Data processing systems for use in automatically generating, populating, and submitting data subject access requests

Patent metadata

Field	Value
Publication number	US-11244071-B2
Application number	US-202017068454-A
Country	US
Kind code	B2
Filing date	Oct 12, 2020
Priority date	Jun 10, 2016
Publication date	Feb 8, 2022
Grant date	Feb 8, 2022

Abstract

Computer systems and methods for: (1) analyzing electronic correspondence associated with a data subject (e.g., the emails within one or more email in-boxes associated with the data subject); (2) based on the analysis, identifying at least one entity that that the data subject does not actively do business with (e.g., as evidenced by the fact that the data subject no longer opens emails from the entity, and/or has set up a rule to automatically delete emails received from the entity); and (3) in response to identifying the entity as an entity that the data subject no longer does business with, at least substantially automatically populating and/or submitting a data subject access request to the entity (e.g., to delete all personal information being processed by the entity).

First claim

What is claimed is:

1. A computer-implemented data processing method of automatically submitting a data subject access request, the method comprising:
analyzing, by one or more computer processors, a plurality of pieces of electronic correspondence received by a particular data subject from a particular entity;
determining, by one or more computer processors, based at least in part on the analysis, a first subset of the plurality of pieces of electronic correspondence, wherein each of the first subset of the plurality of pieces of electronic correspondence is a first electronic correspondence type;
determining, by one or more computer processors, based at least in part on the analysis, a second subset of the plurality of pieces of electronic correspondence, wherein each of the second subset of the plurality of pieces of electronic correspondence is a second electronic correspondence type, and wherein the first electronic correspondence type is distinct from the second electronic correspondence type;
determining, by one or more computer processors, a first engagement factor associated with the first subset of the plurality of pieces of electronic correspondence;
determining, by one or more computer processors, based at least in part on the analysis, a second engagement factor associated with the second subset of the plurality of pieces of electronic correspondence;
determining, by one or more computer processors, based at least in part on the first engagement factor and the second engagement factor, that the particular data subject does not actively do business with the particular entity; and
at least partially in response to determining that the particular data subject does not actively do business with the particular entity:
scanning, by one or more computer processors, one or more pieces of the first subset of the plurality of pieces of electronic correspondence to determine one or more pieces of personal data of the particular data subject; and
automatically submitting, by one or more computer processors, a data subject access request to the particular entity on behalf of the particular data subject, wherein:
the data subject access request comprises the one or more pieces of the personal data of the particular data subject determined by scanning the one or more pieces of the first subset of the plurality of pieces of electronic correspondence; and
the data subject access request is a request to modify one or more preferences of the particular data subject associated with the second electronic correspondence type.

2. The computer-implemented data processing method of claim 1 , wherein determining, based at least in part on the first engagement factor and the second engagement factor, that the particular data subject does not actively do business with the particular entity comprises:
determining, by one or more computer processors, a data subject disengagement rating based at least in part on the first engagement factor and the second engagement factor; and
determining, by one or more computer processors, that the particular data subject does not actively do business with the particular entity based at least in part on the data subject disengagement rating.

3. The computer-implemented data processing method of claim 2 , wherein determining that the particular data subject does not actively do business with the particular entity based at least in part on the data subject disengagement rating comprises:
determining, by one or more computer processors, that the data subject disengagement rating exceeds a threshold.

4. The computer-implemented data processing method of claim 2 , wherein:
determining the first engagement factor associated with the first subset of the plurality of pieces of electronic correspondence comprises assigning, by one or more computer processors, a first numerical value to the first engagement factor;
determining, based at least in part on the analysis, the second engagement factor associated with the second subset of the plurality of pieces of electronic comprises assigning, by one or more computer processors, a second numerical value to the second engagement factor; and
determining the data subject disengagement rating based at least in part on the first engagement factor and the second engagement factor comprises calculating, by one or more computer processors, the data subject disengagement rating using the first numerical value and the second numerical value.

5. The computer-implemented data processing method of claim 1 , wherein each piece of the plurality of pieces of electronic correspondence is a type of electronic correspondence selected from the group consisting of:
(a) an email;
(b) a text message;
(c) a social media post; and
(d) a scan of paper correspondence.

6. The computer-implemented data processing method of claim 1 , wherein analyzing the plurality of pieces of electronic correspondence received by the particular data subject from the particular entity comprises scanning each piece of the plurality of pieces of electronic correspondence to identify a domain associated with the particular entity.

7. The computer-implemented data processing method of claim 1 , wherein automatically submitting the data subject access request to the particular entity on behalf of the particular data subject comprises:
automatically transmitting a confirmation request message comprising an indication of the data subject access request to particular data subject;
receiving a confirmation message from the data subject; and
in response to receiving the confirmation message, submitting the data subject access request to the particular entity on behalf of the particular data subject.

8. A non-transitory computer-readable medium storing computer-executable instructions for automatically submitting a data subject access request by:
scanning, by one or more computer processors, a first plurality of pieces of electronic correspondence associated with a particular data subject to identify a particular entity;
identifying, by one or more processors, based at least in part on the identified particular entity, a second plurality of pieces of electronic correspondence received by a particular data subject from the particular entity;
analyzing, by one or more computer processors, the identified second plurality of pieces of electronic correspondence received by the particular data subject from the particular entity;
determining, by one or more computer processors, based at least in part on the analysis, a first subset of the second plurality of pieces of electronic correspondence, wherein each of the first subset of the second plurality of pieces of electronic correspondence is a first electronic correspondence type;
determining, by one or more computer processors, based at least in part on the analysis, a second subset of the second plurality of pieces of electronic correspondence, wherein each of the second subset of the second plurality of pieces of electronic correspondence is a second electronic correspondence type, and wherein the first electronic correspondence type is distinct from the second electronic correspondence type;
determining, by one or more computer processors, a first engagement factor associated with the first subset of the second plurality of pieces of electronic correspondence;
determining, by one or more computer processors, based at least in part on the analysis, a second engagement factor associated with the second subset of the second plurality of pieces of electronic correspondence;
determining, by one or more computer processors, based at least in part on the first engagement factor and the second engagement factor, that the particular data subject does not actively do business with the p

Assignees

• Onetrust Llc

Inventors

• Barday Kabir A
• Karanjkar Mihir S
• Finch Steven W
• Browne Ken A
• Heard Nathan W
• Patel Aakash H
• Sabourin Jason L
• Daniel Richard L
• Patton-Kuhl Dylan D
• Jones Kevin
• Brannon Jonathan Blake

Classifications

• H04L67/535

  Tracking the activity of the user (network monitoring arrangements H04L43/00; recording of computer activity G06F11/34) · CPC title

• H04L63/102

  Entity profiles · CPC title

• G06Q10/107

  Computer-aided management of electronic mailing [e-mailing] · CPC title

• H04L63/0236

  Filtering by address, protocol, port number or service, e.g. IP-address or URL · CPC title

• H04L63/108

  when the policy decisions are valid for a limited amount of time · CPC title