Method and system for generating consent recommendation

• US 11,256,826 B2
• Filed: 03/12/2019
• Issued: 02/22/2022
• Est. Priority Date: 10/26/2018
• Status: Active Grant

• Current Assignee: TATA Consultancy Services Limited (Tata Sons Pvt Ltd.)
• Original Assignee: TATA Consultancy Services Limited (Tata Sons Pvt Ltd.)
• Inventors: Kottekulam Vasu, Rosni, Banahatti, Vijayanand Mahadeo, Lodha, Sachin Premsukh
• Primary Examiner(s): Nguyen, Nhat Huy T
• Application Number:
  US16/351,346
• Publication Number:
  US 20200134228A1
• Time in Patent Office: 1,078 Days
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 3/011 Arrangements for interaction with the human body, e.g. for user immersion in virtual reality blind teaching G09B21/00
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: G06Q 10/0635 Risk analysis of enterprise or organisation activities
• CPC Class Codes: G06Q 10/067 Enterprise or organisation modelling
• CPC Class Codes: G06Q 30/02 Marketing; Price estimation or determination; Fundraising
• CPC Class Codes: H04L 67/306 User profiles

Abstract

This disclosure relates generally to consent management, and more particularly to a method and system for generating consent recommendation. The system determines a user aspect indicating consent preferences of the user, and identifies/predicts a reference privacy profile as matching the user aspect. The system uses a machine learning model to process the user aspect and to predict the matching reference privacy profile. Further, based on the matching reference privacy profile, the system generates one or more consent recommendations. The system can also be configured to obtain feedback for the generated consent recommendations and re-recommends consents based on the obtained feedback.

Claims

1. A processor-implemented method for consent recommendation, comprising:

determining a user aspect indicating consent preference of a user, via one or more hardware processors;

identifying, via the one or more hardware processors, a matching reference privacy profile out of a plurality of reference privacy profiles, corresponding to the determined user aspect;

generating at least one consent recommendation based on the matching privacy profile, via the one or more hardware processors, wherein the plurality of reference privacy profiles are used for collecting and processing information corresponding to the determined user aspect, and wherein the processing information is stored in a knowledge database, wherein the user aspect indicating the consent preference of the user is identified based on at least one of (i) collected user response to a plurality of questions in a questionnaire, (ii) at least one auxiliary information pertaining to the user, or (iii) data pertaining to past consent preferences of the user, and checking for deviations from the at least one consent recommendation by comparing the consent preference of the user with one or more consent recommendations, wherein if the deviations are detected, alternate recommendations are generated and wherein if the user continues to deviate from the one or more consent recommendations after a certain number of the one or more consent recommendations, then a reasoning for the deviation is required and based on the reasoning an updated reference privacy profile is generated, the updated reference privacy profile is used to predict the matching reference privacy profile; and

applying a latent factor modelling approach to generate the plurality of reference privacy profiles related to the consent recommendation, wherein a fatigue level of the user responding to the questionnaire is detected, and wherein when the detected fatigue level of the user exceeds a threshold of fatigue level, a precautionary action is triggered, wherein the precautionary action is at least one of terminating and postponing a current session, and wherein if the current session is being postponed, an alternative time is automatically suggested and if the collected user responses are sufficient to determine an user aspect.

2. The processor-implemented method as claimed in claim 1, wherein each of the plurality of reference privacy profiles comprises of one or more purposes, a user consent for each of the one or more purposes, and risk value corresponding to each of the one or more purposes.

3. The processor-implemented method as claimed in claim 2, wherein each of the plurality of reference privacy profiles is generated by:

fetching data pertaining to the one or more purposes from a knowledge base of at least one entity;

performing risk computation to assess risk of each of the plurality of purposes, wherein the assessed risk is represented in terms of the risk value; and

building the reference privacy profiles based on at least a few of the plurality of purposes, corresponding risk values and the user consent.

4. The processor-implemented method as claimed in claim 2, wherein the risk value is computed for each of the one or more purposes based on (i) sensitivity level of personal information being captured for each of the one or more purposes, (ii) reputation level of an enterprise which decides each of the one or more purposes, and (iii) duration of data exposure with each of the one or more purposes.

5. The processor-implemented method as claimed in claim 1, wherein the step of identifying a matching reference privacy profile comprises:

providing the determined user aspect as input to at least one pre-trained machine learning model; and

predicting the matching reference privacy profile corresponding to the user aspect, by the at least one pre-trained machine learning model.

6. A system (100), comprising:

one or more communication interfaces (101);

a memory module (102) storing a plurality of instructions; and

one or more hardware processors (103) coupled to the memory module (102) via the one or more communication interfaces (101), wherein the one or more hardware processors (103) are configured by the instructions to;

determine a user aspect indicating consent preference of a user;

identify a matching reference privacy profile out of a plurality of reference privacy profiles, corresponding to the determined user aspect;

generate at least one consent recommendation based on the matching reference privacy profile, wherein the plurality of reference privacy profiles are used for collecting and processing information corresponding to the determined user aspect, and wherein the processing information is stored in a knowledge database, wherein the system identifies the user aspect indicating the consent preference of the user based on at least one of collected user response to a plurality of questions in a questionnaire, at least one auxiliary information pertaining to the user, or data pertaining to past consent preferences of the user, and check for deviations from the at least one consent recommendation by comparing the consent preference of the user with one or more consent recommendations, wherein if the deviations are detected, alternate recommendations are generated and wherein if the user continues to deviate from the one or more consent recommendations after a certain number of the one or more consent recommendations, then a reasoning for the deviation is required and based on the reasoning an updated reference privacy profile is generated, the updated reference privacy profile is used to predict the matching reference privacy profile; and

apply a latent factor modelling approach to generate the plurality of reference privacy profiles related to the consent recommendation, wherein the system is configured to detect a fatigue level of the user responding to the questionnaire, and wherein when the detected fatigue level of the user exceeds a threshold of fatigue level, the system triggers a precautionary action and wherein if the current session is being postponed, an alternative time is automatically suggested and if the collected user responses are sufficient to determine an user aspect.

7. The system as claimed in claim 6, wherein each of the plurality of reference privacy profiles comprises of one or more purposes, a user consent for each of the one or more purposes, and risk value corresponding to each of the one or more purposes.

8. The system as claimed in claim 7, wherein the system generates each of plurality of reference privacy profiles by:

fetching data pertaining to the one or more purposes from a knowledge base of at least one entity;

performing risk computation to assess risk of each of the one or more purposes, wherein the assessed risk is represented in terms of the risk value; and

building the privacy profiles based on at least a few of the one or more purposes, corresponding risk values and the user consent.

9. The system as claimed in claim 8, wherein the system computes the risk value for each of the one or more purposes based on (i) sensitivity level of personal information being captured for each of the one or more purposes, (ii) reputation level of enterprise which decides the one or more purposes, and (iii) duration of data exposure with each of the one or more purposes.

10. The system as claimed in claim 6, wherein the system identifies the matching reference privacy profile by:

providing the determined user aspect as input to at least one pre-trained machine learning model of the system; and

predicting the matching reference privacy profile corresponding to the user aspect, by the at least one pre-trained machine learning model.

11. A non-transitory computer readable medium for consent recommendation, said non-transitory computer readable medium comprising one or more instructions which when executed by one or more hardware processors cause:

determining a user aspect indicating consent preference of a user;

identifying a matching reference privacy profile out of a plurality of reference privacy profiles, corresponding to the determined user aspect;

generating at least one consent recommendation based on the matching privacy profile, wherein the plurality of reference privacy profiles are used for collecting and processing information corresponding to the determined user aspect, and wherein the processing information is stored in a knowledge database, wherein the user aspect indicating the consent preference of the user is identified based on at least one of (i) collected user response to a plurality of questions in a questionnaire, (ii) at least one auxiliary information pertaining to the user, or (iii) data pertaining to past consent preferences of the user, and checking for deviations from the at least one consent recommendation by comparing the consent preference of the user with one or more consent recommendations, wherein if the deviations are detected, alternate recommendations are generated and wherein if the user continues to deviate from the one or more consent recommendations after a certain number of the one or more consent recommendations, then a reasoning for the deviation is required and based on the reasoning an updated reference privacy profile is generated, the updated reference privacy profile is used to predict the matching reference privacy profile; and

applying a latent factor modelling approach to generate the plurality of reference privacy profiles related to the consent recommendation, wherein a fatigue level of the user responding to the questionnaire is detected, and wherein when the detected fatigue level of the user exceeds a threshold of fatigue level, a precautionary action is triggered, and wherein the precautionary action is at least one of terminating and postponing a current session and wherein if the current session is being postponed, an alternative time is automatically suggested and if the collected user responses are sufficient to determine an user aspect.

12. The non-transitory computer readable medium as claimed in claim 11, wherein each of the plurality of reference privacy profiles comprises of one or more purposes, a user consent for each of the one or more purposes, and risk value corresponding to each of the one or more purposes.

13. The non-transitory computer readable medium as claimed in claim 12, wherein each of the plurality of reference privacy profiles is generated by:

fetching data pertaining to the one or more purposes from a knowledge base of at least one entity;

performing risk computation to assess risk of each of the plurality of purposes, wherein the assessed risk is represented in terms of the risk value; and

building the reference privacy profiles based on at least a few of the plurality of purposes, corresponding risk values and the user consent.

14. The non-transitory computer readable medium as claimed in claim 12, wherein the risk value is computed for each of the one or more purposes based on (i) sensitivity level of personal information being captured for each of the one or more purposes, (ii) reputation level of an enterprise which decides each of the one or more purposes, and (iii) duration of data exposure with each of the one or more purposes.

15. The non-transitory computer readable medium as claimed in claim 11, wherein the step of identifying a matching reference privacy profile comprises:

providing the determined user aspect as input to at least one pre-trained machine learning model; and

predicting the matching reference privacy profile corresponding to the user aspect, by the at least one pre-trained machine learning model.