Data processing systems for data testing to confirm data deletion and related methods
In particular embodiments, a Personal Data Deletion System is configured to: (1) at least partially automatically identify and delete personal data that an entity is required to erase under one or more of the conditions discussed above; and (2) perform one or more data tests after the deletion to confirm that the system has, in fact, deleted any personal data associated with the data subject. The system may, for example, be configured to test to ensure the data has been deleted by: (1) submitting a unique token of data through a form to a system; (2) in response to passage of an expected data retention time, test the system by calling into the system after the passage of the data retention time to search for the unique token.
1. A data management computer system for confirming a deletion of personal data associated with a data subject from one or more computer systems associated with an entity, the system comprising:
one or more computer processors; and
computer memory operatively coupled to the one or more processors, wherein the one or more computer processors are adapted for:
receiving an indication that the one or more computer systems have completed an erasure of one or more pieces of personal data associated with the data subject;
in response to receiving the indication that the one or more computer systems have completed the erasure, initiating a test interaction between the data subject and the entity, the test interaction requiring a response from the entity to the data subject;
in response to initiating the test interaction, determining whether one or more computer systems associated with the entity have initiated a test interaction response to the data subject based at least in part on the test interaction; and
in response to determining that the one or more computer systems associated with the entity have initiated the test interaction response:
determining whether the one or more computer systems have completed the erasure of the one or more pieces of personal data associated with the data subject; and
automatically taking one or more actions with regard to the personal data associated with the data subject, wherein the one or more actions comprise:
identifying the one or more pieces of personal data associated with the data subject that remain stored in the one or more computer systems of the entity;
flagging the one or more pieces of personal data associated with the data subject that remain stored in the one or more computer systems of the entity;
providing the flagged one or more pieces of personal data associated with the data subject that remain stored in the one or more computer systems of the entity to an individual associated with the entity;
generating a report indicating that the one or more pieces of personal data associated with the data subject remain stored in the one or more computer systems of the entity; and
providing the report to the individual associated with the entity.
2. The data management computer system of claim 1 , wherein:
initiating the test interaction between the data subject and the entity comprises substantially automatically completing a contact-request form hosted by the entity on behalf of the data subject.
3. The data management computer system of claim 2 , wherein:
substantially automatically completing the contact-request form comprises providing one or more pieces of identifying data associated with the data subject, the one or more pieces of identifying data comprising data other than contact data.
4. The data management computer system of claim 3 , wherein determining whether the one or more system associated with the entity have generated the test interaction response, further comprises:
determining whether the one or more computer systems of the entity have attempted to contact the data subject in response to submission of the contact-request form.
5. The data management computer system of claim 1 , wherein the method further comprises initiating a test interaction between the data subject and the entity in response to determining that a certain period of time has elapsed from a time that the data subject provided the request to delete the data subject's personal data.
6. The data management computer system of claim 5 , wherein the test interaction is automatically initiated by the computer system.
7. A data management computer system for confirming deletion of personal data within one or more computer systems associated with an entity, the system comprising:
one or more computer processors; and
computer memory operatively coupled to the one or more processors, wherein the one or more computer processors are adapted for:
receiving an indication that the one or more computer systems have completed an erasure of one or more pieces of personal data associated with a test data subject;
in response to receiving the indication that the one or more computer systems have completed the erasure, initiating a test interaction between a test data subject and the entity, the test interaction requiring a response from the entity to the test data subject;
in response to initiating the test interaction, determining whether the one or more computer systems associated with the entity have transmitted the response to the test data subject; and
in response to determining that the one or more computer systems associated with the entity have transmitted the response:
determining whether the one or more computer systems have completed the erasure of the one or more pieces of personal data associated with the test data subject; and
automatically taking one or more actions with regard to the personal data associated with the test data subject, wherein the one or more actions comprise:
identifying the one or more pieces of personal data associated with the test data subject that remain stored in the one or more computer systems of the entity;
flagging the one or more pieces of personal data associated with the test data subject that remain stored in the one or more computer systems of the entity;
providing the flagged one or more pieces of personal data associated with the test data subject that remain stored in the one or more computer systems of the entity to an individual associated with the entity;
generating a report indicating that one or more pieces of personal data associated with the test data subject that remain stored in the one or more computer systems of the entity; and
providing the report to an individual associated with the entity.
8. The data management computer system of claim 7 , wherein:
initiating the test interaction between the test data subject and the entity comprises substantially automatically completing a contact-request form hosted by the entity on behalf of the test data subject.
9. The data management computer system of claim 8 , wherein:
substantially automatically completing the contact-request form comprises providing one or more pieces of identifying data associated with the test data subject, the one or more pieces of identifying data comprising data other than contact data.
10. The data management computer system of claim 9 , further comprising:
determining whether the one or more computer systems associated with the entity have generated the response and transmitted the response to the test data subject comprises determining whether the one or more computer systems have attempted to contact the test data subject in response to submission of the contact-request form.
11. The data management computer system of claim 10 , wherein the method further comprises initiating a test interaction between the data subject and the entity in response to determining that a certain period of time has elapsed from a time that the data subject provided the request to delete the data subject's personal data.
12. The data management computer system of claim 11 , wherein the test interaction is automatically initiated by the computer system.
13. A computer-implemented data processing method for monitoring compliance by a particular entity with a data subject's request to delete the data subject's personal data from one or more computer systems associated with a particular entity, the method comprising:
providing a communication to the entity, wherein the communication:
(a) comprises a unique identifier associated with the data subject;
(b) is performed without using a personal communication data platform, and
(c) prompts the entity to provide a response by contacting the data subject via a personal communication data platform;
in response to providing the communication to the entity, determining whether the data subject has received a response via the personal communication data platform;
in response to determining that the data subject has received the response via the personal communication data platform, determining whether the one or more computer systems have executed the data subject's request for deletion of the data subject's personal data;
in response to determining that the one or more computer systems have not complied with the data subject's request for deletion, generating an indication that the one or more computer systems have not complied with the data subject's request for deletion of the data subject's personal data;
digitally storing in computer memory the indication that the one or more computer systems have not complied with the data subject's request for deletion of the data subject's personal data;
identifying one or more pieces of personal data associated with the data subject that are stored in the one or more computer systems of the entity;
flagging the one or more pieces of personal data associated with the data subject that are stored in the one or more computer systems of the entity;
providing the flagged one or more pieces of personal data associated with the data subject that are stored in the one or more computer systems of the entity to an individual associated with the entity;
generating a report based at least in part on the indication that the entity has not complied with the data subject's request for deletion of their personal data in computer memory; and
providing the generated report to an individual associated with the entity.
14. The computer-implemented data processing method of claim 13 , wherein the individual associated with the entity is a privacy officer of the entity.