Data processing systems and methods for automatically detecting and documenting privacy-related aspects of computer software

Patent metadata

Field	Value
Publication number	US-11294939-B2
Application number	US-202117491871-A
Country	US
Kind code	B2
Filing date	Oct 1, 2021
Priority date	Jun 10, 2016
Publication date	Apr 5, 2022
Grant date	Apr 5, 2022

Abstract

Data processing systems and methods according to various embodiments are adapted for automatically detecting and documenting privacy-related aspects of computer software. Particular embodiments are adapted for: (1) automatically scanning source code to determine whether the source code include instructions for collecting personal data; and (2) facilitating the documentation of the portions of the code that collect the personal data. For example, the system may automatically prompt a user for comments regarding the code. The comments may be used, for example, to populate: (A) a privacy impact assessment; (B) system documentation; and/or (C) a privacy-related data map. The system may comprise, for example, a privacy comment plugin for use in conjunction with a code repository.

First claim

What is claimed is:

1. A method comprising:
analyzing, by computing hardware, a segment of computer code to determine whether the segment comprises instructions for using personal data based on at least one variable with a name or a particular data type being contained within the segment indicative of the segment using the personal data, wherein analyzing the segment of the computer code to determine whether the segment comprises the instructions for using the personal data comprises processing the segment using at least one of a rules-based model or a machine learning model to generate an output indicating that the segment uses the personal data based on the at least one variable with the name or the particular data type being contained within the segment;
responsive to determining that the segment comprises the instructions for using the personal data, providing, by the computing hardware, a graphical user interface for a display to a user, wherein the graphical user interface is configured to prompt the user to input information for at least one of (i) a type of the personal data, (ii) a reason why the personal data is used, (iii) a location where the personal data is stored, (iv) a period of time for which the personal data is stored, (v) whether the personal data includes personal data of minors, (vi) whether the personal data is transferred across geographic borders, or (vii) a geographic territory associated with the personal data;
receiving, by the computing hardware, the information from the user;
inserting, by the computing hardware, a comment comprising the information adjacent to the segment in the computer code; and
populating a data model with at least a portion of the information, wherein the data model comprises a respective digital inventory for each of a plurality of data assets including computer software associated with the computer code, and each respective digital inventory comprises an identifier for personal data that is used by the respective data asset.

2. The method of claim 1 further comprising answering at least one question found in a questionnaire used in conducting a privacy impact assessment for the computer code with at least a portion of the information.

3. The method of claim 1 further comprising populating an electronic record used to document functionality of the computer code with at least a portion of the information.

4. The method of claim 1 , wherein analyzing the segment of the computer code occurs at least substantially in real time as the user is writing the segment of the computer code.

5. The method of claim 1 , wherein providing the graphical user interface occurs at least substantially in real time as the user is writing the segment of the computer code.

6. The method of claim 1 , wherein the graphical user interface is configured with at least one of a dropdown input, a multiple-choice selection, or a template for the user to follow to facilitate the user in providing the information.

7. The method of claim 6 further comprising generating, by the computing hardware, the graphical user interface to comprise at least one of the dropdown input, the multiple-choice selection, or the template based on the type of the personal data being used by the segment of the computer code.

8. A non-transitory computer-readable medium having program code that is stored thereon, the program code executable by one or more processing devices for performing operations comprising:
analyzing a segment of computer code to determine whether the segment comprises instructions for using personal data based on at least one of a variable with a name or a particular data type being contained within the segment indicative of the segment using the personal data, wherein analyzing the segment of the computer code to determine whether the segment comprises the instructions for using the personal data comprises processing the segment using at least one of a rules-based model or a machine learning model to generate an output indicating that the segment uses the personal data based on the at least one variable with the name or the particular data type being contained within the segment;
receiving information provided by a user via a graphical user interface displayed to the user, wherein the information comprises for at least one of (i) a type of the personal data, (ii) a reason why the personal data is used, (iii) a location where the personal data is stored, (iv) a period of time for which the personal data is stored, (v) whether the personal data includes personal data of minors, (vi) whether the personal data is transferred across geographic borders, or (vii) a geographic territory associated with the personal data;
inserting a comment comprising the information adjacent to the segment in the computer code; and
populating a data model with at least a portion of the information, wherein the data model comprises a respective digital inventory for each of a plurality of data assets including computer software associated with the computer code, and each respective digital inventory comprises an identifier for personal data that is used by the respective data asset.

9. The non-transitory computer-readable medium of claim 8 , wherein the program code is executable by the one or more processing devices for performing operations comprising at least one of:
answering at least one question found in a questionnaire used in conducting a privacy impact assessment for the computer code with at least a portion of the information, or
populating an electronic record used to document functionality of the computer code with at least a portion of the information.

10. The non-transitory computer-readable medium of claim 8 , wherein analyzing the segment of the computer code occurs at least substantially in real time as the user is writing the segment of the computer code.

11. The non-transitory computer-readable medium of claim 8 , wherein the graphical user interface is provided to the user at least substantially in real time as the user is writing the segment of the computer code.

12. The non-transitory computer-readable medium of claim 8 , wherein the operations further comprise:
generating the graphical user interface to comprise at least one of a dropdown input, a multiple-choice selection, or a template based on the type of the personal data being used by the segment of the computer code; and
providing the graphical user interface for display to the user, wherein the graphical user interface is configured to prompt the user to input the information.

13. A system comprising:
a non-transitory computer-readable medium storing instructions; and
a processing device communicatively coupled to the non-transitory computer-readable medium,
wherein, the processing device is configured to execute the instructions and thereby perform operations comprising:
analyzing a segment of computer code to determine whether the segment comprises instructions for using personal data based on at least one variable with a name or a particular data type being contained within the segment indicative of the segment using the personal data, wherein analyzing the segment of the computer code to determine whether the segment comprises the instructions for using the personal data comprises processing the segment using at least one of a rules-based model or a machine learning model to generate an output indicating that the segment uses the personal data based on the at least one variable with the name or the particular data type being contained within the segment;
responsive to determining that the segment comprises the instructions for using the personal data, providing a graphic

Assignees

• Onetrust Llc

Inventors

• Malhotra Priya
• Barday Kabir A
• Karanjkar Mihir S
• Finch Steven W
• Browne Ken A
• Heard Nathan W
• Patel Aakash H
• Sabourin Jason L
• Daniel Richard L
• Patton-Kuhl Dylan D
• Brannon Jonathan Blake

Classifications

• G06N5/01

  Dynamic search techniques; Heuristics; Dynamic trees; Branch-and-bound · CPC title

• G06N7/01

  Probabilistic graphical models, e.g. probabilistic networks · CPC title

• H04L67/306

  User profiles · CPC title

• G06N20/10

  using kernel methods, e.g. support vector machines [SVM] · CPC title

• G06N5/02

  Knowledge representation; Symbolic representation · CPC title