DATA PROCESSING SYSTEMS FOR IDENTITY VALIDATION OF DATA SUBJECT ACCESS REQUESTS AND RELATED METHODS

• US 20180373890A1
• Filed: 08/06/2018
• Published: 12/27/2018
• Est. Priority Date: 06/10/2016
• Status: Active Grant

• Current Assignee: OneTrust LLC
• Original Assignee: OneTrust LLC
• Inventors: Barday, Kabir A., Sabourin, Jason L., Brannon, Jonathan Blake, Karanjkar, Mihir S., Jones, Kevin
• Granted Patent: US 10,416,966 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 15/76 Architectures of general purpose stored program computers with program plugboard G06F15/08; multicomputers G06F15/16
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 2221/2103 Challenge-response
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 8/20 Software design
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

In particular embodiments, a computer-implemented data processing method for responding to a data subject access request comprises: (A) receiving a data subject access request from a requestor comprising one or more request parameters; (B) validating an identity of the requestor by prompting the requestor to identify information associated with the requestor; (C) in response to validating the identity of the requestor, processing the request by identifying one or more pieces of personal data associated with the requestor, the one or more pieces of personal data being stored in one or more data repositories associated with a particular organization; and (D) taking one or more actions based at least in part on the data subject access request, the one or more actions including one or more actions related to the one or more pieces of personal data.

Claims

1. A computer-implemented data processing method for responding to a data subject access request, the method comprising:

receiving a data subject access request from a requestor comprising one or more request parameters;

validating an identity of the requestor by prompting the requestor to identify information associated with the requestor;

in response to validating the identity of the requestor, processing the request by identifying one or more pieces of personal data associated with the requestor, the one or more pieces of personal data being stored in one or more data repositories associated with a particular organization; and

taking one or more actions based at least in part on the data subject access request, the one or more actions including one or more actions related to the one or more pieces of personal data.

2. The computer-implemented data processing method of claim 1, wherein validating the identity of the requestor comprises:

accessing, via one or more computer networks, one or more third-party data aggregation systems;

confirming, based at least in part on information received via the one or more third-party data aggregation systems, that the data subject exists; and

in response to determining that the data subject exists, confirming, based at least in part on the information received via the one or more third-party data aggregation systems and the one or more request parameters, that the requestor is the data subject.

3. The computer-implemented data processing method of claim 2, wherein confirming that the requestor is the data subject comprises:

generating, based at least in part on the information received via the one or more third-party data aggregation systems, at least one threshold identity confirmation question;

prompting the requestor to provide a response to the at least one threshold identity confirmation question; and

comparing the response to the information received via the one or more third-party data aggregation systems to validate the identity of the requestor.

4. The computer-implemented data processing method of claim 1, wherein validating the identity of the requestor comprises:

prompting the requestor to provide one or more additional pieces of information in order to validate the requestor'"'"'s identity;

receiving the one or more additional pieces of information; and

comparing the one or more additional pieces of information received from the requestor to corresponding data information accessed via one or more third-party data aggregation systems in order to validate the identity of the requestor.

5. The computer-implemented data processing method of claim 4, wherein prompting the requestor to provide one or more additional pieces of information in order to validate the requestor'"'"'s identity further comprises:

generating a secure link between one or more processors associated with the data subject access request and a computing device associated with the requestor to prevent outside access to the one or more additional pieces of information provided by the requestor;

receiving, via the secure link, the one or more additional pieces of information provided by the requestor; and

digitally storing the one or more additional pieces of information provided by the requestor.

6. The computer-implemented data processing method of claim 4, wherein the one or more additional pieces of information is one or more images provided by the requestor via a computing device associated with the requestor.

7. The computer-implemented data processing method of claim 1, wherein one of the one or more request parameters of the data subject access request comprises a type of data subject access request, and wherein the type of data subject access request is selected from a group consisting of:

a subject'"'"'s rights request, and

a data subject deletion request.

8. The computer-implemented data processing method of claim 7, further comprising:

determining, based in part on the type of data subject access request, a number of identity validation methods required to validate the identity of the requestor; and

providing the required number of identity validation methods, wherein each of the identity validation methods includes prompting the requestor to identify different information associated with the requestor for each identity validation method.

9. The computer-implemented data processing method of claim 1, wherein the requestor is a requesting business.

10. The computer-implemented data processing method of claim 9, wherein validating the identity of the requestor further comprises using one or more company validation techniques, wherein the one or more company validation technique is selected from a group consisting of:

validating a vendor contract;

receiving a matching unique identifier provided by an organization receiving the data subject access request to the requesting business;

receiving a matching file in possession of both the requesting business and the organization receiving the data subject access request; and

receiving a document memorializing an association between the requesting business and the organization receiving the data subject access request.

11. A computer-implemented data processing method for responding to a data subject access request, the method comprising:

receiving a data subject access request from a requestor comprising one or more request parameters;

validating an identity of the requestor by prompting the requestor to identify information associated with the requestor, wherein validating the identity of the requestor includes;

accessing, via one or more computer networks, one or more third-party data aggregation systems;

confirming, based at least in part on information received via the one or more third-party data aggregation systems, that the data subject exists; and

in response to determining that the data subject exists, confirming, based at least in part on the information received via the one or more third-party data aggregation systems and the one or more request parameters, that the requestor is the data subject; and

in response to validating the identity of the requestor, taking one or more actions based at least in part on the data subject access request, the one or more actions including one or more actions related to identifying one or more pieces of personal data associated with the requestor.

12. The computer-implemented data processing method of claim 11, wherein confirming that the requestor is the data subject comprises:

generating, based at least in part on the information received via the one or more third-party data aggregation systems, at least one threshold identity confirmation question;

prompting the requestor to provide a response to the at least one threshold identity confirmation question; and

comparing the response to the information received via the one or more third-party data aggregation systems to validate the identity of the requestor.

13. The computer-implemented data processing method of claim 11, wherein validating the identity of the requestor comprises:

prompting the requestor to provide one or more additional pieces of information in order to validate the requestor'"'"'s identity;

receiving the one or more additional pieces of information; and

comparing the one or more additional pieces of information received from the requestor to corresponding data information accessed via one or more third-party data aggregation systems in order to validate the identity of the requestor.

14. The computer-implemented data processing method of claim 13, wherein prompting the requestor to provide one or more additional pieces of information in order to validate the requestor'"'"'s identity further comprises:

generating a secure link between one or more processors associated with the data subject access request and a computing device associated with the requestor to prevent outside access to the one or more additional pieces of information provided by the requestor;

receiving, via the secure link, the one or more additional pieces of information provided by the requestor; and

digitally storing the one or more additional pieces of information provided by the requestor.

15. The computer-implemented data processing method of claim 13, wherein the one or more additional pieces of information is one or more images provided by the requestor via a computing device associated with the requestor.

16. The computer-implemented data processing method of claim 11, wherein one of the one or more request parameters of the data subject access request comprises a type of data subject access request, and wherein the type of data subject access request is selected from a group consisting of:

a subject'"'"'s rights request, and

a data subject deletion request.

17. A computer-implemented data processing method for responding to a data subject access request, the method comprising:

receiving a data subject access request from a requestor comprising one or more request parameters, wherein at least one of the one or more request parameters includes a data subject deletion request;

validating an identity of the requestor by prompting the requestor to identify information associated with the requestor, wherein validating an identity of the requestor further comprises;

in response to validating the identity of the requestor,

automatically identifying, by one or more computer processors, one or more pieces of personal data associated with the requestor, the one or more pieces of personal data being stored in one or more data repositories associated with a particular organization; and

in response to identifying, by one or more computer processors, the one or more pieces of personal data associated with the requestor, automatically facilitating the deletion of the data subject'"'"'s one or more data repositories associated with the particular organization.

18. The computer-implemented data processing method of claim 17, wherein validating the identity of the requestor comprises:

prompting the requestor to provide one or more additional pieces of information in order to validate the requestor'"'"'s identity;

receiving the one or more additional pieces of information; and

comparing the one or more additional pieces of information received from the requestor to corresponding data information accessed via one or more third-party data aggregation systems in order to validate the identity of the requestor.

19. The computer-implemented data processing method of claim 18, wherein prompting the requestor to provide one or more additional pieces of information in order to validate the requestor'"'"'s identity further comprises:

generating a secure link between one or more processors associated with the data subject access request and a computing device associated with the requestor to prevent outside access to the one or more additional pieces of information provided by the requestor;

receiving, via the secure link, the one or more additional pieces of information provided by the requestor; and

digitally the one or more additional pieces of information provided by the requestor.

20. The computer-implemented data processing method of claim 17,

wherein the requestor is a business and validating the identity of the requestor further comprises using one or more company verification techniques, and

wherein the one or more company verification technique is selected from a group consisting of:

validating a vendor contract;

receiving a matching unique identifier provided by an organization receiving the data subject access request to the requesting business;

receiving a matching file in possession of both the requesting business and the organization receiving the data subject access request; and

receiving a document memorializing an association between the requesting business and the organization receiving the data subject access request.