Patent Issued for Privacy management systems and methods (USPTO 11195134): OneTrust LLC
2021 DEC 23 (NewsRx) -- By a
Patent number 11195134 is assigned to
The following quote was obtained by the news editors from the background information supplied by the inventors: “Over the past years, privacy and security policies, and related operations have become increasingly important. Breaches in security, leading to the unauthorized access of personal data (which may include sensitive personal data) have become more frequent among companies and other organizations of all sizes. Such personal data may include, but is not limited to, personally identifiable information (PII), which may be information that directly (or indirectly) identifies an individual or entity. Examples of PII include names, addresses, dates of birth, social security numbers, and biometric identifiers such as a person’s fingerprints or picture. Other personal data may include, for example, customers’ Internet browsing habits, purchase history, or even their preferences (e.g., likes and dislikes, as provided or obtained through social media).
“Many organizations that obtain, use, and transfer personal data, including sensitive personal data, have begun to address these privacy and security issues. To manage personal data, many companies have attempted to implement operational policies and processes that comply with legal requirements, such as Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) or the U.S.’s Health Insurance Portability and Accountability Act (HIPPA) protecting a patient’s medical information. Many regulators recommend conducting privacy impact assessments, or data protection risk assessments along with data inventory mapping. For example, the GDPR requires data protection impact assessments. Additionally, the United Kingdom ICO’s office provides guidance around privacy impact assessments. The OPC in
“In implementing these privacy impact assessments, an individual may provide incomplete or incorrect information regarding personal data to be collected, for example, by new software, a new device, or a new business effort, for example, to avoid being prevented from collecting that personal data, or to avoid being subject to more frequent or more detailed privacy audits. In light of the above, there is currently a need for improved systems and methods for monitoring compliance with corporate privacy policies and applicable privacy laws in order to reduce a likelihood that an individual will successfully “game the system” by providing incomplete or incorrect information regarding current or future uses of personal data.
“Organizations that obtain, use, and transfer personal data often work with other organizations (“vendors”) that provide services and/or products to the organizations. Organizations working with vendors may be responsible for ensuring that any personal data to which their vendors may have access is handled properly. However, organizations may have limited control over vendors and limited insight into their internal policies and procedures. Therefore, there is currently a need for improved systems and methods that help organizations ensure that their vendors handle personal data properly.”
In addition to the background information obtained for this patent, NewsRx journalists also obtained the inventors’ summary information for this patent: “A computer-implemented data processing method for monitoring one or more system inputs as input of information related to a privacy campaign, according to various embodiments, comprises: (A) actively monitoring, by one or more processors, one or more system inputs from a user as the user provides information related to a privacy campaign, the one or more system inputs comprising one or more submitted inputs and one or more unsubmitted inputs, wherein actively monitoring the one or more system inputs comprises: (1) recording a first keyboard entry provided within a graphical user interface that occurs prior to submission of the one or more system inputs by the user, and (2) recording a second keyboard entry provided within the graphical user interface that occurs after the user inputs the first keyboard entry and before the user submits the one or more system inputs; (B) storing, in computer memory, by one or more processors, an electronic record of the one or more system inputs; (C) analyzing, by one or more processors, the one or more submitted inputs and one or more unsubmitted inputs to determine one or more changes to the one or more system inputs prior to submission, by the user, of the one or more system inputs, wherein analyzing the one or more submitted inputs and the one or more unsubmitted inputs to determine the one or more changes to the one or more system inputs comprises comparing the first keyboard entry with the second keyboard entry to determine one or more differences between the one or more submitted inputs and the one or more unsubmitted inputs, wherein the first keyboard entry is an unsubmitted input and the second keyboard entry is a submitted input; (D) determining, by one or more processors, based at least in part on the one or more system inputs and the one or more changes to the one or more system inputs, whether the user has provided one or more system inputs comprising one or more abnormal inputs; and (E) at least partially in response to determining that the user has provided one or more abnormal inputs, automatically flagging the one or more system inputs that comprise the one or more abnormal inputs in memory.
“A computer-implemented data processing method for monitoring a user as the user provides one or more system inputs as input of information related to a privacy campaign, in various embodiments, comprises: (A) actively monitoring, by one or more processors, (i) a user context of the user as the user provides the one or more system inputs as information related to the privacy campaign and (ii) one or more system inputs from the user, the one or more system inputs comprising one or more submitted inputs and one or more unsubmitted inputs, wherein actively monitoring the user context and the one or more system inputs comprises recording a first user input provided within a graphical user interface that occurs prior to submission of the one or more system inputs by the user, and recording a second user input provided within the graphical user interface that occurs after the user inputs the first user input and before the user submits the one or more system input; (B) storing, in computer memory, by one or more processors, an electronic record of user context of the user and the one or more system inputs from the user; (C) analyzing, by one or more processors, at least one item of information selected from a group consisting of (i) the user context and (ii) the one or more system inputs from the user to determine whether abnormal user behavior occurred in providing the one or more system inputs, wherein determining whether the abnormal user behavior occurred in providing the one or more system inputs comprises comparing the first user input with the second user input to determine one or more differences between the one or more submitted inputs and the one or more unsubmitted inputs, wherein the first user input is an unsubmitted input and the second user input is a submitted input; and (D) at least partially in response to determining that abnormal user behavior occurred in providing the one or more system inputs, automatically flagging, in memory, at least a portion of the provided one or more system inputs in which the abnormal user behavior occurred.
“A computer-implemented data processing method for monitoring a user as the user provides one or more system inputs as input of information related to a privacy campaign, in various embodiments, comprises: (A) actively monitoring, by one or more processors, a user context of the user as the user provides the one or more system inputs, the one or more system inputs comprising one or more submitted inputs and one or more unsubmitted inputs, wherein actively monitoring the user context of the user as the user provides the one more system inputs comprises recording a first user input provided within a graphical user interface that occurs prior to submission of the one or more system inputs by the user, and recording a second user input provided within the graphical user interface that occurs after the user provides the first user input and before the user submits the one or more system inputs, wherein the user context comprises at least one user factor selected from a group consisting of: (i) an amount of time the user takes to provide the one or more system inputs, (ii) a deadline associated with providing the one or more system inputs, (iii) a location of the user as the user provides the one or more system inputs; and (iv) one or more electronic activities associated with an electronic device on which the user is providing the one or more system inputs; (B) storing, in computer memory, by one or more processors, an electronic record of the user context of the user; (C) analyzing, by one or more processors, the user context, based at least in part on the at least one user factor, to determine whether abnormal user behavior occurred in providing the one or more system inputs, wherein determining whether the abnormal user behavior occurred in providing the one or more system inputs comprises comparing the first user input with the second user input to determine one or more differences between the first user input and the second user input, wherein the first user input is an unsubmitted input and the second user input is a submitted input; and (D) at least partially in response to determining that abnormal user behavior occurred in providing the one or more system inputs, automatically flagging, in memory, at least a portion of the provided one or more system inputs in which the abnormal user behavior occurred.
“A computer-implemented data processing method for scanning one or more webpages to determine vendor risk, in various embodiments, comprises: (A) scanning, by one or more processors, one or more webpages associated with a vendor; (B) identifying, by one or more processors, one or more vendor attributes based on the scan; (C) calculating a vendor risk score based at least in part on the one or more vendor attributes; and (D) taking one or more automated actions based on the vendor risk rating.
“A computer-implemented data processing method for generating an incident notification for a vendor, according to particular embodiments, comprises: receiving, by one or more processors, an indication of a particular incident; determining, by one or more processors based on the indication of the particular incident, one or more attributes of the particular incident; determining, by one or more processors based on the one or more attributes of the particular incident, a vendor associated with the particular incident; determining, by one or more processors based on the vendor associated with the particular incident, a notification obligation for the vendor associated with the particular incident; generating, by one or more processors in response to determining the notification obligation, a task associated with satisfying the notification obligation; presenting, by one or more processors on a graphical user interface, an indication of the task associated with satisfying the notification obligation; detecting, by one or more processors on a graphical user interface, a selection of the indication of the task associated with satisfying the notification obligation; and presenting, by one or more processors on a graphical user interface, detailed information associated with the task associated with satisfying the notification obligation.”
The claims supplied by the inventors are:
“1. A computer-implemented data processing method for determining data breach response activities, the method comprising: generating, by one or more computer processors, a data breach information interface soliciting data breach information comprising a number of affected data subjects and an affected business sector; presenting, by one or more computer processors on a graphical user interface, the data breach information interface to a user; receiving, by one or more computer processors via the data breach information interface, the data breach information comprising the number of affected data subjects and the affected business sector; determining, by one or more computer processors, based at least in part on the affected business sector, a first plurality of data breach response requirements for a first affected jurisdiction; determining, by one or more computer processors, based at least in part on the affected business sector, a second plurality of data breach response requirements for a second affected jurisdiction; generating, by one or more computer processors, an ontology mapping a first requirement of the first plurality of data breach response requirements to a second requirement of the second plurality of data breach response requirements; generating, by one or more computer processors, a master questionnaire comprising a master question; mapping, by one or more computer processors, the first requirement of the first plurality of data breach response requirements to the master question in the ontology; mapping, by one or more computer processors, the second requirement of the second plurality of data breach response requirements to the master question; determining, by one or more computer processors, data responsive to the master question based at least in part on the data breach information; associating, by one or more computer processors, the data responsive to the master question with the first requirement of the first plurality of data breach response requirements in the ontology; associating, by one or more computer processors, the data responsive to the master question with the second requirement of the second plurality of data breach response requirements in the ontology; determining, by one or more computer processors, based at least in part on the data breach information, whether to generate a first data breach disclosure report for the first affected jurisdiction; and at least partially in response to determining to generate the first data breach disclosure report for the first affected jurisdiction, generating, by one or more computer processors, based at least in part on the data breach information, the first data breach disclosure report comprising the data responsive to the master question.
“2. The computer-implemented data processing method of claim 1, wherein determining whether to generate the first data breach disclosure report for the first affected jurisdiction is further based at least in part on the number of affected data subjects.
“3. The computer-implemented data processing method of claim 1, further comprising: determining, by one or more computer processors, based at least in part on the data breach information, to not generate a second data breach disclosure report for the second affected jurisdiction.
“4. The computer-implemented data processing method of claim 3, wherein determining not to generate the second data breach disclosure report for the second affected jurisdiction is further based at least in part on the number of affected data subjects.
“5. The computer-implemented data processing method of claim 3, wherein determining not to generate the second data breach disclosure report for the second affected jurisdiction is further based at least in part on a business value of the second affected jurisdiction.
“6. The computer-implemented data processing method of claim 3, wherein determining not to generate the second data breach disclosure report for the second affected jurisdiction is further based at least in part on a penalty for failing to address the second plurality of data breach response requirements for the second affected jurisdiction.
“7. The computer-implemented data processing method of claim 1, wherein the first plurality of data breach response requirements comprises one or more requirements selected from a group consisting of: (a) generating a notification to a regulatory agency; (b) generating a notification to affected data subjects; or © generating a notification to an internal organization.
“8. A non-transitory computer-readable medium storing computer-executable instructions for determining data breach response activities, the computer-executable instructions comprising instructions for: generating, by one or more computer processors, a data breach information interface soliciting data breach information comprising an affected business sector; presenting, by one or more computer processors on a graphical user interface, the data breach information interface to a user; receiving, by one or more computer processors via the data breach information interface, the data breach information comprising the affected business sector; determining, by one or more computer processors, based at least in part on the affected business sector, a first plurality of data breach response requirements for a first affected jurisdiction; determining, by one or more computer processors, based at least in part on the affected business sector, a second plurality of data breach response requirements for a second affected jurisdiction; presenting, by one or more computer processors to the user, a data breach response interface comprising a plurality of checklist items, wherein each checklist item of the plurality of checklist items corresponds to at least one of a requirement of the first plurality of data breach response requirements for the first affected jurisdiction and a requirement of the second plurality of data breach response requirements for the second affected jurisdiction; detecting, by one or more computer processors, an activation by the user of a first checklist item of the plurality of checklist items; determining, by one or more computer processors, a first data breach response requirement of the first plurality of data breach response requirements for the first affected jurisdiction corresponding to the first checklist item; determining, by one or more computer processors, a second data breach response requirement of the second plurality of data breach response requirements for the second affected jurisdiction corresponding to the first checklist item; storing, in a memory by one or more computer processors, an indication of completion of the first data breach response requirement; storing, in the memory by one or more computer processors, an indication of completion of the second data breach response requirement; determining, by one or more computer processors, based at least in part on the data breach information, whether to generate a first data breach disclosure report for the first affected jurisdiction; and at least partially in response to determining to generate the first data breach disclosure report for the first affected jurisdiction, generating, by one or more computer processors, based at least in part on the data breach information, the first data breach disclosure report comprising the indication of completion of the first data breach response requirement.
“9. The non-transitory computer-readable medium of claim 8, wherein determining whether to generate the first data breach disclosure report for the first affected jurisdiction is further based at least in part on a penalty for failing to address the first plurality of data breach response requirements for the first affected jurisdiction.
“10. The non-transitory computer-readable medium of claim 8, wherein determining whether to generate the first data breach disclosure report for the first affected jurisdiction is further based at least in part on a number of affected users.
“11. The non-transitory computer-readable medium of claim 8, wherein determining whether to generate the first data breach disclosure report for the first affected jurisdiction is further based at least in part on a business value of the first affected jurisdiction.
“12. The non-transitory computer-readable medium of claim 8, wherein the computer-executable instructions further comprise instructions for: determining, by one or more computer processors, based at least in part on the data breach information, to not generate a second data breach disclosure report for the second affected jurisdiction.
“13. The non-transitory computer-readable medium of claim 8, wherein the data breach information comprises one or more pieces of information selected from a group consisting of: (a) a number of affected users; (b) a data breach discovery date; © a data breach discovery time; (d) a data breach occurrence date; (e) a data breach occurrence time; (f) a personal data type; and (g) a data breach discovery method.
“14. The non-transitory computer-readable medium of claim 8, wherein the data breach information interface is presented to the user via a web browser.”
There are additional claims. Please visit full patent to read further.
URL and more information on this patent, see: Brannon,
(Our reports deliver fact-based news of research and discoveries from around the world.)
Patent Application Titled “Methodology For Blinded Messaging” Published Online (USPTO 20210385197): Patent Application
Anti-cancer Insurance Market is Booming with Strong Growth Prospects | Leading Players: Allianz, MetLife, Axa
Advisor News
- Surpassing expectations: How planning helps clients with their financial goals
- Retirement regrets spark financial resolutions for the new year
- Wealth management: why some insurance companies are opting out of a lucrative opportunity
- Middle-income households exceeding retirement savings expectations
- How SECURE impacts inherited IRA beneficiaries
More Advisor NewsAnnuity News
Health/Employee Benefits News
- Woman Arrested and Charged for “Threatening” Insurance Co. by Saying “Delay, Deny, Depose”
- Suspect in the killing of UnitedHealthcare CEO did not have insurance coverage from the company
- UnitedHealth Group CEO admits more transparency is needed in insurance industry
- Rep. AOC says denying health care coverage can be seen as ‘act of violence’
- Data on Breast Cancer Described by Researchers at University of Texas MD Anderson Cancer Center (Real-world Neoadjuvant and Adjuvant Trastuzumab-containing Regimen Patterns and Their Association With Survival Among Patients With Operable …): Oncology – Breast Cancer
More Health/Employee Benefits NewsLife Insurance News