Data subject access request processing systems and related methods

Patent metadata

Field	Value
Publication number	US-11210420-B2
Application number	US-202016881832-A
Country	US
Kind code	B2
Filing date	May 22, 2020
Priority date	Jun 10, 2016
Publication date	Dec 28, 2021
Grant date	Dec 28, 2021

Abstract

In particular embodiments, a computer-implemented data processing method for responding to a data subject access request comprises: (A) receiving a data subject access request from a requestor comprising one or more request parameters; (B) determining that the data subject is associated with a particular geographic location; (C) verifying that the data subject is associated with the particular geographic location; (D) in response to verifying that the data subject is associated with the particular geographic location, processing the request by identifying one or more pieces of personal data associated with the data subject; and (E) taking one or more actions based at least in part on the data subject access request, the one or more actions including one or more actions related to the one or more pieces of personal data.

First claim

We claim:

1. A computer-implemented data processing method for responding to a data subject access request, the method comprising:
receiving, by one or more processors, a data subject access request from a data subject comprising one or more request parameters;
determining, by the one or more processors, that the data subject is associated with a particular geographic location;
verifying, by the one or more processors, that the data subject is associated with the particular geographic location by:
prompting the data subject to provide one or more additional pieces of information in order to verify that the data subject is associated with the particular geographic location;
receiving the one or more additional pieces of information; and
confirming that the data subject is associated with the particular geographic location based at least in part on the one or more additional pieces of information;

in response to verifying that the data subject is associated with the particular geographic location, processing, by the one or more processors, the data subject access request by identifying one or more pieces of personal data associated with the data subject, the one or more pieces of personal data being stored in one or more data repositories associated with a particular organization; and
taking, by the one or more processors, one or more actions based at least in part on the data subject access request, the one or more actions including one or more actions related to the one or more pieces of personal data.

2. The computer-implemented data processing method of claim 1 , wherein prompting the data subject to provide the one or more additional pieces of information in order to verify that the data subject is associated with the particular geographic location further comprises:
generating a secure link between the one or more processors associated with the data subject access request and a computing device associated with the data subject to prevent outside access to the one or more additional pieces of information provided by the data subject;
receiving, via the secure link, the one or more additional pieces of information provided by the data subject; and
digitally storing the one or more additional pieces of information provided by the data subject.

3. The computer-implemented data processing method of claim 1 , wherein determining that the data subject is associated with the particular geographic location comprises determining that the data subject is a resident of the particular geographic location.

4. The computer-implemented data processing method of claim 1 , wherein verifying that the data subject is associated with the particular geographic location further comprises:
accessing, by the one or more processors, one or more third-party data aggregation systems; and
comparing, by the one or more processors, the one or more additional pieces of information received from the data subject to corresponding data information accessed via one or more third-party data aggregation systems in order to verify that the data subject is associated with the particular geographic location.

5. The computer-implemented data processing method of claim 4 , wherein the one or more additional pieces of information received from the data subject identifies an address of residence of the data subject and the method further comprises:
accessing, via the one or more third-party data aggregation systems, one or more property identification databases associated with the particular geographic location;
determining a property identification address of residence of the data subject based at least in part on accessing the one or more property identification databases;
comparing, by the one or more processors, the address of residence of the data subject identified in the one or more additional pieces of information to the property identification address of residence of the data subject; and
verifying, by the one or more processors, that the data subject is associated with the particular geographic location based at least in part on the comparing of the address of residence of the data subject identified in the one or more additional pieces of information to the property identification address of residence of the data subject.

6. The computer-implemented data processing method of claim 4 , wherein the one or more additional pieces of information received from the data subject identifies one or more financial records of the data subject and the method further comprises:
determining a geographic location associated with one or more financial transactions based at least in part on the one or more financial records provided by the data subject;
accessing, via the one or more third-party data aggregation systems, one or more financial record databases;
confirming, by the one or more processors, the geographic location associated with the one or more financial transactions is the determined particular geographic location associated with the data subject; and
verifying, by the one or more processors, that the data subject is associated with the particular geographic location based at least in part on the confirming that the geographic location associated with the one or more financial transactions is the determined particular geographic location associated with the data subject.

7. The computer-implemented data processing method of claim 1 , wherein one of the one or more request parameters of the data subject access request comprises a type of the data subject access request, and wherein the type of the data subject access request is selected from a group consisting of:
a subject's rights request, and
a data subject deletion request.

8. The computer-implemented data processing method of claim 1 , wherein the one or more additional pieces of information is one or more images provided by the data subject via a computing device associated with the data subject.

9. A computer-implemented data processing method for responding to a data subject access request, the method comprising:
receiving, by one or more processors, a data subject access request from a data subject comprising one or more request parameters, wherein the data subject access request includes a particular geographic location identified by the data subject to be a residence geographic location of the data subject;
verifying, by the one or more processors, that the data subject is associated with the particular geographic location by:
accessing one or more third-party data aggregation systems; and
confirming the particular geographic location identified by the data subject to be the residence geographic location of the data subject based at least in part on accessing the one or more third-party data aggregation systems;

in response to verifying that the data subject is associated with the particular geographic location, processing, by the one or more processors, the data subject access request by identifying one or more pieces of personal data associated with the data subject, the one or more pieces of personal data being stored in one or more data repositories associated with a particular organization; and
taking, by the one or more processors, one or more actions based at least in part on the data subject access request, the one or more actions including one or more actions related to the one or more pieces of personal data.

10. The computer-implemented data processing method of claim 9 , wherein determining that the data subject is associated with the particular geographic location comprises determining that the data subject is a resident of the particular geographic location.

11. The computer-implemented data processing method of claim 9 , w

Assignees

• Onetrust Llc

Inventors

• Brannon Jonathan Blake
• Hill Casey

Classifications

• G06F2221/2111

  Location-sensitive, e.g. geographical location, GPS · CPC title

• G06F21/6245 Primary

  Protecting personal data, e.g. for financial or medical purposes · CPC title