Patent Application Titled “Privacy Management Systems And Methods” Published Online (USPTO 20210312353): OneTrust LLC
2021 OCT 26 (NewsRx) -- By a
The assignee for this patent application is
Reporters obtained the following quote from the background information supplied by the inventors: “Over the past years, privacy and security policies, and related operations have become increasingly important. Breaches in security, leading to the unauthorized access of personal data (which may include sensitive personal data) have become more frequent among companies and other organizations of all sizes. Such personal data may include, but is not limited to, personally identifiable information (PII), which may be information that directly (or indirectly) identifies an individual or entity. Examples of PII include names, addresses, dates of birth, social security numbers, and biometric identifiers such as a person’s fingerprints or picture. Other personal data may include, for example, customers’ Internet browsing habits, purchase history, or even their preferences (e.g., likes and dislikes, as provided or obtained through social media).
“Many organizations that obtain, use, and transfer personal data, including sensitive personal data, have begun to address these privacy and security issues. To manage personal data, many companies have attempted to implement operational policies and processes that comply with legal requirements, such as Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) or the U.S.’s Health Insurance Portability and Accountability Act (HIPPA) protecting a patient’s medical information. Many regulators recommend conducting privacy impact assessments, or data protection risk assessments along with data inventory mapping. For example, the GDPR requires data protection impact assessments. Additionally, the United Kingdom ICO’s office provides guidance around privacy impact assessments. The OPC in
“In implementing these privacy impact assessments, an individual may provide incomplete or incorrect information regarding personal data to be collected, for example, by new software, a new device, or a new business effort, for example, to avoid being prevented from collecting that personal data, or to avoid being subject to more frequent or more detailed privacy audits. In light of the above, there is currently a need for improved systems and methods for monitoring compliance with corporate privacy policies and applicable privacy laws in order to reduce a likelihood that an individual will successfully “game the system” by providing incomplete or incorrect information regarding current or future uses of personal data.
“Organizations that obtain, use, and transfer personal data often work with other organizations (“vendors”) that provide services and/or products to the organizations. Organizations working with vendors may be responsible for ensuring that any personal data to which their vendors may have access is handled properly. However, organizations may have limited control over vendors and limited insight into their internal policies and procedures. Therefore, there is currently a need for improved systems and methods that help organizations ensure that their vendors handle personal data properly.
“Many organizations offer multiple services to customers and other users. Because each such service may use personal data (e.g., collect personal data, store personal data, retain personal data, etc.) across many different jurisdictions, the risks posed by a potential data breach related to those services may be great. Moreover, the geographical location of users of such services may vary, which may also affect the response requirements that may apply to a data breach in different jurisdictions. Therefore, there is currently a need for improved systems and methods of for handling intrusions or errors that lead to an exposure of data.”
In addition to obtaining background information on this patent application, NewsRx editors also obtained the inventors’ summary information for this patent application: “A method, in various embodiments, comprises: (1) determining, by computing hardware, data breach response requirements for each affected jurisdiction for a data breach; (2) obtaining, by the computing hardware, data breach response prioritization data; (3) generating, by the computing hardware and based on evaluating the data breach response requirements against the data breach response prioritization data, a graphical user interface by configuring a first navigation element on the graphical user interface and excluding a second navigation element from the graphical user interface; (4) transmitting, by the computing hardware, a first instruction to a user device to present the graphical user interface on the user device; (5) detecting, by the computing hardware, a selection of a first navigation element; and (6) in response to detecting the selection of the first navigation element, transmitting, by the computing hardware, a second instruction to the user device causing the user device to retrieve and present a first display element on the user device. In particular embodiments: (1) the first navigation element is configured for navigating to a first display element that presents a first data breach response requirement, and (2) the second navigation element is configured for navigating to a second display element that presents a second data breach response requirement.
“In particular embodiments, a system comprises a non-transitory computer-readable medium storing instructions; and processing hardware communicatively coupled to the non-transitory computer-readable medium. In various embodiments, the processing hardware is configured to execute the instructions and thereby perform operations comprising: (1) identifying data breach data and affected jurisdictions for a data breach; (2) determining data breach response requirements for each of the affected jurisdictions based on the data breach data; (3) obtaining data breach response prioritization data; (4) generating a response plan for the data breach by evaluating the data breach response requirements against the data breach response prioritization data; (5) generating, based on the response plan, a graphical user interface by configuring a first set of navigation elements on the graphical user interface and excluding a second set of navigation elements from the graphical user interface, wherein: (A) each respective navigation element of the first set of navigation elements is configured for navigating to a different respective display element that presents a first different respective data breach response requirement, and (B) each respective navigation element of the second set of navigation elements is configured for navigating to a different respective display element that presents a second different respective data breach response requirement, and; (6) transmitting a first instruction to a user device to present the graphical user interface on the user device; (7) detecting a selection of a first navigation element of the first set of navigation elements; and (8) in response to detecting the selection of the first navigation element, transmitting a second instruction to the user device causing the user device to retrieve and present the respective display element for the first navigation element on the user device.
“In still other embodiments, a system comprises a non-transitory computer-readable medium storing instructions; and processing hardware communicatively coupled to the non-transitory computer-readable medium. In various embodiments, the processing hardware is configured to execute the instructions and thereby perform operations comprising: (1) identifying data breach data and affected jurisdictions for a data breach; (2) determining data breach response requirements for each of the affected jurisdictions based on the data breach data; (3) obtaining data breach response prioritization data; (4) generating a response plan for the data breach by evaluating the data breach response requirements against the data breach response prioritization data; and (5) causing performance of one of the data breach response requirements according to the response plan.
“The details of one or more embodiments of the subject matter described in this specification are set forth in the accompanying drawings and the description below. Other features, aspects, and advantages of the subject matter may become apparent from the description, the drawings, and the claims.”
The claims supplied by the inventors are:
“1. A method comprising: determining, by computing hardware, data breach response requirements for each affected jurisdiction for a data breach; obtaining, by the computing hardware, data breach response prioritization data; generating, by the computing hardware and based on evaluating the data breach response requirements against the data breach response prioritization data, a graphical user interface by configuring a first navigation element on the graphical user interface and excluding a second navigation element from the graphical user interface, wherein: the first navigation element is configured for navigating to a first display element that presents a first data breach response requirement, and the second navigation element is configured for navigating to a second display element that presents a second data breach response requirement; transmitting, by the computing hardware, a first instruction to a user device to present the graphical user interface on the user device; detecting, by the computing hardware, a selection of the first navigation element; and in response to detecting the selection of the first navigation element, transmitting, by the computing hardware, a second instruction to the user device causing the user device to retrieve and present the first display element on the user device.
“2. The method of claim 1, wherein: generating the graphical user interface further comprises: configuring a third navigation element on the graphical user interface, wherein the third navigation element is configured for navigating to a third display element that presents a third data breach response requirement; and positioning the first navigation element and the third navigation element on the graphical user interface based on evaluating the data breach response requirements against the data breach response prioritization data.
“3. The method of claim 2, further comprising: determining, by the computing hardware, that the third data breach response requirement has been completed; and responsive to determining that the third data breach response requirement has been completed, modifying, by the computing hardware, the graphical user interface to exclude the third navigation element.
“4. The method of claim 1, wherein: the method further comprises, obtaining, by the computing hardware, data breach requirement enforcement data for each affected jurisdiction; and generating the graphical user interface is further based on evaluating the data breach response requirements against the data breach requirement enforcement data for each affected jurisdiction.
“5. The method of claim 1, wherein the data breach response prioritization data comprises: a ranking of each of the affected jurisdictions; and at least one of: penalty data for each respective data breach response requirement, and enforcement frequency data for each of the affected jurisdictions.
“6. The method of claim 1, wherein: the method further comprises determining, by the computing hardware, a respective prioritization score for each affected jurisdiction based on at least one of penalty data for each affected jurisdiction, deadline data for each affected jurisdiction, and a number of data subjects affected by the data breach in each affected jurisdiction; and generating the graphical user interface is further based on the respective prioritization score for each affected jurisdiction.
“7. The method of claim 6, further comprising modifying each respective prioritization score based on a user-provided weighting factor for each affected jurisdiction.
“8. A system comprising: a non-transitory computer-readable medium storing instructions; and processing hardware communicatively coupled to the non-transitory computer-readable medium, wherein the processing hardware is configured to execute the instructions and thereby perform operations comprising: identifying data breach data and affected jurisdictions for a data breach; determining data breach response requirements for each of the affected jurisdictions based on the data breach data; obtaining data breach response prioritization data; generating a response plan for the data breach by evaluating the data breach response requirements against the data breach response prioritization data; generating, based on the response plan, a graphical user interface by configuring a first set of navigation elements on the graphical user interface and excluding a second set of navigation elements from the graphical user interface, wherein: each respective navigation element of the first set of navigation elements is configured for navigating to a different respective display element that presents a first different respective data breach response requirement, and each respective navigation element of the second set of navigation elements is configured for navigating to a different respective display element that presents a second different respective data breach response requirement; transmitting a first instruction to a user device to present the graphical user interface on the user device; detecting a selection of a first navigation element of the first set of navigation elements; and in response to detecting the selection of the first navigation element, transmitting a second instruction to the user device causing the user device to retrieve and present the respective display element for the first navigation element on the user device.
“9. The system of claim 8, wherein the processing hardware is further configured to perform operations comprising: completing a first data breach response requirement; and responsive to performing the first data breach response requirement, modifying the graphical user interface by excluding a second navigation element from the first set of navigation elements, wherein the second navigation element is configured for navigating to a second display element that presents the first data breach response requirement.
“10. The system of claim 8, wherein: a third navigation element of the first set of navigation elements displays a completion status of a second data breach response requirement; and the method further comprises: causing performance of the second data breach response requirement; and responsive to causing the performance of the second data breach response requirement, modifying, by the computing hardware, the third navigation element to indicate the completion status of the second data breach response requirement to reflect the performance of the second data breach response requirement.
“11. The system of claim 8, wherein: the processing hardware is further configured to perform operations comprising, obtaining data breach requirement enforcement data for each of the affected jurisdictions; and generating the response plan for the data breach is further based on evaluating the data breach response requirements against the data breach requirement enforcement data for each of the affected jurisdictions.
“12. The system of claim 8, wherein the data breach response prioritization data comprises a user-provided prioritization of each of the affected jurisdictions.
“13. The system of claim 8, wherein the response plan comprises an ordered listing of at least one of the data breach response requirements.
“14. The system of claim 8, wherein configuring the first set of navigation elements on the graphical user interface comprises configuring each respective navigation element of the first set of navigation elements according to the response plan.
“15. A system comprising: a non-transitory computer-readable medium storing instructions; and processing hardware communicatively coupled to the non-transitory computer-readable medium, wherein the processing hardware is configured to execute the instructions and thereby perform operations comprising: identifying data breach data and affected jurisdictions for a data breach; determining data breach response requirements for each of the affected jurisdictions based on the data breach data; obtaining data breach response prioritization data; generating a response plan for the data breach by evaluating the data breach response requirements against the data breach response prioritization data; and causing performance of one of the data breach response requirements according to the response plan.
“16. The system of claim 15, wherein the processing hardware is further configured to perform operations comprising performing each of the data breach response requirements according to the response plan.
“17. The system of claim 15, wherein: a first response requirement for a first jurisdiction conflicts with a second response requirement for a second jurisdiction; and generating the response plan comprises evaluating the first response requirement and the second response requirement against the data breach response prioritization data to determine which of the first response requirement and the second response requirement to include in the response plan.”
There are additional claims. Please visit full patent to read further.
For more information, see this patent application: Brannon,
(Our reports deliver fact-based news of research and discoveries from around the world.)
“Systems And Methods For Automatic Breakdown Detection And Roadside Assistance” in Patent Application Approval Process (USPTO 20210314753): Allstate Insurance Company
Patent Issued for Obscuring facial features of a subject in an image (USPTO 11138778): Koninklijke Philips N.V.
Advisor News
- Your client’s $3 million portfolio doesn’t tell you their insurance needs
- How life insurance can provide liquidity for wealthy families
- Retirement providers turn to digital engagement to retain assets
- Looking out for clients with diminished mental capacity
- House panel advances CLEAR Forms Act backed by IRI
More Advisor NewsAnnuity News
- What lower interest rates mean to annuity payouts
- AM Best downgrades A-Cap insurers amid financial and regulatory troubles
- Lawsuit claims Delaware Life hid billions in insurer-linked investments
- AM Best to Deliver Presentation at 2026 ACLI Annual Conference
- Global Atlantic Announces Launch of ForeLifetime Income, a New Fixed Index Annuity
More Annuity NewsHealth/Employee Benefits News
Life Insurance News