Data processing systems for measuring privacy maturity within an organization

• US 10,867,072 B2
• Filed: 03/06/2020
• Issued: 12/15/2020
• Est. Priority Date: 06/10/2016
• Status: Active Grant

• Current Assignee: OneTrust LLC
• Original Assignee: OneTrust LLC
• Inventors: Barday, Kabir A., Brannon, Jonathan Blake
• Primary Examiner(s): Rahman, Shawnchoy
• Application Number:
  US16/811,793
• Publication Number:
  US 20200210618A1
• Time in Patent Office: 284 Days
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 3/04842 Selection of displayed objects or displayed text elements G06F3/0482 takes precedence
• CPC Class Codes: G06Q 50/01 Social networking
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]

Abstract

A privacy compliance measurement system, according to particular embodiments, is configured to determine compliance with one or more privacy compliance requirements by an organization or sub-group of the organization. In various embodiments, the system is configured to determine a privacy maturity rating for each of a plurality of sub-groups within an organization. In some embodiments, the privacy maturity rating is based at least in part on: (1) a frequency of risks or issues identified with Privacy Impact Assessments (PIAs) performed or completed by the one or sub-groups; (2) a relative training level of members of the sub-groups with regard to privacy related matters; (3) a breadth and amount of personal data collected by the sub-groups; and/or (4) etc. In various embodiments, the system is configured to automatically modify one or more privacy campaigns based on the determined privacy maturity ratings.

Claims

1. A computer-implemented data processing method for measuring a particular organization'"'"'s compliance with one or more requirements associated with one or more pieces of computer code originating from the particular organization, the method comprising:

determining, by one or more processors, for each of the one or more pieces of computer code, one or more respective storage locations;

electronically obtaining, by one or more processors, each of the one or more pieces of computer code based on the one or more respective storage locations;

automatically electronically analyzing each of the one or more pieces of computer code to determine one or more privacy-related attributes of each of the one or more pieces of computer code, each of the privacy-related attributes indicating one or more types of privacy campaign data that the computer code collects or accesses;

retrieving, by one or more processors, for at least one individual associated with the particular organization, privacy training data comprising an amount of privacy training received by the at least one individual;

determining, by one or more processors, based at least in part on the one or more types of privacy campaign data that the computer code collects or accesses and the privacy training data, a privacy maturity score for the particular organization; and

displaying, by one or more processors, the privacy maturity score on a display screen associated with a computing device.

2. The computer-implemented data processing method of claim 1, the method further comprising modifying at least one of the one or more pieces of computer code based at least in part on the privacy maturity score.

3. The computer-implemented data processing method of claim 1, wherein the one or more types of privacy campaign data that the computer code collects or accesses comprises:

a number of privacy campaigns facilitated by the one or more pieces of computer code;

an amount of personal data collected by each of the one or more pieces of computer code;

a type of the personal data collected by each of the one or more pieces of computer code; and

a volume of the personal data transferred by the one or more pieces of computer code.

4. The computer-implemented data processing method of claim 1, the method further comprising:

auditing, by one or more processors, the one or more pieces of computer code according to a particular schedule;

modifying, by one or more processors, the schedule based at least in part on the privacy maturity score.

5. The computer-implemented data processing method of claim 1, wherein:

the method further comprises receiving one or more privacy impact assessments associated with each of the one or more pieces of computer code; and

determining the privacy maturity score for the particular organization further comprises determining the privacy maturity score based at least in part on the one or more privacy impact assessments.

6. The computer-implemented data processing method of claim 5, wherein:

the one or more privacy impact assessments are one or more privacy impact assessments performed prior to execution of the one or more pieces of computer code as part of a privacy campaign.

7. A non-transitory computer-readable medium storing computer-executable instructions for determining a privacy maturity of a business unit associated with an organization, the non-transitory computer-readable medium storing computer-executable instructions for:

electronically obtaining, by one or more processors, one or more pieces of computer code associated with the business unit;

automatically electronically analyzing each of the one or more pieces of computer code to determine one or more privacy-related attributes of each of the one or more pieces of computer code, each of the privacy-related attributes indicating one or more types of personal data that the computer code collects or accesses;

in response to determining that the computer code has a particular one of the one or more privacy-related attributes, executing the steps of (i) electronically displaying one or more prompts to a first individual from the business unit requesting that the first individual input information regarding the particular privacy-related attribute;

(ii) receiving information regarding the particular privacy-related attribute from the first individual; and

(iii) communicating the information regarding the particular privacy-related attribute to one or more second individuals from the business unit for use in conducting one or more privacy assessments of the computer code;

accessing, by one or more processors, training data associated with one or more individuals from the business unit;

determining, by one or more processors, based at least in part on the one or more types of personal data that the computer code collects or accesses and the training data, a privacy maturity score for the business unit indicating compliance of the business unit with one or more privacy-related requirements; and

displaying, by one or more processors, the privacy maturity score on a display screen associated with a computing device.

8. The non-transitory computer-readable medium of claim 7, wherein the training data comprises training data selected from the group consisting of:

i. a number of the one or more individuals that have completed one or more privacy trainings;

ii. a number of the one or more individuals that have attended one or more privacy events;

iii. a number of the one or more individuals that are members of a privacy professional association; and

iv. a number of the one or more individuals that hold a professional certification related to the collection and storage of personal data.

9. The non-transitory computer-readable medium of claim 7, further comprising modifying at least one of the one or more pieces of computer code based at least in part on the privacy maturity score.

10. The non-transitory computer-readable medium of claim 7, wherein the one or more types of privacy campaign data that the computer code collects or accesses comprises:

a number of privacy campaigns facilitated by the one or more pieces of computer code;

an amount of personal data collected by each of the one or more pieces of computer code;

a type of the personal data collected by each of the one or more pieces of computer code; and

a volume of the personal data transferred by the one or more pieces of computer code.

11. The non-transitory computer-readable medium of claim 7, further comprising:

auditing, by one or more processors, the one or more pieces of computer code according to a particular schedule; and

modifying, by one or more processors, the schedule based at least in part on the privacy maturity score.

12. The non-transitory computer-readable medium of claim 7, wherein:

further comprises receiving the one or more privacy assessments of the computer code; and

determining the privacy maturity score for the particular organization further comprises determining the privacy maturity score based at least in part on the one or more privacy assessments.

13. The non-transitory computer-readable medium of claim 12, wherein:

the one or more privacy assessments are one or more privacy impact assessments performed prior to execution of the one or more pieces of computer code as part of a privacy campaign.

14. A computer-implemented data processing method for measuring a particular organization'"'"'s compliance with one or more requirements associated with one or more pieces of computer code originating from the particular organization, the method comprising:

determining, by one or more processors, for each of the one or more pieces of computer code, one or more respective storage locations;

electronically obtaining, by one or more processors, each of the one or more pieces of computer code based on the one or more respective storage locations;

automatically electronically analyzing each of the one or more pieces of computer code to determine one or more privacy-related attributes of each of the one or more pieces of computer code, each of the privacy-related attributes indicating one or more types of privacy campaign data that the computer code collects or accesses, the one or more types of privacy campaign data comprising at least one type of privacy campaign data selected from the group consisting of;

a number of privacy campaigns facilitated by the one or more pieces of computer code;

an amount of personal data collected by each of the one or more pieces of computer code;

a type of the personal data collected by each of the one or more pieces of computer code; and

a volume of the personal data transferred by the one or more pieces of computer code;

retrieving, by one or more processors, one or more privacy impact assessments of the one or more pieces computer coded submitted by the particular organization; and

determining, by one or more processors, based at least in part on the one or more types of privacy campaign data that the computer code collects or accesses and the one or more privacy impact assessments of the one or more pieces computer coded submitted by the particular organization, a privacy maturity score for the particular organization; and

displaying, by one or more processors, the privacy maturity score on a display screen associated with a computing device.

15. The computer-implemented data processing method of claim 14, wherein determining, by one or more processors, the privacy maturity score for the particular organization based at least in part on the one or more privacy impact assessments of the one or more pieces computer coded submitted by the particular organization comprises determining one or more identified issues with the one or more privacy impact assessments.

16. The computer-implemented data processing method of claim 15, wherein the one or more types of privacy campaign data comprise the number of privacy campaigns facilitated by the one or more pieces of computer code.

17. The computer-implemented data processing method of claim 16, wherein:

the method further comprises tracking the amount of personal data collected by each of the one or more pieces of computer code; and

the one or more types of privacy campaign data that the computer code collects or accesses comprises the amount of personal data collected by each of the one or more pieces of computer code.

18. The computer-implemented data processing method of claim 17, further comprising:

substantially automatically modifying the one or more pieces of computer code based at least in part on the privacy maturity score.

19. The computer-implemented data processing method of claim 14, wherein:

one or more privacy impact assessments of the one or more pieces computer coded are one or more privacy impact assessments performed prior to execution of the one or more pieces of computer code as part of a privacy campaign.

20. The computer-implemented data processing method of claim 19, further comprising:

substantially automatically modifying the privacy campaign based at least in part on the privacy maturity score.