Privacy management systems and methods
Data processing systems and methods, according to various embodiments, are adapted for mapping various questions regarding a data breach from a master questionnaire to a plurality of territory-specific data breach disclosure questionnaires. The answers to the questions in the master questionnaire are used to populate the territory-specific data breach disclosure questionnaires and determine whether disclosure is required in territory. The system can automatically notify the appropriate regulatory bodies for each territory where it is determined that data breach disclosure is required.
1. A computer-implemented data processing method for determining a required data privacy activity comprising:
receiving, by one or more computer processors from a user via a first graphical user interface, an indication of a first jurisdiction and an indication of a second jurisdiction;
retrieving, by the one or more computer processors based at least in part on the first jurisdiction, a first data privacy requirement for the first jurisdiction from a data structure using an ontology mapping the first data privacy requirement for the first jurisdiction to a second data privacy requirement for the second jurisdiction;
retrieving, by the one or more computer processors based on the ontology mapping the first data privacy requirement for the first jurisdiction to the second data privacy requirement for the second jurisdiction, the second data privacy requirement for the second jurisdiction from the data structure using the ontology;
retrieving, by the one or more computer processors based on the first jurisdiction, a first enforcement parameter from the data structure using the ontology, wherein the first enforcement parameter indicates a first number of enforcement actions associated with the first data privacy requirement for the first jurisdiction performed in a particular time period;
retrieving, by the one or more computer processors based at least in part on the second jurisdiction, a second enforcement parameter from the data structure using the ontology, wherein the second enforcement parameter indicates a second number of enforcement actions associated with the second data privacy requirement for the second jurisdiction performed in the particular time period;
determining, by the one or more computer processors, a first reporting score for the first jurisdiction based on a first business value for the first jurisdiction and the first enforcement parameter;
determining, by the one or more computer processors, a second reporting score for the second jurisdiction based on a second business value for the second jurisdiction and the second enforcement parameter;
determining, by the one or more computer processors, that satisfying the first data privacy requirement for the first jurisdiction conflicts with satisfying the second data privacy requirement for the second jurisdiction;
in response to determining that satisfying the first data privacy requirement for the first jurisdiction conflicts with satisfying the second data privacy requirement for the second jurisdiction, automatically, by the one or more computer processors:
calculating a first risk level associated with not satisfying the first data privacy requirement for the first jurisdiction using the first reporting score for the first jurisdiction; and
calculating a second risk level associated with not satisfying the second data privacy requirement for the second jurisdiction using the second reporting score for the second jurisdiction;
performing, by the one or more computer processors, a comparison of the first risk level with the second risk level to determine which of the first risk level and the second risk level is a lowest risk level;
determining, by the one or more computer processors based on the lowest risk level, a required data privacy activity;
mapping, by the one or more computer processors, the required data privacy activity to a master question in a master questionnaire;
electronically generating, by the one or more computer processors, a second graphical user interface comprising the master questionnaire;
electronically receiving, by the one or more computer processors, data responsive to the master question via the second graphical user interface;
generating, by the one or more computer processors, an electronic link associating the data responsive to the master question with the required data privacy activity in the data structure using the ontology; wherein:
calculating the first risk level associated with not satisfying the first data privacy requirement for the first jurisdiction comprises determining a first fine imposition rate for violations of the first data privacy requirement for the first jurisdiction; and
calculating the second risk level associated with not satisfying the second data privacy requirement for the second jurisdiction comprises determining a second fine imposition rate for violations of the second data privacy requirement for the second jurisdiction.
2. The computer-implemented data processing method of claim 1 , further comprising automatically performing the required data privacy activity.
3. The computer-implemented data processing method of claim 1 , wherein the first data privacy requirement for the first jurisdiction comprises a first personal data retention policy; and
wherein the second data privacy requirement for the second jurisdiction comprises a second personal data retention policy.
4. The computer-implemented data processing method of claim 1 , wherein calculating the first risk level associated with not satisfying the first data privacy requirement for the first jurisdiction comprises determining a first penalty for not satisfying the first data privacy requirement for the first jurisdiction; and
wherein calculating the second risk level associated with not satisfying the second data privacy requirement for the second jurisdiction comprises determining a second penalty for not satisfying the second data privacy requirement for the first jurisdiction.
5. The computer-implemented data processing method of claim 1 , wherein calculating the first risk level associated with not satisfying the first data privacy requirement for the first jurisdiction comprises determining a first volume of data processed in the first jurisdiction; and
wherein calculating the second risk level associated with not satisfying the second data privacy requirement for the second jurisdiction comprises determining a second volume of data processed in the first jurisdiction.
6. The computer-implemented data processing method of claim 1 , further comprising presenting, on the generating a third graphical user interface comprising a recommended course of action comprising an indication of the required data privacy activity.
7. A computer-implemented data processing method for performing data breach response activities comprising:
determining, by one or more computer processors, a first jurisdiction affected by a data breach;
determining, by the one or more computer processors, a second jurisdiction affected by the data breach;
retrieving, by the one or more computer processors based on the first jurisdiction, the first reporting requirement for the first jurisdiction from a data structure using an ontology mapping the first reporting requirement for the first jurisdiction to a second reporting requirement for the second jurisdiction;
retrieving, by the one or more computer processors based on the ontology mapping the first reporting requirement for the first jurisdiction to the second reporting requirement for the second jurisdiction, the second reporting requirement for the second jurisdiction from the data structure using the ontology;
retrieving, by the one or more computer processors based on the first jurisdiction, a first enforcement parameter from the data structure using the ontology, wherein the first enforcement parameter indicates a first number of enforcement actions associated with the first reporting requirement for the first jurisdiction performed in a particular time period;
retrieving, by the one or more computer processors based on the second jurisdiction, a second enforcement parameter from the data structure using the ontology, wherein the second enforcement parameter indicates a second number of enforcement actions associated with the second reporting requirement for the second jurisdiction performed in a particular time period;
determining, by the one or more computer processors, a first reporting score for the first jurisdiction based on a first business value for the first jurisdiction and the first enforcement parameter;
determining, by the one or more computer processors, a second reporting score for the second jurisdiction based on a second business value for the second jurisdiction and the second enforcement parameter;
determining, by the one or more computer processors, that performing both the first reporting requirement for the first jurisdiction and the second reporting requirement for the second jurisdiction is not possible;
in response to determining that performing both the first reporting requirement for the first jurisdiction and performing the second reporting requirement for the second jurisdiction is not possible, automatically, by the one or more computer processors:
calculating a first risk level associated with not performing the first reporting requirement for the first jurisdiction using the first reporting score for the first jurisdiction, wherein calculating the first risk level comprises determining a first penalty for not satisfying the first reporting requirement for the first jurisdiction; and
calculating a second risk level associated with not performing the second reporting requirement for the second jurisdiction using the second reporting score for the second jurisdiction, wherein calculating the second risk level comprises determining a second penalty for not satisfying the second reporting requirement for the second jurisdiction;
performing, by the one or more computer processors, a comparison of the first risk level with the second risk level to determine that the first risk level is higher than the second risk level;
determining, by the one or more computer processors based on determining that the first risk level is higher than the second risk level, to perform the first reporting requirement for the first jurisdiction;
mapping, by the one or more computer processors, the first reporting requirement for the first jurisdiction to a master question in a master questionnaire and not mapping the second reporting requirement for the second jurisdiction to a question in the master questionnaire;
electronically generating, by the one or more computer processors, a graphical user interface comprising the master questionnaire;
electronically receiving, by the one or more computer processors, data responsive to the master question via the graphical user interface;
generating, by the one or more computer processors, an electronic link associating the data responsive to the master question with the first reporting requirement for the first jurisdiction in the data structure using the ontology; and
automatically performing, by the one or more computer processors, the first reporting requirement for the first jurisdiction.
8. The computer-implemented data processing method of claim 7 , further comprising electronically storing an indication that the second reporting requirement for the second jurisdiction was not performed.
9. The computer-implemented data processing method of claim 8 , further comprising electronically communicating the indication that the second reporting requirement for the second jurisdiction was not performed to a user.
10. The computer-implemented data processing method of claim 7 , wherein determining the first jurisdiction affected by the data breach comprises receiving an indication of the first jurisdiction as an answer to a first question in a first questionnaire; and
wherein determining the second jurisdiction affected by the data breach comprises receiving an indication of the second jurisdiction as an answer to a second question in the first questionnaire.
11. The computer-implemented data processing method of claim 10 , wherein determining the first reporting requirement for the first jurisdiction comprises using the ontology to determine the first reporting requirement for the first jurisdiction based on the answer to the first question in the questionnaire; and
wherein determining the second reporting requirement for the second jurisdiction comprises using the ontology to determine the second reporting requirement for the second jurisdiction based on the answer to the second question in the questionnaire.
12. The computer-implemented data processing method of claim 7 , wherein calculating the first risk level associated with not performing the first reporting requirement for the first jurisdiction comprises determining a first deadline for performing the first reporting requirement for the first jurisdiction; and
wherein calculating the second risk level associated with not performing the second reporting requirement for the second jurisdiction comprises determining a second deadline for performing the second reporting requirement for the second jurisdiction.
13. The computer-implemented data processing method of claim 12 , wherein determining the first deadline for performing the first reporting requirement for the first jurisdiction comprises accessing the ontology using an indication of the first jurisdiction to determine the first deadline for performing the first reporting requirement for the first jurisdiction; and
wherein determining the second deadline for performing the second reporting requirement for the second jurisdiction comprises accessing an ontology using an indication of the second jurisdiction to determine the second deadline for performing the second reporting requirement for the second jurisdiction.
14. A data breach response system comprising:
one or more processors; and
computer memory, wherein the data breach response system is configured for:
generating a data breach information interface soliciting a first affected jurisdiction, a second affected jurisdiction, and data breach information;
presenting the data breach information interface to a user;
receiving, from the user via the data breach information interface, an indication of the first affected jurisdiction, an indication of the second affected jurisdiction, and the data breach information;
retrieving, based on the first affected jurisdiction and the data breach information, a first data breach response requirement for the first affected jurisdiction from a data structure using an ontology mapping the first data breach response requirement for the first affected jurisdiction to a second data breach response requirement for the second affected jurisdiction;
retrieving, based on the second affected jurisdiction, the ontology mapping the first data breach response requirement for the first affected jurisdiction to the second data breach response requirement for the second affected jurisdiction, and the data breach information, the second data breach response requirement for the second affected jurisdiction from the data structure using the ontology;
retrieving, based on the first affected jurisdiction, a first enforcement parameter from the data structure using the ontology, wherein the first enforcement parameter indicates a first number of enforcement actions associated with the first data breach response requirement for the first affected jurisdiction in a particular time period;
retrieving, based on the second affected jurisdiction, a second parameter from the data structure using the ontology, wherein the second enforcement parameter indicates a second number of enforcement actions associated with the second data breach response requirement enforcement for the second affected jurisdiction in the particular time period;
determining a first reporting score for the first affected jurisdiction based on a first business value for the first affected jurisdiction and the first enforcement parameter;
determining a second reporting score for the second affected jurisdiction based on a second business value for the second affected jurisdiction and the second enforcement parameter;
determining that performing both the first data breach response requirement for the first affected jurisdiction and the second data breach response requirement for the second affected jurisdiction is not possible; and
in response to determining that performing both the first data breach response requirement for the first affected jurisdiction and the second data breach response requirement for the second affected jurisdiction is not possible:
calculating a first risk level associated with not performing the first data breach response requirement for the first affected jurisdiction using the first reporting score for the first affected jurisdiction; and
calculating a second risk level associated with not performing the second data breach response requirement for the second affected jurisdiction using the second reporting score for the second affected jurisdiction;
performing a comparison of the first risk level with the second risk level to determine that the first risk level is higher than the second risk level;
generating a master questionnaire comprising a master question;
mapping the first data breach response requirement for the first affected jurisdiction to the master question in the ontology and not mapping the second data breach response requirement for the second affected jurisdiction to a question in the master questionnaire;
generating a graphical user interface comprising the master questionnaire;
electronically receiving data responsive to the master question via the graphical user interface;
generating an electronic link associating the data responsive to the master question with the first data breach response requirement for the first affected jurisdiction in the data structure using the ontology;
generating a first data breach disclosure report for the first affected jurisdiction, the first data breach disclosure report comprising the data responsive to the master question, wherein:
the first reporting score for the first affected jurisdiction is further based at least in part on a first penalty associated with not satisfying a first reporting requirement for the first affected jurisdiction; and
the second reporting score for the second affected jurisdiction is further based at least in part on a second penalty associated with not satisfying a second reporting requirement for the second affected jurisdiction.
15. The data breach response system of claim 14 , wherein the data breach information comprises at least one of a number of affected users, a data breach discovery date, a data breach discovery time, a data breach occurrence date, a data breach occurrence time, or a data breach discovery method.
16. The data breach response system of claim 14 , wherein the first data breach disclosure report is one of a notification to a regulatory agency, a notification to affected data subjects, or a notification to an internal organization.
17. The data breach response system of claim 14 , wherein the data breach response system is further configured for:
determining, based on the first affected jurisdiction and the data breach information, a first plurality of data breach response requirements for the first affected jurisdiction; and
generating a data breach response interface comprising a checklist, the checklist comprising a plurality of checklist items,
wherein each of the plurality of checklist items is associated with a respective requirement of the first plurality of data breach response requirements, and
wherein none of the plurality of checklist items is associated with the second affected jurisdiction.
18. The data breach response system of claim 14 , wherein:
the first reporting score for the first affected jurisdiction is further based at least in part on a temporal proximity of a first deadline for satisfying reporting requirements for the first affected jurisdiction; and
the second reporting score for the second affected jurisdiction is further based at least in part on a temporal proximity of a second deadline for satisfying reporting requirements for the second affected jurisdiction.