Data processing systems for fulfilling data subject access requests and related methods
Responding to a data subject access request includes receiving the request and validating an identity of the requestor. In response to validating the identity of the requestor, a computer processor determines whether the data subject access request is subject to fulfillment constraints. If so, then the computer processor notifies the requestor that the data subject access request is subject to one or more limitations and the computer processor takes action based on those limitations. Fulfillment constraint data is updated and maintained in a database or server.
1. A computer-implemented data processing method for responding to a data subject access request, the method comprising:
receiving, by one or more computer processors, a data subject access request from a requestor comprising one or more first pieces of personal data associated with the requestor;
validating, by the one or more computer processors, an identity of the requestor based at least in part on the one or more first pieces of personal data;
in response to validating the identity of the requestor, determining, by the one or more computer processors, whether the data subject access request is subject to one or more response fulfillment constraints associated with the requestor or associated with a source of the data subject access request;
in response to determining that the data subject access request is subject to one or more response fulfillment constraints associated with the requestor or associated with a source of the data subject access request, taking action, by the one or more computer processors, according to one or more limitations corresponding to the one or more response fulfillment constraints; and
in response to determining that the data subject access request is not subject to one or more response fulfillment constraints:
identifying, by the one or more computer processors, one or more second pieces of personal data associated with the requestor, the one or more second pieces of personal data being stored in one or more data repositories associated with a particular organization, and
using the one or more second pieces of personal data to fulfill the data subject access request.
2. The computer-implemented data processing method of claim 1 , wherein the one or more response fulfillment constraints are associated with a source of the data subject access request.
3. The computer-implemented data processing method of claim 2 , wherein the source is selected from the group consisting of:
a particular IP address; and
a particular domain.
4. The computer-implemented data processing method of claim 3 wherein the source is selected from the group consisting of:
a particular IP address associated with a competitor; and
a particular domain associated with a competitor.
5. The computer-implemented data processing method of claim 3 , wherein the source is selected from the group consisting of:
a particular IP address or a particular domain associated with a particular geographic region;
a particular IP address or a particular domain associated with a particular political group; and
a particular IP address or a particular domain associated with a particular protesting group.
6. The computer-implemented data processing method of claim 1 , wherein the one or more response fulfillment constraints are associated with the requestor.
7. The computer-implemented data processing method of claim 6 , wherein determining whether the data subject access request is subject to one or more response fulfillment constraints comprises determining, by the one or more computer processors, whether the requestor was previously and not currently employed by an entity receiving the data subject access request.
8. The computer-implemented data processing method of claim 1 , further comprising updating, by the one or more computer processors, the fulfillment constraint data in a third party repository server to store information associated with the data subject access request received from the requestor.
9. The computer-implemented data processing method of claim 1 , wherein the one or more response fulfillment constraints comprise denial of the data subject access request.
10. The computer-implemented data processing method of claim 1 , wherein the data subject access request being subject to one or more response fulfillment constraints comprises the data subject access request being subject to one or more processing fees.
11. The computer-implemented data processing method of claim 1 , further comprising:
if the data subject access request is subject to one or more response fulfillment constraints, determining, by the one or more computer processors, whether the one or more limitations comprises denying the data subject access request or requesting one or more processing fees prior to fulfilling the request by taking one or more actions based at least in part on the data subject access request.
12. The computer-implemented data processing method of claim 11 , wherein determining whether the one or more limitations comprise denying the data subject access request or requesting one or more processing fees prior to fulfilling the request comprises analyzing, by the one or more computer processors, a customer history associated with the requestor.
13. The computer-implemented data processing method of claim 12 , wherein the customer history associated with the requestor comprises one or more spending characteristics.
14. The computer-implemented data processing method of claim 13 , wherein if the one or more spending characteristics comprise an amount spent over a reference time period that exceeds a spending threshold, then the one or more limitations comprise requesting, by the one or more computer processors, one or more processing fees prior to fulfilling the data subject access request.
15. The computer-implemented data processing method of claim 13 , wherein if the one or more spending characteristics comprise an amount spent over a reference time period that does not exceed a spending threshold, then the one or more limitations comprise denying, by the one or more computer processors, the data subject access request.
16. The computer-implemented data processing method of claim 11 , wherein determining whether the one or more limitations comprise denying the data subject access request or requesting one or more processing fees prior to fulfilling the request comprises analyzing, by the one or more computer processors, a complaint history associated with the requestor.
17. The computer-implemented data processing method of claim 1 , further comprising:
in response to determining that the data subject access request is subject to one or more response fulfillment constraints associated with the requestor or associated with a source of the data subject access request:
providing, by the one or more computer processors, the requestor with a reason for the one or more limitations;
informing, by the one or more computer processors, the requestor of their right to communicate with a supervisory authority regarding the one or more limitations; and
informing, by the one or more computer processors, the requestor of their right to judicial remedy without delay.
18. The computer implemented data processing method of claim 17 , further comprising identifying or storing, by the one or more computer processors, documentation supporting the reason far the one or more limitations.
19. The computer-implemented data processing method of claim 1 , wherein the one or more data repositories storing the one or more pieces of personal data associated with the particular organization comprises a third party repository server associated with and accessible by a plurality of organizations.
20. A computer-implemented data processing method for responding to a data subject access request, the method comprising:
receiving, by one or more computer processors, a data subject access request from a requestor comprising one or more pieces of personal data associated with the requestor;
validating, by the one or more computer processors, an identity of the requestor based at least in part on the one or more pieces of personal data;
in response to validating the identity of the requestor, retrieving, by the one or more computer processors, fulfillment constraint data associated with the data subject access request from a third party repository server corresponding to a plurality of data subject access requests from a plurality of requestors and a plurality of data subject access request sources;
determining, by the one or more computer processors, that the data subject access request is subject to one or more response fulfillment constraints based on the fulfillment constraint data; and
in response to determining that the data subject access request is subject to one or more response fulfillment constraints based on the fulfillment constraint data:
(1) denying, by the one or more computer processors, the data subject access request, or
(2) requesting, by the one or more computer processors, one or more processing fees prior to fulfilling the request by taking one or more actions based at least in part on the data subject access request.
21. The computer-implemented data processing method of claim 20 , further comprising identifying or storing, by the one or more computer processors, documentation supporting the reason for the one or more response fulfillment constraints.
22. The computer-implemented data processing method of claim 20 , further comprising updating, by the one or more computer processors, the fulfillment constraint data in the third party repository server to store information associated with the data subject access request received from the requestor.
23. The computer-implemented data processing method of claim 20 , wherein the one or more response fulfillment constraints are associated with a source of the data subject access request.
24. The computer-implemented data processing method of claim 20 , wherein the fulfillment constraint data comprises a purchase history or a complaint history associated with the requestor.