Data processing systems and methods for performing privacy assessments and monitoring of new versions of computer code for privacy compliance

Patent metadata

Field	Value
Publication number	US-11343284-B2
Application number	US-202117334948-A
Country	US
Kind code	B2
Filing date	May 31, 2021
Priority date	Jun 10, 2016
Publication date	May 24, 2022
Grant date	May 24, 2022

Abstract

In various embodiments, a data map generation system is configured to receive a request to generate a privacy-related data map for particular computer code, and, at least partially in response to the request, determine a location of the particular computer code, automatically obtain the particular computer code based on the determined location, and analyze the particular computer code to determine privacy-related attributes of the particular computer code, where the privacy-related attributes indicate types of personal information that the particular computer code collects or accesses. The system may be further configured to generate and display a data map of the privacy-related attributes to a user.

First claim

What is claimed is:

1. A method comprising:
monitoring, by computing hardware, a location where computer code is located;
identifying, by the computing hardware, a new instance of the computer code at the location;
comparing, by the computing hardware, the new instance of the computer code with a previous instance of the computer code to identify a change has been made to the computer code;
responsive to identifying the change, analyzing, by the computing hardware, the new instance of the computer code to determine a privacy-related attribute of the new instance of the computer code, the privacy-related attribute indicating a type of personal information that the new instance of the computer code at least one of collects or accesses;
modifying, by the computing hardware, a data map representing processing of the personal information to reflect the privacy-related attribute identified for the new instance of the computer code; and
providing, by the computing hardware, the data map for display to a user.

2. The method of claim 1 , wherein analyzing the new instance of the computer code to determine the privacy-related attribute comprises detecting use by the computer code of at least one of a location-based capability to detect a location of a user computing device, an encryption capability, a call to third party computer code, a communication log, or a cookie to track user behavior.

3. The method of claim 1 , wherein the computer code is associated with a website and identifying the new instance of the computer code involves identifying a change in information displayed on the website.

4. The method of claim 3 , wherein the change in information comprises at least one of a change made to a privacy policy displayed on the website or a change in a location of a link to the privacy policy.

5. The method of claim 1 , wherein the computer code is an application and identifying the new instance of the computer code involves identifying a new version of the application is available at the location.

6. The method of claim 1 , wherein modifying the data map to reflect the privacy-related attribute comprises modifying the data map to identify a storage location for the type of personal information that the new instance of the computer code at least one of collects or accesses.

7. The method of claim 1 , wherein the data map is associated with a privacy campaign and providing the data map for display to the user comprises providing a visual representation of the privacy campaign that includes the type of personal information that the new instance of the computer code at least one of collects or accesses.

8. A system comprising:
a non-transitory computer-readable medium storing instructions; and
a processing device communicatively coupled to the non-transitory computer-readable medium,
wherein, the processing device is configured to execute the instructions and thereby perform operations, upon a new instance of a computer code being identified at a location being monitored where the computer code is located, comprising:
comparing the new instance of the computer code with a previous instance of the computer code to identify a change has been made to the computer code;
responsive to identifying the change, analyzing the new instance of the computer code to determine a privacy-related attribute of the new instance of the computer code, the privacy-related attribute indicating a type of personal information that the new instance of the computer code at least one of collects or accesses;
modifying a data map representing processing of the personal information to reflect the privacy-related attribute identified for the new instance of the computer code; and
providing the data map for display to a user.

9. The system of claim 8 , wherein analyzing the new instance of the computer code to determine the privacy-related attribute comprises detecting use by the computer code of at least one of a location-based capability to detect a location of a user computing device, an encryption capability, a call to third party computer code, a communication log, or a cookie to track user behavior.

10. The system of claim 8 , wherein the privacy-related attribute represents at least one of a storage location of the type of personal information or an access permission of the type of personal information.

11. The system of claim 8 , wherein the computer code is associated with a website and identifying the new instance of the computer code involves identifying at least one of a change made to a privacy policy displayed on the website or a change in a location of a link to the privacy policy.

12. The system of claim 8 , wherein modifying the data map to reflect the privacy-related attribute comprises modifying the data map to identify a storage location for the type of personal information that the new instance of the computer code at least one of collects or accesses.

13. The system of claim 8 , wherein the data map is associated with a privacy campaign and providing the data map for display to the user comprises providing a visual representation of the privacy campaign that includes the type of personal information that the new instance of the computer code at least one of collects or accesses.

14. A non-transitory computer-readable medium storing computer-executable instructions that, when executed by processing hardware, configure the processing hardware to perform operations, upon a new instance of a computer code being identified at a location being monitored where the computer code is located, comprising:
comparing the new instance of the computer code with a previous instance of the computer code to identify a change has been made to the computer code;
responsive to identifying the change, analyzing the new instance of the computer code to determine a privacy-related attribute of the new instance of the computer code, the privacy-related attribute indicating a type of personal information that the new instance of the computer code at least one of collects or accesses; and
modifying a data map representing processing of the personal information to reflect the privacy-related attribute identified for the new instance of the computer code, wherein the data map is provided for display to a user.

15. The non-transitory computer-readable medium of claim 14 , wherein analyzing the new instance of the computer code to determine the privacy-related attribute comprises detecting use by the computer code of at least one of a location-based capability to detect a location of a user computing device, an encryption capability, a call to third party computer code, a communication log, or a cookie to track user behavior.

16. The non-transitory computer-readable medium of claim 14 , wherein the privacy-related attribute represents at least one of a storage location of the type of personal information or an access permission of the type of personal information.

17. The non-transitory computer-readable medium of claim 14 , wherein the computer code is associated with a website and identifying the new instance of the computer code involves identifying at least one of a change made to a privacy policy displayed on the website or a change in a location of a link to the privacy policy.

18. The non-transitory computer-readable medium of claim 14 , wherein modifying the data map to reflect the privacy-related attribute comprises modifying the data map to identify a storage location for the type of personal information that the new instance of the computer code at least one of collects or accesses.

Assignees

• Onetrust Llc

Inventors

• Barday Kabir A
• Karanjkar Mihir S
• Finch Steven W
• Browne Ken A
• Heard Nathan W
• Patel Aakash H
• Sabourin Jason L
• Daniel Richard L
• Patton-Kuhl Dylan D
• Brannon Jonathan Blake

Classifications

• G06Q10/10

  Office automation; Time management · CPC title

• H04L63/0414

  during transmission, i.e. party's identity is protected against eavesdropping, e.g. by using temporary identifiers, but is known to the other party or parties involved in the communication · CPC title

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/1433

  Vulnerability analysis · CPC title

• G06Q10/0635 Primary

  Risk analysis of enterprise or organisation activities · CPC title