Data processing systems for calculating and communicating cost of fulfilling data subject access requests and related methods

• US 10,776,517 B2
• Filed: 09/27/2019
• Issued: 09/15/2020
• Est. Priority Date: 06/10/2016
• Status: Active Grant

• Current Assignee: OneTrust LLC
• Original Assignee: OneTrust LLC
• Inventors: Barday, Kabir A., Sabourin, Jason L., Brannon, Jonathan Blake, Karanjkar, Mihir S., Jones, Kevin
• Primary Examiner(s): Miller, Viva
• Application Number:
  US16/586,202
• Publication Number:
  US 20200026879A1
• Time in Patent Office: 354 Days
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 21/6254 by anonymising data, e.g. decorrelating personal data from the owner's identification
• CPC Class Codes: G06Q 10/063118 Staff planning in a project environment
• CPC Class Codes: G06Q 10/06313 Resource planning in a project environment
• CPC Class Codes: G06Q 10/1097 Task assignment

Abstract

In various embodiments, fulfilling a data subject access request may be particularly costly. In some embodiments, a company may store data regarding a particular data subject in multiple different locations for a plurality of different reasons as part of a plurality of different processing and other business activities. For example, a particular data subject may be both a customer and an employee of a particular company or organization. Accordingly, in some embodiments, fulfilling a data subject access request for a particular data subject may involve a plurality of different information technology (IT) professionals in a plurality of different departments of a particular company or organization. As such, it may be useful to determine a cost of a particular data subject access request (e.g., particularly because, in some cases, a data subject is entitled to a response to their data subject access request as a matter of right at no charge).

Claims

1. A computer-implemented data processing method for processing and executing one or more steps related to fulfillment of a data subject access request, the method comprising:

receiving a data subject access request from a requestor comprising one or more request parameters;

assigning the data subject access request to at least one privacy team member;

identifying one or more information technology (IT) teams required to fulfill the data subject access request based at least in part on the one or more request parameters;

fulfilling the data subject access request by;

delegating one or more subtasks of the data subject access request to each of the one or more IT teams;

accessing a plurality of data models that comprise a respective data inventory for each of a plurality of data storage locations and map one or more relationships between one or more aspects of the data inventory and one or more data storage locations of the plurality of data storage locations;

identifying, based at least in part on one or more data model of the plurality of data models, one or more storage locations of the plurality of data storage locations that comprise each of the one or more pieces of personal data the particular organization has obtained on the requestor; and

retrieving each of the one or more pieces of personal data the particular organization has obtained on the requestor from the one or more storage locations of the plurality of data storage locations;

calculating an effective cost of fulfilling the data subject access request based at least in part on fulfilling the data subject access request by the one or more IT teams; and

digitally storing the total cost in computer memory.

2. The computer-implemented data processing method of claim 1, further comprising:

receiving a plurality of data subject access requests, each of the plurality of data subject access requests comprising one or more request parameters;

for each of the plurality of data subject access requests, determining an estimated total cost associated with fulfilling the data subject access request, comprising;

identifying one or more previously fulfilled data subject access request that are similar to the data subject access request based at least in part on a similarity between the one or more request parameters of the data subject access request and one or more request parameters of the previously fulfilled data subject access requests; and

calculating the estimated total cost associated with fulfilling the data subject access request based at least in part on the total cost for each of the identified one or more previously fulfilled data subject access requests; and

prioritizing the plurality of data subject access requests for fulfillment based at least in part on the estimated total cost associated with fulfilling each of the plurality of data subject access requests.

3. The computer-implemented data processing method of claim 2, wherein the plurality of data subject access requests are prioritized for fulfillment in order of lowest estimated total cost to highest estimated total cost.

4. The computer-implemented data processing method of claim 2, wherein prioritizing the plurality of data subject access requests for fulfillment based at least in part on the estimated total cost associated with fulfilling each of the plurality of data subject access requests comprises prioritizing the plurality of data subject access requests for fulfillment in order of highest estimated total cost to lowest estimated total cost.

5. The computer-implemented data processing method of claim 2, wherein the one or more request parameters include one or more parameters selected from a group consisting of:

a requestor for the data subject access request; and

a type for the data subject access request.

6. The computer-implemented data processing method of claim 5, where one of the one or more request parameters of the data subject access request comprises a type of data subject access request, and wherein the type of data subject access request is selected from a group consisting of:

a subject'"'"'s rights request, and

a data subject deletion request.

7. The computer-implemented data processing method of claim 2, further comprising:

for each of the plurality of data subject access requests,

assigning the data subject access request to at least one privacy team member based at least in part on the estimated total cost of the data subject access request;

identifying one or more information technology (IT) teams required to fulfill the data subject access requests based at least in part on the one or more request parameters; and

delegating one or more subtasks of the data subject access request to each of the one or more IT teams for fulfilling the data subject access request.

8. The computer-implemented data processing method of claim 1, further comprising:

generating a data subject access request invoice for the total cost associated with the data subject access request; and

providing the data subject access request to one or more recipients selected from a group consisting of the requestor and a third party associated with the requestor.

9. The computer-implemented data processing method of claim 1, wherein the one or more external factors is an organization overhead adjustment that is applied as the adjustment to the calculated effective cost.