Consent receipt management systems and related methods

• US 10,678,945 B2
• Filed: 08/27/2019
• Issued: 06/09/2020
• Est. Priority Date: 06/10/2016
• Status: Active Grant

• Current Assignee: OneTrust LLC
• Original Assignee: OneTrust LLC
• Inventors: Barday, Kabir A., Brannon, Jonathan Blake, Sabourin, Jason L., Karanjkar, Mihir S., Jones, Kevin, Beaumont, Richard A.
• Primary Examiner(s): Deng, Anna C
• Application Number:
  US16/552,765
• Publication Number:
  US 20190392171A1
• Time in Patent Office: 287 Days
• Field of Search: 717101
• CPC Class Codes: G06F 16/2365 Ensuring data consistency and integrity
• CPC Class Codes: G06F 16/901 Indexing; Data structures therefor; Storage structures for retrieval from the web G06F16/951
• CPC Class Codes: G06F 16/904 Browsing; Visualisation therefor for navigating the web G06F16/954; browsing optimisation for the web G06F16/957
• CPC Class Codes: G06F 16/9558 Details of hyperlinks; Management of linked annotations
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes

Abstract

A consent receipt management system may, for example, be configured to track data on behalf of an entity that collects and/or processes persona data related to: (1) who consented to the processing or collection of personal data; (2) when the consent was given (e.g., a date and time); (3) what information was provided to the consenter at the time of consent (e.g., a privacy policy, what personal data would be collected following the provision of the consent, for what purpose that personal data would be collected, etc.); (4) how consent was received (e.g., one or more copies of a data capture form, webform, etc. via which consent was provided by the consenter); (5) when consent was withdrawn (e.g., a date and time of consent withdrawal if the consenter withdraws consent); and/or (6) any other suitable data related to receipt or withdrawal of consent.

Claims

1. A consent receipt management system comprising:

one or more processors; and

computer memory, wherein the consent receipt management system is configured to perform;

receiving, from a user interface, a request to initiate a transaction between an entity and a data subject, the transaction involving collection and processing of personal data associated with the data subject by the entity as part of a processing activity undertaken by the entity that the data subject is consenting to as part of the transaction, wherein the request comprises transaction definitions including a unique transaction identifier associated with the transaction, one or more links to a privacy policy associated with the transaction, and a listing of one or more data types for which consent to process will be provided;

in response to receiving the request;

identifying the unique transaction identifier from the request;

generating a unique consent receipt key for the transaction;

determining a unique subject identifier for the data subject; and

generating a piece of computer code associated with the transaction to place in a location at which consent from one or more data subjects will be requested as part of the transaction;

electronically storing the unique subject identifier, the unique consent receipt key, and the unique transaction identifier in computer memory, wherein the computer memory stores a plurality of consent records associated with the unique subject identifier, each of the plurality of consent records being associated with a respective transaction of a plurality of transactions involving the data subject and the entity;

electronically associating the unique subject identifier, the unique consent receipt key, and the unique transaction identifier;

generating a consent record for the transaction, the consent record comprising at least the unique subject identifier and the unique consent receipt key; and

electronically transmitting the consent record to the data subject.

2. The consent receipt management system of claim 1, wherein the consent receipt management system is further configured to perform:

providing a consent receipt management portal; and

displaying, to the data subject, via the consent receipt management portal, the plurality of consent records.

3. The consent receipt management system of claim 2, wherein the consent receipt management system is further configured to perform:

enabling the data subject to rescind, via the consent receipt management portal, a consent for the collection or processing of personal data associated with the data subject that the data subject has previously provided as part of a particular transaction of the plurality of transactions.

4. The consent receipt management system of claim 3, wherein the consent receipt management system is further configured to perform:

receiving an indication that a data system has collected, stored, or processed a new piece of personal data associated with the data subject;

determining, based on the plurality of consent records, whether the data subject has provided valid consent for the collection, storage, and processing of a type of the new piece of personal data for a purpose for which the new piece of personal data was collected, stored, or processed by the data system; and

in response to determining that the data subject has provided valid consent, generating an indication that the data subject has provided consent.

5. The consent receipt management system of claim 4, wherein the consent record comprises a hyperlink to the consent receipt management portal.

6. The consent receipt management system of claim 1, wherein the consent receipt management system is further configured to perform:

providing a user interface for creating a new transaction; and

receiving a request to create a new transaction.

7. The consent receipt management system of claim 1, wherein the transaction comprises a sign up, by the data subject, for a user account with the entity.

8. The consent receipt management system of claim 1, wherein the consent record further comprises a type of personal data that the data subject consented to the collection and processing of as part of the processing activity via the transaction.

9. A computer-implemented data processing method for managing a consent receipt under a transaction, the method comprising:

providing a user interface for initiating a transaction between an entity and a data subject;

receiving a request to initiate a transaction between the entity and the data subject from the user interface, the transaction involving collection and processing of personal data associated with the data subject by the entity as part of a processing activity undertaken by the entity that the data subject is consenting to as part of the transaction, wherein the request comprises transaction definitions including a unique transaction identifier associated with the transaction, one or more links to a privacy policy associated with the transaction, and a listing of one or more data types for which consent to process will be provided;

in response to the request;

identifying the unique transaction identifier from the request;

generating, by a third party consent receipt management system, a unique consent receipt key for the transaction;

receiving, from the data subject, a unique subject identifier; and

generating a piece of computer code associated with the transaction to place in a location at which consent from one or more data subjects will be requested as part of the transaction;

electronically storing the unique subject identifier, the unique consent receipt key, and the unique transaction identifier in computer memory, wherein the computer memory stores a plurality of consent records associated with the unique subject identifier, each of the plurality of consent records being associated with a respective transaction of a plurality of transactions involving the data subject and the entity;

electronically associating the unique subject identifier, the unique consent receipt key, and the unique transaction identifier;

in response to receiving the request, generating a consent receipt the consent receipt comprising at least the unique subject identifier and the unique consent receipt key; and

transmitting the consent receipt to the data subject.

10. The computer-implemented data processing method of claim 9, wherein:

the transaction comprises processing, by the entity, one or more pieces of personal data associated with the data subject; and

the user interface displays information identifying the one or more pieces of personal data.

11. The computer-implemented data processing method of claim 10, further comprising:

providing a consent receipt management portal; and

displaying, to the data subject, via the consent receipt management portal, each of one or more consent receipts provided by the data subject.

12. The computer-implemented data processing method of claim 10, wherein the consent receipt comprises a mechanism for the data subject to withdraw consent for the entity to process the one or more pieces of personal data.

13. The computer-implemented data processing method of claim 12, wherein the mechanism comprises a hyperlink in a consent receipt transmitted to the data subject.

14. The computer-implemented data processing method of claim 9, further comprising:

providing the user interface for creating a new transaction; and

receiving, from the user interface, a request to create a new transaction.

15. The computer-implemented data processing method of claim 14, wherein the definitions are further selected from the group consisting of:

an identity of one or more controllers of the entity that is engaging in the transaction with the data subject, one or more methods used to collect data for which consent to process will be provided, a description of a service provided as part of the transaction, one or more purposes of the processing, a jurisdiction associated with the transaction, and a legal basis for the collection of personal data as part of the transaction.

16. The computer-implemented data processing method of claim 9, further comprising:

receiving, at a third party data repository server, an indication that a piece of personal data has been processed for the data subject as part of the transaction;

in response to receiving the indication, electronically storing, on the third part data repository server;

a copy of the piece of personal data; and

the unique subject identifier; and

electronically associating the copy of the piece of personal data and the unique subject identifier on the third party data repository server.

17. A computer-implemented data processing method for managing a consent receipt under a transaction, the method comprising:

providing a user interface for initiating a transaction between an entity and a data subject;

receiving, from the user interface, a request to initiate a transaction between the entity and the data subject, the transaction involving collection and processing of personal data associated with the data subject by the entity as part of a processing activity undertaken by the entity that the data subject is consenting to as part of the transaction, wherein the request comprises transaction definitions including a unique transaction identifier associated with the transaction, one or more links to a privacy policy associated with the transaction, and a listing of one or more data types for which consent to process will be provided;

in response to the request;

initiating the transaction;

identifying the unique transaction identifier from the request;

generating, using one or more consent receipt generation means, a unique consent receipt key for the transaction;

receiving, from the data subject, a unique subject identifier; and

generating a piece of computer code associated with the transaction to place in a location at which consent from one or more data subjects will be requested as part of the transaction;

electronically storing the unique subject identifier, the unique consent receipt key, and the unique transaction identifier in a computer memory using one or more electronic storage means, wherein the computer memory stores a plurality of consent records associated with the unique subject identifier, each of the plurality of consent records being associated with a respective transaction of a plurality of transactions involving the data subject and the entity;

electronically associating the unique subject identifier, the unique consent receipt key, and the unique transaction identifier;

generating a consent receipt, the consent receipt comprising at least the unique subject identifier and the unique consent receipt key; and

transmitting the consent receipt to the data subject.

18. The computer-implemented data processing method of claim 17, further comprising:

providing a consent receipt management portal using one or more consent receipt portal provision means;

displaying, to the data subject, via the consent receipt management portal, each of one or more consent receipts provided by the data subject; and

providing one or more consent modification means via the consent receipt management portal.

19. The computer-implemented data processing method of claim 17, further comprising:

providing a user interface for creating a new transaction; and

receiving a request to create a new transaction.