Data processing systems and methods for automatically detecting and documenting privacy-related aspects of computer software

Patent metadata

Field	Value
Publication number	US-12204564-B2
Application number	US-202318112149-A
Country	US
Kind code	B2
Filing date	Feb 21, 2023
Priority date	Jun 10, 2016
Publication date	Jan 21, 2025
Grant date	Jan 21, 2025

Abstract

Data processing systems and methods according to various embodiments are adapted for automatically detecting and documenting privacy-related aspects of computer software. Particular embodiments are adapted for: (1) automatically scanning source code to determine whether the source code include instructions for collecting personal data; and (2) facilitating the documentation of the portions of the code that collect the personal data. For example, the system may automatically prompt a user for comments regarding the code. The comments may be used, for example, to populate: (A) a privacy impact assessment; (B) system documentation; and/or (C) a privacy-related data map. The system may comprise, for example, a privacy comment plugin for use in conjunction with a code repository.

First claim

What is claimed is:

1. A method comprising:
analyzing, by computing hardware, a segment of computer code to determine whether the segment comprises instructions for using personal data, wherein analyzing the segment of the computer code comprises processing the segment using at least one of a rules-based model or a machine learning model to generate an output indicating that the segment of computer code comprises instructions to cause a computer system to collect one or more types of personal data;
providing, by the computing hardware, a graphical user interface for a display to a user, wherein the graphical user interface is configured to prompt the user to provide input regarding use of the personal data by the instructions;
receiving, by the computing hardware, the input from the user, the input comprising one or more corresponding reasons for collecting the one or more types of personal data; and
responsive to receiving the input, performing at least one of:
populating an electronic record used to document functionality of the computer code based on the input;
populating at least one question found in a questionnaire used in conducting a privacy impact assessment for the computer code based on the input; or
populating a data model based on the input, wherein the data model comprises a digital inventory for a data asset associated with the computer code.

2. The method of claim 1 , wherein analyzing the segment of computer code and providing the graphical user interface is performed via a plug-in in conjunction with a repository adapted to store the computer code.

3. The method of claim 1 , wherein analyzing the segment of the computer code occurs at least substantially in real time as the user is writing the segment of the computer code.

4. The method of claim 1 , wherein providing the graphical user interface for display to the user comprises:
prompting the user to provide a type of process that involves a collection of the one or more types of personal data via the segment of computer code; or
prompting the user to indicate a specific type of personal data that the computer system collects via the segment of computer code.

5. The method of claim 1 , wherein providing the graphical user interface for display to the user comprises:
prompting the user to provide a source from where the personal data is acquired via the segment of computer code; or
prompting the user to provide information regarding access rights to the personal data acquired via the segment of computer code.

6. The method of claim 1 , wherein providing the graphical user interface for display to the user comprises:
prompting the user to provide an indication of where the personal data acquired via the segment of computer code is stored; and
prompting the user to provide an indication of how long the personal data acquired via the segment of computer code is stored.

7. The method of claim 1 , wherein the graphical user interface is configured with at least one of a dropdown menu, a multiple-choice selection, or a template for the user to follow to facilitate the user in providing the input, and selections for the dropdown menu, the multiple-choice selection, or the template are based on a type of the personal data.

8. A system comprising:
a non-transitory computer-readable medium storing instructions; and
a processing device communicatively coupled to the non-transitory computer-readable medium,
wherein, the processing device is configured to execute the instructions and thereby perform operations comprising:
analyzing a segment of computer code to determine whether the segment comprises instructions for using personal data, wherein analyzing the segment of the computer code comprises processing the segment of computer code using at least one of a rules-based model or a machine learning model to generate output indicating the segment of computer code comprises instructions to cause a computer system to collect one or more types of personal data;
providing a graphical user interface for a display to a user, wherein the graphical user interface is configured to prompt the user to provide input regarding use of the personal data by the instructions;
receiving the input from the user, the input comprising one or more corresponding reasons for collecting the one or more types of personal data; and
responsive to receiving the input, performing at least one of:
populating an electronic record used to document functionality of the computer code based on the input;
populating at least one question found in a questionnaire used in conducting a privacy impact assessment for the computer code based on the input; or
populating a data model based on the input, wherein the data model comprises a digital inventory for a data asset associated with the computer code.

9. The system of claim 8 further comprising a repository adapted to store the computer code, wherein processing the segment of computer code and providing the graphical user interface is performed via a plug-in in conjunction with the repository.

10. The system of claim 8 , wherein processing the segment of the computer code occurs at least substantially in real time as the user is writing the segment of the computer code.

11. The system of claim 8 , wherein providing the graphical user interface occurs at least substantially in real time as the user is writing the segment of the computer code.

12. The system of claim 8 , wherein the graphical user interface is configured with at least one of a dropdown menu a multiple-choice selection, or a template for the user to follow to facilitate the user in providing the input.

13. The system of claim 8 , wherein the output indicating that the segment uses the personal data comprises a type of the personal data.

14. The system of claim 13 , wherein the graphical user interface is configured with at least one of a dropdown menu, a multiple-choice selection, or a template for the user to follow to facilitate the user in providing the input, and selections for the dropdown menu, the multiple-choice selection, or the template are based on the type of the personal data.

15. A non-transitory computer-readable medium having program code that is stored thereon, the program code executable by one or more processing devices for performing operations comprising:
analyzing a segment of computer code to determine whether the segment comprises instructions for using personal data, wherein analyzing the segment of the computer code comprises processing the segment using at least one of a rules-based model or a machine learning model to generate an output indicating that the segment of computer code comprises instructions to cause a computer system to collect one or more types of personal data;
providing a graphical user interface for a-display to a user, wherein the graphical user interface is configured to prompt the user to provide input regarding use of the personal data by the instructions;
receiving the input from the user, the input comprising one or more corresponding reasons for collecting the one or more types of personal data; and
responsive to receiving the input, performing at least one of:
populating an electronic record used to document functionality of the computer code based on the input;
populating at least one question found in a questionnaire used in conducting a privacy impact assessment for the computer code based on the input; or
populating a data model based on the input, wherein the data model comprises a digital inventory for a data asset associated with the computer code.

16. The non-transitory co

Assignees

• Onetrust Llc

Inventors

• Malhotra Priya
• Barday Kabir A
• Karanjkar Mihir S
• Finch Steven W
• Browne Ken A
• Patel Aakash H
• Sabourin Jason L
• Daniel Richard L
• Patton-Kuhl Dylan D
• Brannon Jonathan Blake

Classifications

• G06F40/186

  Templates · CPC title

• H04W12/02

  Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII] · CPC title

• H04L67/306

  User profiles · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/04

  for providing a confidential data exchange among entities communicating through data packet networks · CPC title