Data processing systems for prioritizing data subject access requests for fulfillment and related methods

• US 10,706,174 B2
• Filed: 09/16/2019
• Issued: 07/07/2020
• Est. Priority Date: 06/10/2016
• Status: Active Grant

• Current Assignee: OneTrust LLC
• Original Assignee: OneTrust LLC
• Inventors: Barday, Kabir A., Sabourin, Jason L., Brannon, Jonathan Blake, Karanjkar, Mihir S., Jones, Kevin
• Primary Examiner(s): Khong, Alexander
• Application Number:
  US16/572,182
• Publication Number:
  US 20200012813A1
• Time in Patent Office: 295 Days
• CPC Class Codes: G06F 15/76 Architectures of general purpose stored program computers with program plugboard G06F15/08; multicomputers G06F15/16
• CPC Class Codes: G06F 16/587 using geographical or spatial information, e.g. location
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06F 9/4881 Scheduling strategies for dispatcher, e.g. round robin, multi-level priority queues

Abstract

In various embodiments, a data subject request fulfillment system may be adapted to prioritize the processing of data subject access requests based on metadata of the data subject access request. For example, the system may be adapted for: (1) in response to receiving a data subject access request, obtaining metadata regarding the location from which the data subject access request is being made; (2) using the metadata to determine whether a priority of the data subject access request should be adjusted based on the obtained metadata; and (3) in response to determining that the priority of the data subject access request should be adjusted based on the obtained metadata, adjusting the priority of the data subject access request.

Claims

1. A computer-implemented data processing method for prioritizing data subject access requests, the method comprising:

receiving from a requestor, by one or more processors, a data subject access request comprising one or more request parameters;

applying, by the one or more processors, a prioritization level to the data subject access request based at least in part on the one or more request parameters;

determining, by the one or more processors, one or more pieces of metadata associated with the data subject access request;

determining, by the one or more processors based on the one or more pieces of metadata, a location from which the data subject access request is being made;

determining, by the one or more processors, whether the location from which the data subject access request is being made relates to a priority of fulfilling the data subject access request;

in response to determining that the location from which the data subject access request is being made relates to the priority of fulfilling the data subject access request, analyzing, by the one or more processors, the location from which the data subject access request is being made to determine whether the prioritization level of the data subject access request should be adjusted;

in response to determining that the prioritization level of the data subject access request should be adjusted based on the location from which the data subject access request is being made, adjusting, by the one or more processors, the prioritization level of the data subject access request for fulfillment of the data subject access request, wherein adjusting the prioritization level of the data subject access request comprises;

modifying a completion date for fulfillment of the data subject access request based on the adjusted prioritization level of the data subject access request, and

updating a prioritization indicator associated with the data subject access request to indicate that the prioritization level of the data subject access request has been adjusted; and

digitally storing, by the one or more processors, the adjusted prioritization level of the data subject access request in computer memory.

2. The computer-implemented data processing method of claim 1, wherein determining the location from which the data subject access request is being made comprises:

determining an IP address based, at least in part, on the one or more pieces of metadata; and

determining the location from which the data subject access request is being made based, at least in part, on the IP address.

3. The computer-implemented data processing method of claim 1, further comprising determining, based at least in part on the location from which the data subject access request is being made, one or more regulations that apply to the data subject access request.

4. The computer-implemented data processing method of claim 1, wherein determining the one or more pieces of metadata associated with the data subject access request comprises:

requesting the one or more one or more pieces of metadata from the requestor issuing the data subject access request; and

receiving the one or more one or more pieces of metadata from the requestor issuing the data subject access request.

5. The computer-implemented data processing method of claim 1, wherein the prioritization level is one of a first pre-determined prioritization level and a second pre-determined prioritization level.

6. The computer-implemented data processing method of claim 1, further comprising determining, based at least in part on the one or more pieces of metadata, one or more of:

a request type associated with the data subject access request,

a status of the requestor issuing the data subject access request, or

a time in which the data subject access request was made.

7. The computer-implemented data processing method of claim 1, wherein:

adjusting the prioritization level comprises adjusting the prioritization level to decrease the prioritization level of the data subject access request; and

modifying the completion date for fulfillment of the data subject access request comprises modifying the completion date to a modified completion date that is a later date than the completion date.

8. The computer-implemented data processing method of claim 1, wherein:

adjusting the prioritization level comprises adjusting the prioritization level to increase the prioritization level of the data subject access request; and

modifying the completion date for fulfillment of the data subject access request comprises modifying the completion date to a modified completion date that is an earlier date than the completion date.

9. The computer-implemented data processing method of claim 8, further comprising:

generating a prioritization message to indicate that the prioritization level of the data subject access request has been adjusted; and

providing, via electronic communication, the prioritization message to at least one privacy team member that is assigned to fulfill the data subject access request.

10. The computer-implemented data processing method of claim 1, wherein determining the one or more pieces of metadata associated with the data subject access request comprises:

generating a secure link between the one or more processors and a computing device associated with the requestor issuing the data subject access request to prevent outside access to the one or more pieces of metadata;

receiving, via the secure link, the one or more pieces of metadata; and

digitally storing, in computer memory, the one or more pieces of metadata in association with the data subject access request.

11. The computer-implemented data processing method of claim 10, further comprising:

generating a prioritization message to indicate that the prioritization level of the data subject access request has been adjusted; and

providing, via electronic communication, the prioritization message to at least one privacy team member that is assigned to fulfill the data subject access request.

12. A computer-implemented data processing method for prioritizing data subject access requests, the method comprising:

receiving, by one or more processors, a data subject access request from a requestor;

validating, by the one or more processors, an identity of the requestor by prompting the requestor to identify information associated with the requestor;

at least partially in response to validating the identity of the requestor, determining, by the one or more processors, one or more pieces of metadata associated with the data subject access request;

determining, by the one or more processors based on the one or more pieces of metadata, a location from which the data subject access request is being made;

analyzing, by the one or more processors, the location from which the data subject access request is being made, wherein analyzing the location from which the data subject access request is being made comprises determining whether the location from which the data subject access request is being made impacts a priority of fulfilling the data subject access request;

determining, by the one or more processors, the prioritization level of the data subject access request based at least in part on the analyzed location from which the data subject access request is being made; and

digitally storing, by the one or more processors, the prioritization level of the data subject access request in computer memory.

13. The computer-implemented data processing method of claim 12, further comprising:

determining, based on the one or more pieces of metadata, a location of a data subject associated with the data subject access request,

wherein determining the prioritization level of the data subject access request is further based at least in part on the location of the data subject associated with the data subject access request.

14. The computer-implemented data processing method of claim 12, further comprising:

determining, based at least in part on the one or more pieces of metadata, that a location of a data subject associated with the data subject access request is a first geographical location that is distinct from a second geographical location of the location from which the data subject access request is being made,

wherein determining the prioritization level of the data subject access request is further based at least in part on determining that the first geographical location is distinct from the second geographical location.

15. The computer-implemented data processing method of claim 12, wherein determining the one or more pieces of metadata further comprises:

generating a secure link between the one or more processors and a computing device associated with the requestor issuing the data subject access request to prevent outside access to the one or more pieces of metadata;

receiving, via the secure link, the one or more pieces of metadata; and

digitally storing one or more pieces of metadata in association with the data subject access request.

16. The computer-implemented data processing method of claim 12, wherein determining the location from which the data subject access request is being made comprises:

determining an IP address based on the one or more pieces of metadata; and

determining the location from which the data subject access request is being made based, at least in part, on the IP address.

17. The computer-implemented data processing method of claim 12, further comprising:

determining, based at least in part on the location from which the data subject access request is being made, one or more laws or regulations that apply to the data subject access request, wherein;

determining the prioritization level of the data subject access request is further based at least in part on the one or more laws or regulations.

18. A computer-implemented data processing method for prioritizing data subject access requests, the method comprising:

receiving, by one or more processors, a data subject access request from a requestor;

at least partially in response to receiving the data subject access request, obtaining, by the one or more processors, one or more pieces of metadata associated with the data subject access request;

determining, by the one or more processors based at least in part on the one or more pieces of metadata, a location from which the data subject access request is being made;

analyzing, by the one or more processors, the location from which the data subject access request is being made to determine whether the location from which the data subject access request is being made impacts a priority of fulfilling the data subject access request;

in response to determining that the location from which the data subject access request is being made impacts a priority of fulfilling the data subject access request, determining a prioritization level of the data subject access request based at least in part on the location from which the data subject access request is being made; and

digitally storing, by the one or more processors, the prioritization level of the data subject access request in computer memory.

19. The computer-implemented data processing method of claim 18, wherein obtaining the one or more pieces of metadata comprises:

requesting the one or more one or more pieces of metadata from the requestor issuing the data subject access request; and

receiving the one or more one or more pieces of metadata from the requestor issuing the data subject access request.

20. The computer-implemented data processing method of claim 18, wherein obtaining the one or more pieces of metadata comprises:

generating a secure link between the one or more processors and a computing device associated with the requestor issuing the data subject access request to prevent outside access to the one or more pieces of metadata;

receiving, via the secure link, the one or more pieces of metadata; and

digitally storing one or more pieces of metadata in association with the data subject access request.

21. The computer-implemented data processing method of claim 18, wherein determining the location from which the data subject access request is being made comprises:

determining an IP address based on the one or more pieces of metadata; and

determining the location from which the data subject access request is being made based at least in part on the IP address.

22. The computer-implemented data processing method of claim 18, wherein the one or more pieces of metadata comprise information related to one or more of:

a request type associated with the data subject access request,

a status of the requestor issuing the data subject access request, or

a time in which the data subject access request was made.

23. The computer-implemented data processing method of claim 18, further comprising determining, based on the location from which the data subject access request is being made, one or more laws or regulations that apply to the data subject access request;

and

determining a prioritization level of the data subject access request comprises determining the prioritization level based, at least in part on the one or more laws or regulations.

24. The computer-implemented data processing method of claim 18, wherein the prioritization level is one of a first predetermined prioritization level and a second predetermined prioritization level.

25. The computer-implemented data processing method of claim 18, wherein:

fulfilling the data subject access request comprises identifying one or more pieces of personal data associated with a data subject associated with the data subject access request; and

identifying the one or more pieces of personal data associated with the data subject comprises scanning one or more data inventories for the one or more pieces of personal data.

26. A non-transitory computer-readable medium storing computer-executable instructions for:

receiving a data subject access request from a requestor;

at least partially in response to receiving the data subject access request, obtaining one or more pieces of metadata associated with the data subject access request;

determining, based on the one or more pieces of metadata, a geographical location from which the data subject access request is being made;

determining, based on the one or more pieces of metadata, a geographical location of a data subject associated with the data subject access request;

determining, based on the one or more pieces of metadata, that the geographical location from which the data subject access request is being made is distinct from the geographical location of the data subject associated with the data subject access request;

analyzing the geographical location from which the data subject access request is being made and the geographical location of the data subject associated with the data subject access request to determine whether the geographical location from which the data subject access request is being made being distinct from the geographical location of the data subject associated with the data subject access request impacts a priority of fulfilling the data subject access request;

at least partially in response to determining that the geographical location from which the data subject access request is being made being distinct from the geographical location of the data subject associated with the data subject access request impacts a priority of fulfilling the data subject access request, determining a prioritization level of the data subject access request based, at least in part, on the geographical location from which the data subject access request is being made being distinct from the geographical location of the data subject associated with the data subject access request; and

digitally storing the prioritization level of the data subject access request in computer memory.