Data processing consent management systems and related methods

Patent metadata

Field	Value
Publication number	US-11416636-B2
Application number	US-202117479807-A
Country	US
Kind code	B2
Filing date	Sep 20, 2021
Priority date	Jun 10, 2016
Publication date	Aug 16, 2022
Grant date	Aug 16, 2022

Abstract

In various embodiments, a personal data processing system may require guardian consent (e.g., parental consent) for a data subject in order to collect, store, and or process the subject's personal data. The system may prompt the data subject to initiate a request for guardian consent or the system may initiate a request for guardian consent without initiation from the data subject (e.g., in the background of a transaction). In some embodiments, the system may require guardian consent when a data subject is under the age for valid consent for the particular type of personal data that will be collected as part of a particular transaction. Data processing systems may generate and store one or more consent records memorializing valid consent for data processing from data subjects and/or from guardians on their behalf (e.g., in the case of a minor data subject).

First claim

What is claimed is:

1. A system comprising:
a non-transitory computer-readable medium storing instructions; and
processing hardware communicatively coupled to the non-transitory computer-readable medium, wherein the processing hardware is configured to execute the instructions and thereby perform operations comprising:
receiving a request to initiate a transaction, the request comprising a transaction parameter, a data subject parameter, and a consent parameter indicating consent by a data subject to processing of personal data received via a computer network;
determining, based on the data subject parameter, that the data subject does not meet an age criterion for the processing of the personal data under the transaction;
in response to determining that the data subject does not meet the age criterion, identifying a guardian associated with the data subject;
receiving valid consent from the guardian to the processing of the personal data as part of the transaction;
modifying the consent parameter to reflect the valid consent from the guardian;
generating a consent receipt set indicating consent to the processing of the personal data, wherein the consent receipt set comprises a consent receipt identifier, a transaction identifier based on the transaction parameter, a consent status based on the consent parameter, and a subject identifier based on the data subject parameter; and
initiating the transaction based on the consent receipt set.

2. The system of claim 1 , wherein the operations further comprise:
initiating electronic communication with the guardian; and
receiving the valid consent via the electronic communication.

3. The system of claim 1 , wherein identifying the guardian associated with the data subject comprises accessing an electronic guardian registry and identifying the guardian in the electronic guardian registry based on the data subject parameter.

4. The system of claim 1 , wherein modifying the consent parameter to reflect the valid consent from the guardian comprises modifying the consent status from invalid to valid.

5. The system of claim 1 , wherein initiating the transaction based on the consent receipt set comprises:
generating a graphical user interface for a browser application executed on a user device by configuring a customized display element based on the consent parameter; and
transmitting an instruction to the browser application causing the browser application to present the graphical user interface on the user device.

6. The system of claim 1 , wherein the transaction comprises tracking interaction of the data subject with a website.

7. The system of claim 1 , wherein identifying the guardian associated with the data subject comprises:
identifying a prior transaction involving the data subject based on the data subject parameter;
determining an individual that provided consent on behalf of the data subject for the prior transaction; and
identifying the guardian as the individual.

8. A method comprising:
receiving, by computing hardware, a request to initiate a transaction, the request comprising a transaction parameter, a data subject parameter, and a consent parameter indicating consent by a data subject to processing of personal data received via a computer network;
generating a consent receipt set comprising a consent receipt identifier, a transaction identifier based on the transaction parameter, a consent status based on the consent parameter, and a subject identifier based on the data subject parameter;
determining, by the computing hardware, based on the data subject parameter, that the data subject does not meet an age criterion for the processing of the personal data under the transaction;
in response to determining that the data subject does not meet the age criterion, identifying a guardian associated with the data subject;
receiving valid consent from the guardian to the processing of the personal data as part of the transaction;
generating a modified consent receipt set based on the consent receipt set and the valid consent; and
causing initiation of the transaction based on the modified consent receipt set.

9. The method of claim 8 , wherein:
the consent status comprises a consent validity status; and
the method further comprises responsive to determining that the data subject does not meet the age criterion for the processing of the personal data under the transaction, setting, by the computing hardware, the consent validity status to invalid.

10. The method of claim 9 , wherein generating the modified consent receipt set comprises generating the modified consent receipt set to comprise the consent status defining the consent status as valid based on the valid consent.

11. The method of claim 8 , further comprising:
initiating, by the computing hardware electronic communication with the guardian; and
receiving, by the computing hardware, the valid consent based on the electronic communication.

12. The method of claim 11 , wherein:
the electronic communication comprises a unique code; and
receiving the valid consent based on the electronic communication comprises receiving the unique code from the data subject.

13. The method of claim 8 , wherein identifying the guardian associated with the data subject comprises accessing an electronic guardian registry and identifying the guardian in the electronic guardian registry based on the data subject parameter.

14. The method of claim 8 , wherein identifying the guardian associated with the data subject comprises:
identifying, by the computing hardware, a prior transaction involving the data subject based on the data subject parameter;
determining, by the computing hardware, an individual that provided consent on behalf of the data subject for the prior transaction; and
identifying the guardian as the individual.

15. A non-transitory computer-readable medium storing computer-executable instructions that, when executed by processing hardware, configure the processing hardware to perform operations comprising:
receiving a request to initiate a transaction, the request comprising a data subject parameter and a consent parameter indicating consent by a data subject to processing of personal data received via a computer network;
determining, based on the data subject parameter, that the data subject does not meet an age criterion for the processing of the personal data under the transaction;
prompting a guardian associated with the data subject to provide valid consent to the processing of the personal data as part of the transaction;
modifying the consent parameter to reflect the valid consent from the guardian;
generating a consent receipt set indicating consent to the processing of the personal data, wherein the consent receipt set comprises a consent receipt identifier, a consent status based on the consent parameter, and a subject identifier based on the data subject parameter; and
causing initiation of the transaction based on the consent receipt set.

16. The non-transitory computer-readable medium of claim 15 , wherein the operations further comprise:
identifying a prior transaction involving the data subject based on the data subject parameter;
determining an individual that provided consent on behalf of the data subject for the prior transaction; and
prompting the individual for the valid consent.

17. The non-transitory computer-readable medium of claim 15 , wherein the operations further comprise:
transmitting an electronic communication to the guardian;
prompting the guardian for the valid consent via the electroni

Assignees

• Onetrust Llc

Inventors

• Brannon Jonathan Blake
• Hill Casey
• Jones Kevin
• Beaumont Richard A

Classifications

• G06F21/602

  Providing cryptographic facilities or services · CPC title

• G06F21/60

  Protecting data · CPC title

• G06F21/604

  Tools and structures for managing or administering access control systems · CPC title

• G06F21/6245 Primary

  Protecting personal data, e.g. for financial or medical purposes · CPC title

• G06F21/6272 Primary

  by registering files or documents with a third party · CPC title