Data processing systems and methods for performing privacy assessments and monitoring of new versions of computer code for privacy compliance

Patent metadata

Field	Value
Publication number	US-2021344720-A1
Application number	US-202117334948-A
Country	US
Kind code	A1
Filing date	May 31, 2021
Priority date	Jun 10, 2016
Publication date	Nov 4, 2021
Grant date	—

Abstract

In various embodiments, a data map generation system is configured to receive a request to generate a privacy-related data map for particular computer code, and, at least partially in response to the request, determine a location of the particular computer code, automatically obtain the particular computer code based on the determined location, and analyze the particular computer code to determine privacy-related attributes of the particular computer code, where the privacy-related attributes indicate types of personal information that the particular computer code collects or accesses. The system may be further configured to generate and display a data map of the privacy-related attributes to a user.

First claim

What is claimed is:

1 . A method comprising:
monitoring, by computing hardware, a location where computer code is located; identifying, by the computing hardware, a new instance of the computer code at the location; comparing, by the computing hardware, the new instance of the computer code with a previous instance of the computer code to identify a change has been made to the computer code; responsive to identifying the change, analyzing, by the computing hardware, the new instance of the computer code to determine a privacy-related attribute of the new instance of the computer code, the privacy-related attribute indicating a type of personal information that the new instance of the computer code at least one of collects or accesses; modifying, by the computing hardware, a data map representing processing of the personal information to reflect the privacy-related attribute identified for the new instance of the computer code; and providing, by the computing hardware, the data map for display to a user.

2 . The method of claim 1 , wherein analyzing the new instance of the computer code to determine the privacy-related attribute comprises detecting use by the computer code of at least one of a location-based capability to detect a location of a user computing device, an encryption capability, a call to third party computer code, a communication log, or a cookie to track user behavior.

3 . The method of claim 1 , wherein the computer code is associated with a website and identifying the new instance of the computer code involves identifying a change in information displayed on the website.

4 . The method of claim 3 , wherein the change in information comprises at least one of a change made to a privacy policy displayed on the website or a change in a location of a link to the privacy policy.

5 . The method of claim 1 , wherein the computer code is an application and identifying the new instance of the computer code involves identifying a new version of the application is available at the location.

6 . The method of claim 1 , wherein modifying the data map to reflect the privacy-related attribute comprises modifying the data map to identify a storage location for the type of personal information that the new instance of the computer code at least one of collects or accesses.

7 . The method of claim 1 , wherein the data map is associated with a privacy campaign and providing the data map for display to the user comprises providing a visual representation of the privacy campaign that includes the type of personal information that the new instance of the computer code at least one of collects or accesses.

8 . A system comprising:
a non-transitory computer-readable medium storing instructions; and a processing device communicatively coupled to the non-transitory computer-readable medium, wherein, the processing device is configured to execute the instructions and thereby perform operations, upon a new instance of a computer code being identified at a location being monitored where the computer code is located, comprising:
comparing the new instance of the computer code with a previous instance of the computer code to identify a change has been made to the computer code;
responsive to identifying the change, analyzing the new instance of the computer code to determine a privacy-related attribute of the new instance of the computer code, the privacy-related attribute indicating a type of personal information that the new instance of the computer code at least one of collects or accesses;
modifying a data map representing processing of the personal information to reflect the privacy-related attribute identified for the new instance of the computer code; and
providing the data map for display to a user.

9 . The system of claim 8 , wherein analyzing the new instance of the computer code to determine the privacy-related attribute comprises detecting use by the computer code of at least one of a location-based capability to detect a location of a user computing device, an encryption capability, a call to third party computer code, a communication log, or a cookie to track user behavior.

10 . The system of claim 8 , wherein the privacy-related attribute represents at least one of a storage location of the type of personal information or an access permission of the type of personal information.

11 . The system of claim 8 , wherein the computer code is associated with a website and identifying the new instance of the computer code involves identifying at least one of a change made to a privacy policy displayed on the website or a change in a location of a link to the privacy policy.

12 . The system of claim 8 , wherein modifying the data map to reflect the privacy-related attribute comprises modifying the data map to identify a storage location for the type of personal information that the new instance of the computer code at least one of collects or accesses.

13 . The system of claim 8 , wherein the data map is associated with a privacy campaign and providing the data map for display to the user comprises providing a visual representation of the privacy campaign that includes the type of personal information that the new instance of the computer code at least one of collects or accesses.

14 . A non-transitory computer-readable medium storing computer-executable instructions that, when executed by processing hardware, configure the processing hardware to perform operations, upon a new instance of a computer code being identified at a location being monitored where the computer code is located, comprising:
comparing the new instance of the computer code with a previous instance of the computer code to identify a change has been made to the computer code; responsive to identifying the change, analyzing the new instance of the computer code to determine a privacy-related attribute of the new instance of the computer code, the privacy-related attribute indicating a type of personal information that the new instance of the computer code at least one of collects or accesses; and modifying a data map representing processing of the personal information to reflect the privacy-related attribute identified for the new instance of the computer code, wherein the data map is provided for display to a user.

15 . The non-transitory computer-readable medium of claim 14 , wherein analyzing the new instance of the computer code to determine the privacy-related attribute comprises detecting use by the computer code of at least one of a location-based capability to detect a location of a user computing device, an encryption capability, a call to third party computer code, a communication log, or a cookie to track user behavior.

16 . The non-transitory computer-readable medium of claim 14 , wherein the privacy-related attribute represents at least one of a storage location of the type of personal information or an access permission of the type of personal information.

17 . The non-transitory computer-readable medium of claim 14 , wherein the computer code is associated with a website and identifying the new instance of the computer code involves identifying at least one of a change made to a privacy policy displayed on the website or a change in a location of a link to the privacy policy.

18 . The non-transitory computer-readable medium of claim 14 , wherein modifying the data map to reflect the privacy-related attribute comprises modifying the data map to identify a storage location for the type of personal information that the new instance of the compu

Assignees

• Onetrust Llc

Inventors

• Barday Kabir A
• Karanjkar Mihir S
• Finch Steven W
• Browne Ken A
• Heard Nathan W
• Patel Aakash H
• Sabourin Jason L
• Daniel Richard L
• Patton-Kuhl Dylan D
• Brannon Jonathan Blake

Classifications

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/04

  for providing a confidential data exchange among entities communicating through data packet networks · CPC title

• G06Q10/06

  Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling · CPC title

• G06Q10/0635 Primary

  Risk analysis of enterprise or organisation activities · CPC title

• H04L63/1433

  Vulnerability analysis · CPC title