Data processing systems and methods for automatically detecting and documenting privacy-related aspects of computer software

Patent metadata

Field	Value
Publication number	US-11138242-B2
Application number	US-202016865874-A
Country	US
Kind code	B2
Filing date	May 4, 2020
Priority date	Jun 10, 2016
Publication date	Oct 5, 2021
Grant date	Oct 5, 2021

Abstract

Data processing systems and methods according to various embodiments are adapted for automatically detecting and documenting privacy-related aspects of computer software. Particular embodiments are adapted for: (1) automatically scanning source code to determine whether the source code include instructions for collecting personal data; and (2) facilitating the documentation of the portions of the code that collect the personal data. For example, the system may automatically prompt a user for comments regarding the code. The comments may be used, for example, to populate: (A) a privacy impact assessment; (B) system documentation; and/or (C) a privacy-related data map. The system may comprise, for example, a privacy comment plugin for use in conjunction with a code repository.

First claim

What is claimed is:

1. A data processing computer system for automatically analyzing computer code to determine whether computer software associated with the computer code collects personal data, the system comprising:
at least one computer processor; and
a computer memory storing computer-executable instructions for:
extracting one or more comments from a file containing at least one segment of the computer code;
determining, based on the one or more comments, that the computer code comprises instructions for collecting one or more pieces of the personal data;
in response to determining that the computer code comprises instructions for collecting the one or more pieces of the personal data,
extracting, from the one or more comments, particular information comprising at least one of:
(1) where the system stores the one or more pieces of the personal data;
(2) how long the system stores the one or more pieces of the personal data;
(3) an indication of whether the one or more pieces of the personal data will include personal data of minors; or
(4) an indication of whether the at least one segment of the computer code comprises instructions for facilitating a transfer of the one or more pieces of the personal data across one or more geographic borders; and

at least partially in response to determining that the computer code comprises instructions for collecting the one or more pieces of the personal data, using the particular information extracted from the one or more comments to populate at least one data model with the particular information, wherein:
the at least one data model comprises a respective digital inventory for each of a plurality of data assets including the computer software associated with the computer code; and
each respective digital inventory comprises an identifier for one or more pieces of the personal data that are collected by the respective data asset.

2. The data processing computer system of claim 1 , wherein the computer memory further stores computer-executable instructions for:
automatically analyzing the at least one segment of the computer code to determine a particular type of the personal data the at least one segment of the computer code collects; and
automatically extracting, from the one or more comments, specific information as to why the at least one segment of the computer code comprises instructions for collecting the particular type of the personal data.

3. The data processing computer system of claim 2 , wherein the computer memory further stores computer-executable instructions for:
at least partially in response to extracting the specific information, using the specific information to populate at least one question within one or more questionnaires used in conducting a privacy impact assessment for the computer software associated with the computer code.

4. The data processing computer system of claim 1 , wherein the computer memory further stores computer-executable instructions for generating a privacy-related data map based on the at least one data model.

5. The data processing computer system of claim 1 , wherein the computer memory further stores computer-executable instructions for using the particular information to automatically write at least a portion of the particular information to an electronic record that is used to document a functionality of the computer code.

6. The data processing computer system of claim 1 , wherein the each respective digital inventory further comprises at least one additional piece of information comprising at least one of:
(1) where the system stores the one or more pieces of the personal data that are collected by the respective data asset;
(2) how long the system stores the one or more pieces of the personal data that are collected by the respective data asset;
(3) an indication of whether the one or more pieces of the personal data that are collected by the respective data asset includes the personal data of minors; or
(4) an indication of whether the respective data asset facilitates the transfer of the one or more pieces of the personal data that are collected by the respective data asset across one or more geographic borders.

7. The data processing computer system of claim 1 , wherein a respective digital inventory for a particular data asset of the plurality of data assets comprises:
(1) an inventory attribute identifying one or more processing activities associated with the particular data asset; and
(2) an inventory attribute identifying transfer data associated with the particular data asset.

8. A computer-implemented data processing method for automatically analyzing computer code to determine whether computer software associated with the computer code collects personal data, the method comprising:
analyzing, by one or more computer processors, at least one segment of the computer code associated with the computer software to determine whether the at least one segment of the computer code comprises instructions for collecting one or more pieces of the personal data by:
extracting, by the one or more computer processors, one or more comments from a file containing the at least one segment of the computer code; and
determining, by the one or more computer processors based at least in part on the one or more comments, that the at least one segment of the computer code comprises instructions for collecting the one or more pieces of the personal data;

in response to determining that the at least one segment of the computer code comprises instructions for collecting the one or more pieces of the personal data, extracting, by the one or more computer processors from the one or more comments, particular information comprising at least one of:
(1) a location at which a system executing the computer software stores the one or more pieces of the personal data;
(2) an amount of time for which the system executing the computer software stores the one or more pieces of the personal data;
(3) an indication of whether the one or more pieces of the personal data will include personal data of minors; or
(4) an indication of whether the at least one segment of the computer code comprises instructions for facilitating the transfer of the one or more pieces of the personal data across geographic borders; and
using the particular information from the one or more comments, at least partially answering, by the one or more computer processors, one or more questions within one or more questionnaires used in conducting a privacy impact assessment for the computer software associated with the computer code, wherein:
a first piece of the particular information is used to answer a first question of the one or more questions associated with a particular data asset; and
a second piece of the particular information is used to answer a second question of the one or more questions associated with a particular processing activity.

9. The computer-implemented data processing method of claim 8 , wherein the particular information comprises:
(1) a piece of information indicating the location at which a system executing the computer software stores the one or more pieces of the personal data; and
(2) an amount of time after which the one or more pieces of the personal data will be deleted.

10. The computer-implemented data processing method of claim 8 , further comprising automatically storing at least a portion of the particular information in an electronic record comprising documentation describing the functionality of the computer code.

11. The computer-implemented data processing method of claim 8 , further comprising mapping the first question of the one or more questions to a particular invent

Assignees

• Onetrust Llc

Inventors

• Malhotra Priya
• Barday Kabir A
• Karanjkar Mihir S
• Finch Steven W
• Browne Ken A
• Heard Nathan W
• Patel Aakash H
• Sabourin Jason L
• Daniel Richard L
• Patton-Kuhl Dylan D
• Brannon Jonathan Blake

Classifications

• H04L63/04

  for providing a confidential data exchange among entities communicating through data packet networks · CPC title

• G06F21/552

  involving long-term monitoring or reporting · CPC title

• H04L67/306

  User profiles · CPC title

• G06Q10/06 Primary

  Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling · CPC title

• G06N20/00

  Machine learning · CPC title