Patent Application Titled “Protective Deactivation Of Gdpr Wallet” Published Online (USPTO 20230409720): Patent Application

2024 JAN 04 (NewsRx) -- By a News Reporter-Staff News Editor at Insurance Daily News -- According to news reporting originating from Washington, D.C., by NewsRx journalists, a patent application by the inventors Pacino, II, Alcides O. (Cedar Park, TX, US), filed on June 21, 2022, was made available online on December 21, 2023.

No assignee for this patent application has been made.

Reporters obtained the following quote from the background information supplied by the inventors: “

“Field of the Invention

“The present invention generally relates to methods and systems for maintaining private data, and more particularly to methods and systems of protecting access to private data.

“Description of the Related Art

“In the last few years there has been an increasing trend to recognize the value and inherent ownership of personal, private data. One of the primary examples is a recent European Union law known as the General Data Protection Regulation, or GDPR (regulation 2016/679 of the European Parliament). It aims to simplify the regulatory environment for business so both citizens and businesses can fully benefit from the digital economy. The reforms embodied by GDPR are designed to reflect current world views concerning personal data, privacy and consent.

“Fundamentally, almost every aspect of our lives revolves around data. From social media companies, to banks, retailers, and governments, almost every service we use involves the collection and analysis of our personal data. A person’s name, address, credit card number and much more are all collected, analyzed and, perhaps most importantly, stored by sundry organizations. GDPR makes it a requirement that anyone using such data previously receive consent from the person involved (the data subject), and store it in a manner that ensures compliance with privacy requirements. Failure to comply with GDPR can result in significant fines. The types of data considered personal not only include basic things like name and address, but further extend to photos of the person, genetic information, biometrics (body measurements related to human characteristics), and even something like an Internet (IP) address associated with the individual. GDPR also includes a “right to be forgotten”, or right to erasure, which means a person can demand that any of their information being held by an entity be permanently deleted.

“GDPR is not the only regulation pertaining to privacy of data. Many countries have other versions; in the United States, the Health Insurance Portability and Accountability Act (HIPAA) is one example. There are also state-by-state laws, such as the California Consumer Privacy Act. Software has been designed to implement these laws in various ways. For instance, an institution seeking permission for access to personal information can present an interface to the person explaining the intended usage and asking the person to consent, and after consent is confirmed, the personal data can be transferred to the institution.”

In addition to obtaining background information on this patent application, NewsRx editors also obtained the inventors’ summary information for this patent application: “The present invention in at least one embodiment is generally directed to a computer-implemented method of deactivating access to a private data repository uniquely associated with an individual by constructing the private data repository in a records management system of a computer server by compiling a plurality of electronic records having personal information pertaining to the individual wherein each electronic record has a respective timestamp, granting access rights for all of the electronic records in the private data repository to one or more consumers, receiving a selective command from the individual at the records management system which identifies a selected one of the consumers and requests selective deactivation of access rights granted to the selected consumer, establishing a selective deactivation date for the selected consumer regarding access to the private data repository, and prohibiting access by the selected consumer to any of the electronic records having a timestamp subsequent to the selective deactivation date while maintaining access by the selected consumer to any of the electronic records which have a timestamp prior to the selective deactivation date. In the illustrative implementation a given electronic record includes a content date associated with a subject of the given electronic record, an upload date that the given electronic record was added into the private data repository, a shared date that the given electronic record was first shared by the individual with one of the consumers, and a verification date that the given electronic record was verified by a third party, and each of the content date, upload date, shared date and verification date are different. The timestamp could be the upload date or the shared date. In a preferred embodiment the method further includes receiving a global command from the individual at the records management system requesting deactivation of access rights granted to all of the consumers, establishing a global deactivation date for all of the consumers except the selected consumer regarding access to the private data repository, and prohibiting access by all of the consumers except the selected consumer to any of the electronic records having a timestamp subsequent to the global deactivation date while maintaining access by all of the consumers except the selected consumer to any of the electronic records which have a timestamp prior to the global deactivation date. If the individual has previously consented to a minimum retention period of the private data repository for at least one of the consumers, then a minimum retention date can be computed based on the minimum retention period and, when the minimum retention date has passed, all of the electronic records in the private data repository can be permanently deleted.

“The above as well as additional objectives, features, and advantages in the various embodiments of the present invention will become apparent in the following detailed written description.

“The use of the same reference symbols in different drawings indicates similar or identical items.”

The claims supplied by the inventors are:

“1. A computer-implemented method of deactivating access to a private data repository uniquely associated with an individual comprising: constructing the private data repository in a records management system of a computer server by compiling a plurality of electronic records having personal information pertaining to the individual wherein each electronic record has a respective timestamp; granting access rights for all of the electronic records in the private data repository to one or more consumers; receiving a selective command from the individual at the records management system which identifies a selected one of the consumers and requests selective deactivation of access rights granted to the selected consumer; establishing a selective deactivation date for the selected consumer regarding access to the private data repository; and prohibiting access by the selected consumer to any of the electronic records having a timestamp subsequent to the selective deactivation date while maintaining access by the selected consumer to any of the electronic records which have a timestamp prior to the selective deactivation date.

“2. The computer-implemented method of claim 1 wherein: a given electronic record includes a content date associated with a subject of the given electronic record, an upload date that the given electronic record was added into the private data repository, a shared date that the given electronic record was first shared by the individual with one of the consumers, and a verification date that the given electronic record was verified by a third party; and each of the content date, upload date, shared date and verification date are different.

“3. The computer-implemented method of claim 2 wherein the timestamp is the upload date.

“4. The computer-implemented method of claim 2 wherein the timestamp is the shared date.

“5. The computer-implemented method of claim 1 further comprising: receiving a global command from the individual at the records management system requesting deactivation of access rights granted to all of the consumers; establishing a global deactivation date for all of the consumers except the selected consumer regarding access to the private data repository; and prohibiting access by all of the consumers except the selected consumer to any of the electronic records having a timestamp subsequent to the global deactivation date while maintaining access by all of the consumers except the selected consumer to any of the electronic records which have a timestamp prior to the global deactivation date.

“6. The computer-implemented method of claim 5 wherein the individual has previously consented to a minimum retention period of the private data repository for at least one of the consumers, and further comprising computing a minimum retention date based on the minimum retention period; determining that the minimum retention date has passed; and responsive to said determining, permanently deleting all of the electronic records in the private data repository.

“7. The computer-implemented method of claim 1 further comprising: constructing a private data directory for the selected consumer wherein the private data directory includes an entry for the individual which provides through a directory interface both access to the private data repository and a communications link between the selected consumer and the individual; and maintaining the communications link after initiating said prohibiting access.

“8. The computer-implemented method of claim 7 wherein the private data directory interface provides an indication to the selected consumer that the individual has deactivated access rights granted to the selected consumer.

“9. The computer-implemented method of claim 1 further comprising: after said prohibiting access, receiving a reinstatement request to reinstate the deactivated access rights of the selected consumer; and allowing access by the selected consumer to all of the electronic records without regard to their timestamps.

“10. The computer-implemented method of claim 9 further comprising: in response to receiving the reinstatement request, determining by the records management system that a payment is required from the selected consumer before granting access to the private data repository; sending a notification to the selected consumer regarding the reinstatement request; and receiving an acknowledgment of reinstatement permitting the payment from the selected consumer, wherein said allowing access occurs only after said receiving of the acknowledgement.

“11. A computer system comprising: one or more processors which process program instructions; a memory device connected to said one or more processors, said memory device having stored therein a plurality of private data wallets wherein a given private data wallet is associated with a respective individual and includes a plurality of electronic records having personal information pertaining to the respective individual, a plurality of site directories wherein a first site directory is constructed from a first set of the private data wallets and each of the individuals associated with the first set of the private data wallets is a participant in a first project at a first site, and wherein a second site directory is constructed from a second set of the private data wallets and each of the individuals associated with the second set of the private data wallets is a participant in a second project at a second site, and a sponsor directory constructed from at least the first and second site directories such that each private data wallet in the first set and the second set becomes a real-time data source for the sponsor directory wherein the first site and the second site are both part of a common undertaking; and program instructions residing in said memory device for providing a first user interface to each of the individuals wherein the first user interface allows a particular individual to upload the electronic records to the private data wallet of the particular individual and separately authorize sharing of a specific one of the electronic records in the private data wallet of the particular individual, and providing a second user interface to operators of each of the site directories and the sponsor directory wherein the second user interface allows one of the operators of a particular directory to view the electronic records of any of the private data wallets in the particular directory.

“12. The computer system of claim 11 wherein each electronic record has a respective timestamp, and said program instructions further: receive a selective command from the particular individual which identifies a selected one of the sites and requests selective deactivation of access rights for the electronic records in the private data wallet of the particular individual granted to the selected site; establish a selective deactivation date for the selected site regarding access to the private data wallet of the particular individual; and prohibit access by the selected site to any of the electronic records in the private data wallet of the particular individual having a timestamp subsequent to the selective deactivation date while maintaining access by the selected site to any of the electronic records in the private data wallet of the particular individual which have a timestamp prior to the selective deactivation date.

“13. The computer system of claim 12 wherein: a given electronic record includes a content date associated with a subject of the given electronic record, an upload date that the given electronic record was added into the private data repository, a shared date that the given electronic record was first shared by the individual with one of the consumers, and a verification date that the given electronic record was verified by a third party; and each of the content date, upload date, shared date and verification date are different.

“14. The computer system of claim 13 wherein the timestamp is the upload date.

“15. The computer system of claim 12 wherein said program instructions further: receive a global command from the individual at the records management system requesting deactivation of access rights granted to all of the consumers; establish a global deactivation date for all of the consumers except the selected consumer regarding access to the private data repository; and prohibit access by all of the consumers except the selected consumer to any of the electronic records having a timestamp subsequent to the global deactivation date while maintaining access by all of the consumers except the selected consumer to any of the electronic records which have a timestamp prior to the global deactivation date.

“16. The computer system of claim 15 wherein the individual has previously consented to a minimum retention period of the private data repository for at least one of the consumers, and said program instructions further: compute a minimum retention date based on the minimum retention period; determine that the minimum retention date has passed; and permanently delete all of the electronic records in the private data repository.

“17. The computer system of claim 12 wherein said program instructions further: construct a private data directory for the selected consumer wherein the private data directory includes an entry for the individual which provides through a directory interface both access to the private data repository and a communications link between the selected consumer and the individual; and maintain the communications link after prohibiting access.

“18. The computer system of claim 17 wherein the private data directory interface provides an indication to the selected consumer that the individual has deactivated access rights granted to the selected consumer.”

There are additional claims. Please visit full patent to read further.

For more information, see this patent application: Pacino, II, Alcides O. Protective Deactivation Of Gdpr Wallet. U.S. Patent Application Number 20230409720, filed June 21, 2022 and posted December 21, 2023. Patent URL (for desktop use only): https://ppubs.uspto.gov/pubwebapp/external.html?q=(20230409720)&db=US-PGPUB&type=ids

(Our reports deliver fact-based news of research and discoveries from around the world.)