or more privacy notices;

analyzing one or more contents of the one or more privacy notices; and

determining the privacy maturity score by electronically calculating the privacy maturity score based, at least in part, on the one or more contents of the one or more privacy notices.

15. A data processing system for determining a privacy maturity of a plurality of individuals, the system comprising:

one or more computer processors;

computer memory operatively coupled to the computer processor, wherein the data processing system comprises;

means for electronically obtaining one or more pieces of computer code from the one or more websites associated with the plurality of individuals;

means for automatically electronically analyzing each of the one or more pieces of computer code to determine one or more privacy-related attributes of each of the one or more pieces of computer code, each of the privacy-related attributes indicating one or more types of personal data collected or accessed by the computer code;

means for, in response to determining that the computer code has a particular attribute of the one or more privacy-related attributes, executing the steps of (i) electronically displaying one or more prompts to a first individual of the plurality of individuals requesting that the first individual input additional information describing the particular privacy-related attribute;

(ii) receiving the additional information describing the particular privacy-related attribute from the first individual; and

(iii) communicating the additional information describing the particular privacy-related attribute to one or more second individuals of the plurality of individuals for use in conducting a privacy assessment of the computer code;

means for analyzing, for at least one of the plurality of individuals, pieces of publicly available data associated with the at least one of the plurality of individuals, the pieces of publicly available data comprising one or more public record databases comprising one or more social network websites, one or more pieces of credit data corresponding to an organization to which the plurality of individuals belong, and one or more privacy notices for the particular organization comprising one or more privacy disclaimers corresponding to the one or more websites associated with the plurality of individuals, wherein the one or more pieces of credit data are obtained from accessing one or more credit bureau databases;

means for calculating, based at least in part on the one or more types of personal data collected or accessed by the computer code and the pieces of publicly available data comprising the one or more pieces of credit data and the one or more privacy notices, a privacy maturity score for the plurality of individuals indicating compliance of the plurality of individuals with one or more privacy-related requirements; and

means for displaying the privacy maturity score for the plurality of individuals on a display screen associated with a computing device.