Data processing systems for use in automatically generating, populating, and submitting data subject access requests
Computer systems and methods for: (1) analyzing electronic correspondence associated with a data subject (e.g., the emails within one or more email in-boxes associated with the data subject); (2) based on the analysis, identifying at least one entity that that the data subject does not actively do business with (e.g., as evidenced by the fact that the data subject no longer opens emails from the entity, and/or has set up a rule to automatically delete emails received from the entity); and (3) in response to identifying the entity as an entity that the data subject no longer does business with, at least substantially automatically populating and/or submitting a data subject access request to the entity (e.g., to delete all personal information being processed by the entity).
1. A computer-implemented data processing method of automatically submitting a data subject access request, the method comprising:
analyzing, by one or more computer processors, a plurality of pieces of electronic correspondence received by a particular data subject from a particular entity;
determining, by one or more computer processors, based at least in part on the analysis, a first subset of the plurality of pieces of electronic correspondence, wherein each of the first subset of the plurality of pieces of electronic correspondence is a first electronic correspondence type;
determining, by one or more computer processors, based at least in part on the analysis, a second subset of the plurality of pieces of electronic correspondence, wherein each of the second subset of the plurality of pieces of electronic correspondence is a second electronic correspondence type, and wherein the first electronic correspondence type is distinct from the second electronic correspondence type;
determining, by one or more computer processors, a first engagement factor associated with the first subset of the plurality of pieces of electronic correspondence;
determining, by one or more computer processors, based at least in part on the analysis, a second engagement factor associated with the second subset of the plurality of pieces of electronic correspondence;
determining, by one or more computer processors, based at least in part on the first engagement factor and the second engagement factor, that the particular data subject does not actively do business with the particular entity; and
at least partially in response to determining that the particular data subject does not actively do business with the particular entity:
scanning, by one or more computer processors, one or more pieces of the first subset of the plurality of pieces of electronic correspondence to determine one or more pieces of personal data of the particular data subject; and
automatically submitting, by one or more computer processors, a data subject access request to the particular entity on behalf of the particular data subject, wherein:
the data subject access request comprises the one or more pieces of the personal data of the particular data subject determined by scanning the one or more pieces of the first subset of the plurality of pieces of electronic correspondence; and
the data subject access request is a request to modify one or more preferences of the particular data subject associated with the second electronic correspondence type.
2. The computer-implemented data processing method of claim 1 , wherein determining, based at least in part on the first engagement factor and the second engagement factor, that the particular data subject does not actively do business with the particular entity comprises:
determining, by one or more computer processors, a data subject disengagement rating based at least in part on the first engagement factor and the second engagement factor; and
determining, by one or more computer processors, that the particular data subject does not actively do business with the particular entity based at least in part on the data subject disengagement rating.
3. The computer-implemented data processing method of claim 2 , wherein determining that the particular data subject does not actively do business with the particular entity based at least in part on the data subject disengagement rating comprises:
determining, by one or more computer processors, that the data subject disengagement rating exceeds a threshold.
4. The computer-implemented data processing method of claim 2 , wherein:
determining the first engagement factor associated with the first subset of the plurality of pieces of electronic correspondence comprises assigning, by one or more computer processors, a first numerical value to the first engagement factor;
determining, based at least in part on the analysis, the second engagement factor associated with the second subset of the plurality of pieces of electronic comprises assigning, by one or more computer processors, a second numerical value to the second engagement factor; and
determining the data subject disengagement rating based at least in part on the first engagement factor and the second engagement factor comprises calculating, by one or more computer processors, the data subject disengagement rating using the first numerical value and the second numerical value.
5. The computer-implemented data processing method of claim 1 , wherein each piece of the plurality of pieces of electronic correspondence is a type of electronic correspondence selected from the group consisting of:
(a) an email;
(b) a text message;
(c) a social media post; and
(d) a scan of paper correspondence.
6. The computer-implemented data processing method of claim 1 , wherein analyzing the plurality of pieces of electronic correspondence received by the particular data subject from the particular entity comprises scanning each piece of the plurality of pieces of electronic correspondence to identify a domain associated with the particular entity.
7. The computer-implemented data processing method of claim 1 , wherein automatically submitting the data subject access request to the particular entity on behalf of the particular data subject comprises:
automatically transmitting a confirmation request message comprising an indication of the data subject access request to particular data subject;
receiving a confirmation message from the data subject; and
in response to receiving the confirmation message, submitting the data subject access request to the particular entity on behalf of the particular data subject.
8. A non-transitory computer-readable medium storing computer-executable instructions for automatically submitting a data subject access request by:
scanning, by one or more computer processors, a first plurality of pieces of electronic correspondence associated with a particular data subject to identify a particular entity;
identifying, by one or more processors, based at least in part on the identified particular entity, a second plurality of pieces of electronic correspondence received by a particular data subject from the particular entity;
analyzing, by one or more computer processors, the identified second plurality of pieces of electronic correspondence received by the particular data subject from the particular entity;
determining, by one or more computer processors, based at least in part on the analysis, a first subset of the second plurality of pieces of electronic correspondence, wherein each of the first subset of the second plurality of pieces of electronic correspondence is a first electronic correspondence type;
determining, by one or more computer processors, based at least in part on the analysis, a second subset of the second plurality of pieces of electronic correspondence, wherein each of the second subset of the second plurality of pieces of electronic correspondence is a second electronic correspondence type, and wherein the first electronic correspondence type is distinct from the second electronic correspondence type;
determining, by one or more computer processors, a first engagement factor associated with the first subset of the second plurality of pieces of electronic correspondence;
determining, by one or more computer processors, based at least in part on the analysis, a second engagement factor associated with the second subset of the second plurality of pieces of electronic correspondence;
determining, by one or more computer processors, based at least in part on the first engagement factor and the second engagement factor, that the particular data subject does not actively do business with the particular entity; and
at least partially in response to determining that the particular data subject does not actively do business with the particular entity:
scanning, by one or more computer processors, one or more of the first subset of the second plurality of pieces of electronic correspondence to determine a plurality of pieces of personal data of the particular data subject; and
automatically submitting, by one or more computer processors, a data subject access request to the particular entity on behalf of the particular data subject, wherein:
the data subject access request comprises one or more of the plurality of pieces of the personal data of the particular data subject determined by scanning the one or more of the second plurality of pieces of electronic correspondence; and
the data subject access request is a request to restrict processing by the particular entity of electronic correspondence of the second electronic correspondence type associated with the particular data subject.
9. The non-transitory computer-readable medium of claim 8 , wherein the second engagement factor associated with the second subset of the second plurality of pieces of electronic correspondence is determined based at least in part on criteria selected from a group consisting of:
(a) whether one or more of the second subset of the second plurality of pieces of electronic correspondence were opened by the particular data subject;
(b) a length of time one or more of the second subset of the second plurality of pieces of electronic correspondence were viewed by the particular data subject;
(c) whether the particular data subject activated a link in one or more of the second subset of the second plurality of pieces of electronic correspondence; and
(d) a percentage of the second subset of the second plurality of pieces of electronic correspondence that were opened by the particular data subject.
10. The non-transitory computer-readable medium of claim 8 , wherein determining, based at least in part on the first engagement factor and the second engagement factor, that the particular data subject does not actively do business with the particular entity comprises:
determining, by one or more computer processors, a data subject disengagement rating based at least in part on a sum of a value of the first engagement factor and a value of the second engagement factor; and
determining, by one or more computer processors, that the particular data subject does not actively do business with the particular entity based at least in part on the data subject disengagement rating.
11. The non-transitory computer-readable medium of claim 10 , wherein determining the data subject disengagement rating based at least in part on the sum of the value of the first engagement factor and the value of the second engagement factor comprises:
determining a respective weighting factor for each of the first engagement factor and the second engagement factor;
determining a respective weighted value for each of the first engagement factor and the second engagement factor based at least in part on the respective weighting factor for each of the first engagement factor and the second engagement factor and the respective value for each of the first engagement factor and the second engagement factor; and
determining the data subject disengagement rating based at least in part on the respective weighted value for each of the first engagement factor and the second engagement factor.
12. The non-transitory computer-readable medium of claim 8 , wherein the request to restrict processing by the particular entity of electronic correspondence of the second electronic correspondence type associated with the particular data subject comprises a request selected from a group consisting of:
(a) a request to delete the electronic correspondence of the second electronic correspondence type associated with the particular data subject;
(b) a request to delete all personal data of the particular data subject associated with the second electronic correspondence type; and
(c) a request to stop transmission of the electronic correspondence of the second electronic correspondence from the particular entity to the particular data subject.
13. The non-transitory computer-readable medium of claim 8 , wherein analyzing the second plurality of pieces of electronic correspondence received comprises identifying, by one or more computer processors, one or more components of each piece of the second plurality of pieces of electronic correspondence by a software plugin configured to integrate with a software application for accessing electronic correspondence on a computing device.
14. The non-transitory computer-readable medium of claim 13 , wherein each of the one or more components of each piece of the second plurality of pieces of electronic correspondence is selected from a group consisting of:
(a) a subject field of a respective piece of electronic correspondence;
(b) a sender of a respective piece of electronic correspondence;
(c) a body of a respective piece of electronic correspondence; and
(d) a domain associated with a respective piece of electronic correspondence.
15. A data processing system for automatically submitting a data subject access request, the system comprising:
one or more computer processors;
computer memory; and
a non-transitory computer-readable medium storing computer-executable instructions that, when executed by the one or more computer processors, cause the one or more computer processors to perform operations comprising:
scanning a first plurality of pieces of electronic correspondence associated with a particular data subject to identify a particular entity;
identifying, based at least in part on the identified particular entity, a second plurality of pieces of electronic correspondence received by a particular data subject from the particular entity;
analyzing the identified second plurality of pieces of electronic correspondence received by a particular data subject from the particular entity;
determining, based at least in part on the analysis, a first subset of the second plurality of pieces of electronic correspondence, wherein each of the first subset of the second plurality of pieces of electronic correspondence is a first electronic correspondence type;
determining, based at least in part on the analysis, a second subset of the second plurality of pieces of electronic correspondence, wherein each of the second subset of the second plurality of pieces of electronic correspondence is a second electronic correspondence type, and wherein the first electronic correspondence type is distinct from the second electronic correspondence type;
determining, a first engagement factor associated with the first subset of the second plurality of pieces of electronic correspondence;
determining, based at least in part on the analysis, a second engagement factor associated with the second plurality of pieces of electronic correspondence;
calculating, based at least in part on the first engagement factor and the second engagement factor, a data subject disengagement rating;
determining, based at least in part on the data subject disengagement rating, that the particular data subject does not use one or more services associated with the particular entity; and
at least partially in response to determining that the particular data subject does not use one or more services associated with the particular entity:
scanning one or more pieces of the first subset of the second plurality of pieces of electronic correspondence to determine one or more pieces of personal data of the particular data subject; and
automatically submitting a data subject access request to the particular entity on behalf of the particular data subject, wherein:
the data subject access request comprises the one or more pieces of the personal data of the particular data subject determined by scanning the one or more pieces of the first subset of the second plurality of pieces of electronic correspondence; and
the data subject access request is a request to modify one or more preferences of the particular data subject associated with the second electronic correspondence type.
16. The data processing system of claim 15 , wherein:
the first electronic correspondence type is email; and
the second electronic correspondence type is text messages.
17. The data processing system of claim 15 , wherein one or more of the one or more pieces of the personal data of the particular data subject determined by scanning the one or more pieces of the first subset of the second plurality of pieces of electronic correspondence is selected from a group consisting of:
(a) an email address of the particular data subject;
(b) a first name of the particular data subject;
(c) a last name of the particular data subject;
(d) an address of the particular data subject; and
(e) a telephone number of the particular data subject.
18. The data processing system of claim 15 , wherein analyzing the second plurality of pieces of electronic correspondence received by the particular data subject from the particular entity comprises scanning each piece of the plurality of pieces of electronic correspondence to identify a company name associated with the particular entity.
19. The data processing system of claim 15 , wherein analyzing the second plurality of pieces of electronic correspondence received by the particular data subject from the particular entity comprises analyzing interaction by the particular data subject with each piece of the second plurality of pieces of electronic correspondence.
20. The data processing system of claim 15 , wherein automatically submitting the data subject access request to the particular entity on behalf of the particular data subject comprises;
automatically transmitting a confirmation request message comprising an indication of the data subject access request to the particular data subject;
receiving a confirmation message from the data subject; and
in response to receiving the confirmation message, submitting the data subject access request to the particular entity on behalf of the particular data subject.