Data processing systems for modifying privacy campaign data via electronic messaging systems

• US 9,892,443 B2
• Filed: 06/09/2017
• Issued: 02/13/2018
• Est. Priority Date: 04/01/2016
• Status: Active Grant

• Current Assignee: OneTrust LLC
• Original Assignee: OneTrust LLC
• Inventors: Barday, Kabir A.
• Primary Examiner(s): Ouellette, Jonathan P
• Application Number:
  US15/619,382
• Publication Number:
  US 20170287032A1
• Time in Patent Office: 249 Days
• Field of Search: 705 11-912, 705325
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06Q 10/063114 Status monitoring or status determination for a person or group
• CPC Class Codes: G06Q 30/0609 Buyer or seller confidence or verification
• CPC Class Codes: G06Q 50/265 Personal security, identity or safety

Abstract

In various embodiments, a privacy campaign data modification system is configured to store electronic messages in memory and associate those electronic messages with a particular privacy campaign. In particular, a privacy officer or other individual may receive e-mails or other electronic messages that are associated with an existing privacy campaign or an existing privacy impact assessment currently being performed for a particular privacy campaign. In various embodiments, it may be necessary to store and maintain the electronic messages for any suitable reason (e.g., record keeping, auditing, etc.).

Claims

1. A computer-implemented data processing method for electronically receiving the input of campaign data related to a privacy campaign and electronically calculating a risk level for the privacy campaign based on the data inputs comprising:

displaying on a graphical user interface a prompt to create an electronic record for a privacy campaign, wherein the privacy campaign utilizes personal data collected from at least one or more persons or one or more entities;

receiving a command to create an electronic record for the privacy campaign;

creating an electronic record for the privacy campaign and digitally storing the record;

presenting, on one or more graphical user interfaces, a plurality of prompts for the input of campaign data related to the privacy campaign;

electronically receiving campaign data input by one or more users, wherein the campaign data identifies each of;

a description of the campaign;

one or more types of personal data related to the campaign;

a subject from which the personal data was collected;

the storage of the personal data; and

access to the personal data;

processing the campaign data by electronically associating the campaign data with the record for the privacy campaign;

receiving, by one or more computer processors, a request to associate an electronic message with the record for the privacy campaign;

in response to receiving the request, associating the electronic message with the record for the privacy campaign;

digitally storing the campaign data associated with the record for the campaign;

using one or more computer processors, calculating a risk level for the campaign based on the campaign data, wherein calculating the risk level for the campaign comprises;

electronically retrieving from a database the campaign data associated with the record for the campaign;

electronically determining a plurality of weighting factors for the campaign, wherein the plurality of weighting factors are based upon a plurality of factors including;

the nature of the personal data associated with the campaign;

the physical location of the personal data associated with the campaign;

the length of time that the personal data associated with the campaign will be retained in storage;

the type of individual from which the personal data associated with the campaign originated; and

the country of residence of the individual from which the personal data associated with the campaign originated;

electronically assigning a relative risk rating for each of the plurality of factors; and

electronically calculating a risk level for the campaign based upon the plurality of weighting factors and the relative risk rating for each of the plurality of factors; and

digitally storing the risk level associated with the record for the campaign;

scanning one or more pieces of content in the electronic message;

after scanning the one or more pieces of content, analyzing the one or more pieces of content to identify one or more keywords in the electronic message;

determining, based at least in part on the one or more keywords, whether to modify the risk level for the privacy campaign;

in response to determining to modify the risk level, calculating an updated risk level for the particular privacy campaign by;

electronically modifying at least one of the plurality of weighting factors;

electronically calculating an updated risk level based at least in part on the modified plurality of weighting factors; and

digitally storing the updated risk level associated with the record for the campaign.

2. The computer-implemented data processing method of claim 1, further comprising electronically determining an audit schedule for the campaign based at least in part on the risk level.

3. The computer-implemented data processing method of claim 2, further comprising:

scanning the electronic message to identify at least one piece of content within the electronic message; and

modifying the audit schedule based at least in part on the at least one piece of content.

4. The computer-implemented data processing method of claim 1, wherein:

the method further comprises providing a browser plug-in for installation on a computer device, the browser plug-in being configured to receive the request to associate the electronic message with the record for the privacy campaign; and

receiving the request to associate the electronic message with the record for the privacy campaign comprises receiving the request via the browser plug-in.

5. The computer-implemented data processing method of claim 1, wherein:

the method further comprises establishing an e-mail alias associated with the campaign; and

receiving the request to associate the electronic message with the record for the privacy campaign comprises receiving the electronic message in response to an individual forwarding the electronic message to the e-mail alias.

6. The computer-implemented data processing method of claim 1, wherein the plurality of weighting factors are based upon the electronic message.

7. The computer implemented data processing method of claim 1, further comprising:

scanning the electronic message to identify at least one piece of content within the electronic message; and

determining, based at least in part on the at least one piece of content, whether to associate the electronic message with the campaign.

8. The computer-implemented data processing method of claim 7, wherein the at least one piece of content comprises at least one unique identifier associated with the campaign.

9. The computer implemented data processing method of claim 1, further comprising:

in response receiving the command to create the electronic record for the privacy campaign, automatically generating an e-mail alias and associating the e-mail alias with the privacy campaign.

10. The computer implemented data processing method of claim 9, wherein receiving the request to associate the electronic message with the record for the privacy campaign comprises receiving the electronic message via a forwarded electronic message to the e-mail alias.

11. A computer-implemented data processing method of electronically modifying a data structure comprising campaign data related to a privacy campaign, the method comprising:

receiving, by one or more processors, a request to modify a data structure to include one or more electronic messages, wherein the data structure digitally stores campaign data related to a privacy campaign, and the campaign data identifies each of;

a description of the privacy campaign;

one or more types of personal data related to the privacy campaign;

a subject from which the personal data was collected;

a storage location of the personal data;

one or more access permissions related to the personal data;

a risk level for the privacy campaign, wherein the risk level is calculated by;

identifying a plurality of risk factors for the privacy campaign, wherein each of the plurality of risk factors has an associated weighting factor and the plurality of risk factors includes;

a type of the personal data collected as part of the particular privacy campaign;

information about a type of data subject from which the personal data is collected as part of the particular privacy campaign; and

storage information for the personal data collected as part of the particular privacy campaign; and

electronically calculating the risk level for the privacy campaign based upon, for each respective one of the plurality of risk factors, the weighting factor for the risk factor,

in response to receiving the request;

scanning one or more pieces of content in the one or more electronic messages;

after scanning the one or more pieces of content, analyzing the one or more pieces of content;

determining based at least in part on the one or more pieces of content, whether to modify the data structure to include the one or more messages;

in response to determining to modify the data structure, modifying, by one or more processors, the data structure to include the one or more electronic messages;

associating, in the data structure, the one or more electronic messages with the campaign data;

determining, based at least in part on the one or more pieces of content, whether to modify the risk level for the privacy campaign; and

in response to determining to modify the risk level, calculating an updated risk level for privacy campaign by;

electronically modifying the associated weighting factor for at least one of the plurality of risk factors;

after electronically modifying the associated weighting factor for the at least one of the plurality of risk factors;

electronically calculating a modified risk level for the privacy campaign based upon, for each respective one of the plurality of risk factors, the associated weighting factor; and

digitally storing the modified risk level with the campaign data.

12. The computer-implemented data processing method of claim 11, further comprising electronically determining an audit schedule for the campaign based at least in part on the risk level.

13. The computer-implemented data processing method of claim 12, wherein:

the method further comprises providing a software plug-in for installation on a computing device, wherein the software plug-in is configured to integrate with one or more electronic messaging programs; and

receiving the request to modify the data structure to include the one or more electronic messages comprises receiving the request via the software plug-in.

14. The computer-implemented data processing method of claim 11, further comprising:

receiving, by one or more processors, a request to modify a data structure to include one or more second electronic messages related to a second privacy campaign;

determining, by one or more processors, whether the second privacy campaign is an existing privacy campaign;

in response to determining that the second privacy campaign is an existing privacy campaign, modifying, by one or more processors, campaign data associated with the second privacy campaign to include the one or more second electronic messages; and

in response to determining that the second privacy campaign is not an existing privacy campaign;

storing the one or more second electronic messages in memory; and

tagging the one or more second electronic messages as unassigned.

15. The computer-implemented data processing method of claim 14, wherein:

the method further comprises providing, by one or more processors, a software plug-in for installation on a computing device;

receiving the request to modify the data structure to include the one or more second electronic messages related to the second privacy campaign comprises receiving the request via the software plug-in.

16. The computer-implemented data processing method of claim 15, wherein the software plug-in is a plug-in selected from the group consisting of:

a browser plug-in extension configured for capturing the one or more electronic messages via webmail; and

an electronic messaging application plug-in configured for capturing the one or more electronic messages from the electronic messaging application.

17. A computer-implemented data processing method of electronically modifying campaign data related to a particular privacy campaign of a plurality of privacy campaigns, the method comprising:

providing, by one or more processors, a software plug-in for installation on a computing device;

receiving, by one or more processors, via the software plug-in, a request to modify campaign data for a particular privacy campaign of a plurality of privacy campaigns to include one or more electronic messages, wherein the campaign data identifies each of;

a description of the particular privacy campaign;

one or more types of personal data related to the particular privacy campaign;

a subject from which the personal data was collected;

a storage location of the personal data;

one or more access permissions related to the personal data; and

a risk level for the particular privacy campaign;

in response to receiving the request;

scanning one or more pieces of content in the one or more electronic messages;

after scanning the one or more pieces of content, analyzing the one or more pieces of content; and

identifying the particular privacy campaign of the plurality of privacy campaigns based at least in part on the analyzed one or more pieces of content;

modifying, by one or more processors, the campaign data for the particular privacy campaign to include the one or more electronic messages;

associating, in the data structure, the one or more electronic messages with the campaign data;

analyzing the one or more pieces of content to identify one or more keywords in the one or more messages;

determining, based at least in part on the one or more keywords, whether to modify the risk level for the particular privacy campaign; and

in response to determining to modify the risk level, calculating an updated risk level for the particular privacy campaign by;

identifying a plurality of risk factors for the particular privacy campaign, wherein each of the plurality of risk factors has an associated weighting factor and the plurality of risk factors includes;

a type of the personal data collected as part of the particular privacy campaign;

information about a type of data subject from which the personal data is collected as part of the particular privacy campaign; and

storage information for the personal data collected as part of the particular privacy campaign;

electronically modifying the associated weighting factor for at least one of the plurality of risk factors;

electronically calculating the updated risk level for the privacy campaign based upon, for each respective one of the plurality of risk factors, the weighting factor for the risk factor; and

digitally storing the updated risk level associated with the record for the campaign.

18. The computer-implemented data processing method of claim 17, wherein the software plug-in is a plug-in selected from the group consisting of:

a browser plug-in extension configured for capturing the one or more electronic messages via webmail; and

an electronic messaging application plug-in configured for capturing the one or more electronic messages from the electronic messaging application.

19. The computer-implemented data processing method of claim 17, wherein:

the one or more pieces of content comprise information related a type of personal data collected as part of the particular privacy campaign other than the one or more types of personal data related to the particular privacy campaign indicated in the campaign data;

electronically modifying the associated weighting factor for at least one of the plurality of risk factors comprises modifying the associated weighting factor for the type of personal data collected as part of the particular privacy campaign.

20. The computer-implemented data processing method of claim 17, wherein:

the one or more pieces of content indicate that the particular privacy campaign is winding down soon; and

the calculated risk level is lower than a previous risk level for the particular privacy campaign.