IP Library › Granted Patent US 11,609,939
Granted Patent B2
US 11,609,939 · App. 17/711,331 · Granted Mar 21, 2023

Data processing systems and methods for automatically detecting and documenting privacy-related aspects of computer software

Inventors: Priya Malhotra (Atlanta, GA); Kabir A. Barday (Atlanta, GA); Mihir S. Karanjkar (Marietta, GA); Steven W. Finch (Kennesaw, GA); Ken A. Browne (Johns Creek, GA); Nathan W. Heard (Marietta, GA); Aakash H. Patel (Norcross, GA); Jason L. Sabourin (Brookhaven, GA); Richard L. Daniel (Atlanta, GA); Dylan D. Patton-Kuhl (Atlanta, GA); Jonathan Blake Brannon (Smyrna, GA)
Assignee: OneTrust, LLC
G06F16/288G06F15/76G06F16/254G06F21/552G06F40/186G06N20/00G06Q10/06H04L63/04H04L63/101H04L63/20H04L67/306H04W12/02
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 11,609,939
App. No.
17/711,331
Filed
Apr 1, 2022
Granted
Mar 21, 2023
Kind
B2
Art Unit
2191
USPC
707/802
Abstract

Data processing systems and methods according to various embodiments are adapted for automatically detecting and documenting privacy-related aspects of computer software. Particular embodiments are adapted for: (1) automatically scanning source code to determine whether the source code include instructions for collecting personal data; and (2) facilitating the documentation of the portions of the code that collect the personal data. For example, the system may automatically prompt a user for comments regarding the code. The comments may be used, for example, to populate: (A) a privacy impact assessment; (B) system documentation; and/or (C) a privacy-related data map. The system may comprise, for example, a privacy comment plugin for use in conjunction with a code repository.

Claims (44)

1. A method comprising:

analyzing, by computing hardware, a segment of computer code to determine whether the segment comprises instructions for using personal data, wherein analyzing the segment of the computer code comprises processing the segment using at least one of a rules-based model or a machine learning model to generate an output indicating that the segment comprises the instructions for using the personal data;

responsive to determining that the segment comprises the instructions for using the personal data, providing, by the computing hardware, a graphical user interface for a display to a user, wherein the graphical user interface is configured to prompt the user to input information on the segment comprising the instructions using the personal data;

receiving, by the computing hardware, the information input from the user; and

performing at least one of:

populating an electronic record used to document functionality of the computer code with at least a portion of the information;

populating at least one question found in a questionnaire used in conducting a privacy impact assessment for the computer code with at least the portion of the information; or

populating a data model with at least the portion of the information, wherein the data model comprises a digital inventory for a data asset associated with the computer code.

2. The method of claim 1 , wherein analyzing the segment of computer code and providing the graphical user interface is performed via a plug-in in conjunction with a repository adapted to store the computer code.

3. The method of claim 1 , wherein analyzing the segment of the computer code occurs at least substantially in real time as the user is writing the segment of the computer code.

4. The method of claim 1 , wherein providing the graphical user interface occurs at least substantially in real time as the user is writing the segment of the computer code.

5. The method of claim 1 , wherein the graphical user interface is configured with at least one of a dropdown input, a multiple-choice selection, or a template for the user to follow to facilitate the user in providing the information.

6. The method of claim 1 , wherein the output indicating that the segment uses the personal data comprises a type of the personal data.

7. The method of claim 6 , wherein the graphical user interface is configured with at least one of a dropdown input, a multiple-choice selection, or a template for the user to follow to facilitate the user in providing the information, and selections for the dropdown input, the multiple-choice selection, or the template are based on the type of the personal data.

8. A system comprising:

a non-transitory computer-readable medium storing instructions; and

a processing device communicatively coupled to the non-transitory computer-readable medium,

wherein, the processing device is configured to execute the instructions and thereby perform operations comprising:

analyzing a segment of computer code to determine whether the segment comprises instructions for using personal data, wherein analyzing the segment of the computer code comprises processing the segment of computer code using at least one of a rules-based model or a machine learning model to generate output indicating the segment comprises the instructions for using the personal data;

responsive to the output indicating the segment comprises the instructions for using the personal data, providing a graphical user interface for a display to a user, wherein the graphical user interface is configured to prompt the user to input information on the segment comprising the instructions using the personal data;

receiving the information input from the user; and

performing at least one of:

populating an electronic record used to document functionality of the computer code with at least a portion of the information;

populating at least one question found in a questionnaire used in conducting a privacy impact assessment for the computer code with at least the portion of the information; or

populating a data model with at least the portion of the information, wherein the data model comprises a digital inventory for a data asset associated with the computer code.

9. The system of claim 8 further comprising a repository adapted to store the computer code, wherein processing the segment of computer code and providing the graphical user interface is performed via a plug-in in conjunction with the repository.

10. The system of claim 8 , wherein processing the segment of the computer code occurs at least substantially in real time as the user is writing the segment of the computer code.

11. The system of claim 8 , wherein providing the graphical user interface occurs at least substantially in real time as the user is writing the segment of the computer code.

12. The system of claim 8 , wherein the graphical user interface is configured with at least one of a dropdown input, a multiple-choice selection, or a template for the user to follow to facilitate the user in providing the information.

13. The system of claim 8 , wherein the output indicating that the segment uses the personal data comprises a type of the personal data.

14. The system of claim 13 , wherein the graphical user interface is configured with at least one of a dropdown input, a multiple-choice selection, or a template for the user to follow to facilitate the user in providing the information, and selections for the dropdown input, the multiple-choice selection, or the template are based on the type of the personal data.

15. A non-transitory computer-readable medium having program code that is stored thereon, the program code executable by one or more processing devices for performing operations comprising:

analyzing a segment of computer code to determine whether the segment comprises instructions for using personal data, wherein analyzing the segment of the computer code comprises processing the segment of computer code using at least one of a rules-based model or a machine learning model to generate output indicating the segment comprises the instructions for using the personal data;

responsive to the output indicating the segment comprises the instructions for using the personal data, providing a graphical user interface for a display to a user, wherein the graphical user interface is configured to prompt the user to input information on the segment comprising the instructions using the personal data;

receiving the information input from the user; and

performing at least one of:

populating an electronic record used to document functionality of the computer code with at least a portion of the information;

populating at least one question found in a questionnaire used in conducting a privacy impact assessment for the computer code with at least the portion of the information; or

populating a data model with at least the portion of the information, wherein the data model comprises a digital inventory for a data asset associated with the computer code.

16. The non-transitory computer-readable medium of claim 15 , wherein the program code comprises a plug-in used in conjunction with a repository adapted to store the computer code.

17. The non-transitory computer-readable medium of claim 15 , wherein processing the segment of the computer code occurs at least substantially in real time as the user is writing the segment of the computer code.

18. The non-transitory computer-readable medium of claim 15 , wherein providing the graphical user interface occurs at least substantially in real time as the user is writing the segment of the computer code.

19. The non-transitory computer-readable medium of claim 15 , wherein the graphical user interface is configured with at least one of a dropdown input, a multiple-choice selection, or a template for the user to follow to facilitate the user in providing the information.

20. The non-transitory computer-readable medium of claim 15 , wherein the output indicating that the segment uses the personal data comprises a type of the personal data.