Granted Patent B2

US 11,520,928 · App. 16/938,509 · Granted Dec 6, 2022

Inventors: Jonathan Blake Brannon (Smyrna, GA); Richard A. Beaumont (London, GB)

Assignee: OneTrust, LLC

G06F21/6254G06F9/542G06F21/78H04L63/20G06F2221/2143

Abstract

Claims (66)

1. A computer-implemented data processing method for an organization to retain one or more pieces of personal data that have a legal basis for retention, the method comprising:

identifying one or more pieces of personal data associated with a data subject based at least in part on one or more triggering actions;

identifying a storage location of each of the one or more pieces of personal data associated with the data subject;

in response to identifying the storage location of each of the one or more pieces of personal data associated with the data subject, automatically determining that a first portion of the one or more of the pieces of personal data has one or more legal bases for continued storage;

in response to determining that the first portion of the one or more of the pieces of personal data associated with the data subject has one or more legal bases for continued storage, automatically maintaining storage of the first portion of the one or more pieces of personal data; and

automatically facilitating deletion of a second portion of the one or more pieces of personal data associated with the data subject, wherein the second portion of the one or more pieces of personal data associated with the data subject is different from the first portion of the one or more pieces of personal data.

2. The computer-implemented data processing method of claim 1 , further comprising:

notifying the data subject that the second portion of the one or more pieces of the personal data is deleted.

3. The computer-implemented data processing method of claim 1 , wherein the one or more triggering actions is a data subject access request submitted by the data subject.

4. The computer-implemented data processing method of claim 1 , further comprising:

applying one or more storage attributes to the first portion of the one or more pieces of personal data; and

determining whether to maintain storage of the first portion of the one or more pieces of personal data based at least in part on the applying the one or more storage attribute to the first portion of the one or more pieces of personal data.

5. The computer-implemented data processing method of claim 4 , wherein the one or more storage attributes comprises a storage time of the one or more pieces of personal data, and the method further comprising:

comparing the storage time of the one or more pieces of personal data to an authorized storage time for the organization to store the one or more pieces of personal data;

determining that the storage time of the one or more pieces of personal data is greater than the authorized storage time for the organization to store the one or more pieces of personal data; and

in response to determining that the storage time of the one or more pieces of personal data is greater than the authorized storage time for the organization to store the one or more pieces of personal data, automatically notifying one or more privacy officers.

6. The computer-implemented data processing method of claim 5 , further comprising:

in response to determining that the storage time of the one or more pieces of personal data is greater than the authorized storage time for the organization to store the one or more pieces of personal data, automatically facilitating deletion of the first portion of the one or more pieces of personal data associated with the data subject.

7. The computer-implemented data processing method of claim 4 , wherein the one or more storage attributes comprises a relevancy attribute of the one or more pieces of personal data, and the method further comprising:

determining that a privacy campaign associated with the one or more pieces of personal data is inactive;

in response to determining that a privacy campaign associated with the one or more pieces of personal data is inactive, automatically facilitating deletion of the first portion of the one or more pieces of personal data associated with the data subject.

8. The computer-implemented data processing method of claim 1 , wherein the one or more legal bases for continued storage are selected from a group consisting of:

an ongoing legal case where the one or more pieces of personal data are to be retained;

consent from the data subject for the continued storage of the one or more pieces of personal data; and

an indication provided by the organization that the one or more pieces of personal data are a part of anonymized data.

9. The computer-implemented data processing method of claim 1 , further comprising:

providing the first portion of the one or more of the pieces of personal data associated with the data subject that has one or more legal bases for continued storage to one or more privacy officers of the organization; and

receiving storage retention feedback from the one or more privacy officers associated with the first portion of the one or more of the pieces of personal data associated with the data subject.

10. The computer-implemented data processing method of claim 9 , wherein the storage retention feedback further comprises:

a selection of a first set of the first portion of the one or more pieces of personal data for which to maintain continued storage; and

automatically facilitating deletion of a second set of the first portion of the one or more pieces of personal data associated with the data subject.

11. A computer-implemented data processing method for an organization to retain one or more pieces of personal data that have a legal basis for retention, the method comprising:

identifying one or more pieces of personal data associated with a data subject based at least in part on one or more triggering actions;

identifying a storage location of each of the one or more pieces of personal data associated with the data subject;

in response to identifying the storage location of each of the one or more pieces of personal data associated with the data subject, automatically determining that a first portion of the one or more of the pieces of personal data has one or more legal bases for continued storage;

in response to determining that the first portion of the one or more of the pieces of personal data associated with the data subject has one or more legal bases for continued storage, automatically notifying one or more privacy officers of the organization of (i) the first portion of the one or more pieces of personal data, and (ii) the one or more legal bases for continued storage of the first portion of the one or more pieces of personal data; and

automatically facilitating deletion of a second portion of the one or more pieces of personal data associated with the data subject, wherein the second portion of the one or more pieces of personal data associated with the data subject is different from the first portion of the one or more pieces of personal data.

12. The computer-implemented data processing method of claim 11 , further comprising:

notifying the data subject that the second portion of the one or more pieces of the personal data is deleted.

13. The computer-implemented data processing method of claim 11 , wherein the one or more triggering actions is a data subject access request submitted by the data subject.

14. The computer-implemented data processing method of claim 11 , further comprising:

applying one or more storage attributes to the first portion of the one or more pieces of personal data; and

determining whether to maintain storage of the first portion of the one or more pieces of personal data based at least in part on the applying the one or more storage attribute to the first portion of the one or more pieces of personal data.

15. The computer-implemented data processing method of claim 14 , wherein the one or more storage attributes comprises a storage time of the one or more pieces of personal data, and the method further comprising:

comparing the storage time of the one or more pieces of personal data to an authorized storage time for the organization to store the one or more pieces of personal data;

determining that the storage time of the one or more pieces of personal data is greater than the authorized storage time for the organization to store the one or more pieces of personal data; and

in response to determining that the storage time of the one or more pieces of personal data is greater than the authorized storage time for the organization to store the one or more pieces of personal data, automatically notifying one or more privacy officers.

16. The computer-implemented data processing method of claim 15 , further comprising:

in response to determining that the storage time of the one or more pieces of personal data is greater than the authorized storage time for the organization to store the one or more pieces of personal data, automatically facilitating deletion of the first portion of the one or more pieces of personal data associated with the data subject.

17. The computer-implemented data processing method of claim 14 , wherein the one or more storage attributes comprises a relevancy attribute of the one or more pieces of personal data, and the method further comprising:

determining that a privacy campaign associated with the one or more pieces of personal data is inactive; and

in response to determining that a privacy campaign associated with the one or more pieces of personal data is inactive, automatically facilitating deletion of the first portion of the one or more pieces of personal data associated with the data subject.

18. The computer-implemented data processing method of claim 11 , wherein the one or more legal bases for continued storage are selected from a group consisting of:

an ongoing legal case where the one or more pieces of personal data are to be retained;

consent from the data subject for the continued storage of the one or more pieces of personal data; and

an indication provided by the organization that the one or more pieces of personal data are a part of anonymized data.

19. A computer-implemented data processing method for an organization to retain one or more pieces of personal data that have a legal basis for retention, the method comprising:

identifying one or more pieces of personal data associated with a data subject based at least in part on one or more triggering actions;

automatically determining that a first portion of the one or more of the pieces of personal data has one or more legal bases for continued storage;

in response to determining that the first portion of the one or more of the pieces of personal data associated with the data subject has one or more legal bases for continued storage, automatically maintaining storage of the first portion of the one or more pieces of personal data;

providing the first portion of the one or more of the pieces of personal data associated with the data subject that has one or more legal bases for continued storage to one or more privacy officers of the organization;

receiving storage retention feedback from the one or more privacy officers associated with the first portion of the one or more of the pieces of personal data associated with the data subject; and

automatically facilitating deletion of a second portion of the one or more pieces of personal data associated with the data subject, wherein the second portion of the one or more pieces of personal data associated with the data subject is different from the first portion of the one or more pieces of personal data.

20. The computer-implemented data processing method of claim 19 , wherein the storage retention feedback further comprises:

a selection of a first set of the first portion of the one or more pieces of personal data for which to maintain continued storage; and

automatically facilitating deletion of a second set of the first portion of the one or more pieces of personal data associated with the data subject.

Assignments (2)

Continuity (24)

Cited By (7)

US 12,255,937 US 12,284,230 US 12,301,632 US 12,323,474 US 12,700,036 US 12,711,270 US 12,719,871