Consent receipt management systems and related methods

Patent metadata

Field	Value
Publication number	US-11416634-B2
Application number	US-202117549170-A
Country	US
Kind code	B2
Filing date	Dec 13, 2021
Priority date	Jun 10, 2016
Publication date	Aug 16, 2022
Grant date	Aug 16, 2022

Abstract

A consent receipt management system may, for example, be configured to track data on behalf of an entity that collects and/or processes persona data related to: (1) who consented to the processing or collection of personal data; (2) when the consent was given (e.g., a date and time); (3) what information was provided to the consenter at the time of consent (e.g., a privacy policy, what personal data would be collected following the provision of the consent, for what purpose that personal data would be collected, etc.); (4) how consent was received (e.g., one or more copies of a data capture form, webform, etc. via which consent was provided by the consenter); (5) when consent was withdrawn (e.g., a date and time of consent withdrawal if the consenter withdraws consent); and/or (6) any other suitable data related to receipt or withdrawal of consent.

First claim

What is claimed is:

1. A method comprising:
receiving, by computing hardware originating from a graphical user interface, information regarding a request to initiate a transaction between an entity and a data subject, wherein the transaction involves a computing system associated with the entity performing at least one of collecting or processing personal data associated with the data subject as part of a processing activity undertaken by the entity that the data subject is consenting to as part of the transaction;
receiving, by the computing hardware, a unique transaction identifier associated with the transaction;
receiving, by the computing hardware, a unique subject identifier for the data subject;
responsive to receiving the information regarding the request:
generating, by the computing hardware, a unique consent receipt key for the transaction;
associating, by the computing hardware, a receipt definition with the unique consent receipt key, wherein the receipt definition comprises the unique transaction identifier and a purpose for the at least one of collecting or processing the personal data; and
generating, by the computing hardware, a consent receipt set comprising the unique subject identifier, the unique consent receipt key, and the unique transaction identifier; and

storing, by the computing hardware in computer memory, the consent receipt set and the receipt definition, wherein at least a portion of the receipt definition is provided to demonstrate that the data subject has provided a consent for the at least one of collecting or processing the personal data by the computing system associated with the entity as part of the processing activity undertaken by the entity.

2. The method of claim 1 , wherein the receipt definition further comprises at least one of a description of a service provided as part of the transaction, a link to a privacy policy associated with the transaction, a process used for the at least one of collecting or processing the personal data, a type of data for which the consent was provided, a jurisdiction applicable to the transaction, a legal basis for the at least one of collecting or processing the personal data, a type of consent provided, at least one of a category or identity of entities to whom the personal data may be transferred, a base of a transfer to a third party entity, a retention period for the personal data, or a withdrawal mechanism for the consent.

3. The method of claim 1 further comprising providing, by the computing hardware, the consent receipt set for display on the graphical user interface.

4. The method of claim 1 further comprising transmitting, by the computing hardware, the consent receipt set in a format comprising at least one of a JavaScript Object Notation, HyperText Markup Language, email, text, or cookie.

5. The method of claim 4 , wherein the consent receipt set further comprises a link to a portal that facilitates withdrawing the consent.

6. The method of claim 1 further comprising:
receiving an indication that the personal data has been at least one of collected or processed as part of the transaction; and
responsive to receiving the indication, associating, by the computing hardware, the personal data and the unique subject identifier.

7. The method of claim 1 , wherein the unique subject identifier is based on a piece of the personal data.

8. A system comprising:
a non-transitory computer-readable medium storing instructions; and
a processing device communicatively coupled to the non-transitory computer-readable medium,
wherein, the processing device is configured to execute the instructions and thereby perform operations comprising:
receiving information regarding a request originating from a graphical user interface to initiate a transaction between an entity and a data subject, wherein the transaction involves a computing system associated with the entity performing at least one of collecting or processing personal data associated with the data subject as part of a processing activity undertaken by the entity that the data subject is consenting to as part of the transaction;
receiving a unique subject identifier for the data subject originating from the graphical user interface;
responsive to receiving the information regarding the request:
generating a unique consent receipt key for the transaction;
associating a receipt definition with the unique consent receipt key, wherein the receipt definition comprises a unique transaction identifier associated with the transaction and a purpose for the at least one of collecting or processing the personal data; and
generating a consent receipt set comprising the unique subject identifier, the unique consent receipt key, and the unique transaction identifier; and

storing, in computer memory, the consent receipt set and the receipt definition, wherein at least a portion of the receipt definition is provided to demonstrate that the data subject has provided a consent for the at least one of collecting or processing the personal data by the computing system associated with the entity as part of the processing activity undertaken by the entity.

9. The system of claim 8 , wherein the receipt definition further comprises at least one of a description of a service provided as part of the transaction, a link to a privacy policy associated with the transaction, a process used for the at least one of collecting or processing the personal data, a type of data for which the consent was provided, a jurisdiction applicable to the transaction, a legal basis for the at least one of collecting or processing the personal data, a type of consent provided, at least one of a category or identity of entities to whom the personal data may be transferred, a base of a transfer to a third party entity, a retention period for the personal data, or a withdrawal mechanism for the consent.

10. The system of claim 8 , wherein the operations further comprise providing the consent receipt set for display on the graphical user interface.

11. The system of claim 8 , wherein the operations further comprise transmitting the consent receipt set in a format comprising at least one of a JavaScript Object Notation, HyperText Markup Language, email, text, or cookie.

12. The system of claim 8 , wherein the operations further comprising providing at least one of the consent receipt set or the receipt definition via a consent receipt management portal.

13. The system of claim 12 , wherein the consent receipt management portal is configured to enable a withdraw of the consent.

14. The system of claim 8 , wherein the operations further comprise:
receiving an indication that the personal data has been at least one of collected or processed as part of the transaction; and
responsive to receiving the indication, associating the personal data and the unique subject identifier.

15. A non-transitory computer-readable medium having program code that is stored thereon, the program code executable by one or more processing devices for performing operations comprising:
receiving information regarding a request to initiate a transaction between an entity and a data subject, wherein the transaction involves a computing system associated with the entity performing at least one of collecting or processing personal data associated with the data subject as part of a processing activity undertaken by the entity that the data subject is consenting to as part of the transaction;
receiving a unique transaction identifier associated with the transaction;
receiving a unique subject identifier for the data subject; and
responsive to receiv

Assignees

• Onetrust Llc

Inventors

• Barday Kabir A
• Brannon Jonathan Blake
• Sabourin Jason L
• Karanjkar Mihir S
• Jones Kevin
• Beaumont Richard A

Classifications

• G06F16/901

  Indexing; Data structures therefor; Storage structures (for retrieval from the web G06F16/951) · CPC title

• G06F16/904

  Browsing; Visualisation therefor (for navigating the web G06F16/954; browsing optimisation for the web G06F16/957) · CPC title

• G06F16/9558

  Details of hyperlinks; Management of linked annotations · CPC title

• G06F16/2365

  Ensuring data consistency and integrity · CPC title

• G06F21/6245 Primary

  Protecting personal data, e.g. for financial or medical purposes · CPC title