Consent receipt management systems and related methods
A consent receipt management system is configured to: (1) automatically cause a prior, validly received consent to expire (e.g., in response to a triggering event); and (2) in response to causing the previously received consent to expire, automatically trigger a recapture of consent. In particular embodiments, the system may, for example, be configured to cause a prior, validly received consent to expire in response to one or more triggering events.
1. A method comprising:
receiving, by computing hardware via a graphical user interface, information regarding a request to initiate a transaction between an entity and a data subject,
wherein the transaction involves a computing system associated with the entity performing at least one of collecting or processing personal data associated with the data subject as part of a processing activity undertaken by the entity that the data subject provides consent as part of the transaction;
receiving, by the computing hardware, a unique transaction identifier associated with the transaction;
receiving, by the computing hardware, a unique subject identifier for the data subject;
responsive to receiving the information regarding the request:
generating, by the computing hardware, a unique consent receipt key for the consent provided by the data subject as part of the transaction;
associating, by the computing hardware, a receipt definition with the unique consent receipt key, wherein the receipt definition comprises the unique transaction identifier and a purpose for the at least one of collecting or processing the personal data, wherein the personal data is identified using one or more machine learning techniques; and
generating, by the computing hardware, a consent receipt set comprising the unique subject identifier, the unique consent receipt key, and the unique transaction identifier;
storing, by the computing hardware in computer memory, the consent receipt set and the receipt definition;
detecting, by the computing hardware and based on data in the receipt definition, an occurrence of a triggering event that causes the consent to expire according to the association of the receipt definition with the unique consent receipt key; and
responsive to detecting the occurrence of the triggering event, causing, by the computing hardware, a recapture of the consent from the data subject.
2. The method of claim 1 , wherein at least a portion of the receipt definition is provided to demonstrate that the data subject has provided the consent for the at least one of collecting or processing the personal data as part of the processing activity undertaken by the entity; and
wherein associating the receipt definition with the unique consent receipt key comprises generating a link between the unique consent receipt key and metadata of the receipt definition that identifies the purpose for the at least one of collecting or processing the personal data.
3. The method of claim 1 , wherein the receipt definition further comprises a link to a privacy policy associated with the transaction and the triggering event comprises a change to the privacy policy.
4. The method of claim 1 , wherein the receipt definition further comprises a location of the data subject and the triggering event comprises a change in the location.
5. The method of claim 1 , wherein the receipt definition further comprises a retention period for the personal data and the triggering event comprises a passage of the retention period.
6. The method of claim 1 , wherein the triggering event comprises at least one of:
a passage of a particular amount of time from generation of the unique consent receipt key;
a change to the purpose for the at least one of collecting or processing the personal data;
a change to a privacy policy associated with the transaction;
a change to a rule that govern the transaction; or
a change in location of the data subject.
7. The method of claim 1 , wherein causing the recapture of the consent from the data subject comprises providing an interface to recapture the consent.
8. A system comprising:
a non-transitory computer-readable medium storing instructions; and
a processing device communicatively coupled to the non-transitory computer-readable medium,
wherein, the processing device is configured to execute the instructions and thereby perform operations comprising:
receiving information via a graphical user interface regarding a request to initiate a transaction between an entity and a data subject, wherein the transaction involves a computing system associated with the entity performing at least one of collecting or processing personal data associated with the data subject as part of a processing activity undertaken by the entity that the data subject provides consent as part of the transaction;
receiving a unique subject identifier for the data subject via the graphical user interface;
responsive to receiving the information regarding the request:
generating a unique consent receipt key for the consent provided by the data subject as part of the transaction;
associating a receipt definition with the unique consent receipt key, wherein the receipt definition comprises a purpose for the at least one of collecting or processing the personal data, wherein the personal data is identified using one or more machine learning techniques; and
generating a consent receipt set comprising the unique subject identifier and the unique consent receipt key;
storing, in computer memory, the consent receipt set and the receipt definition;
detecting, based on data in the receipt definition, an occurrence of a triggering event that causes the consent to expire according to the association of the receipt definition with the unique consent receipt key; and
responsive to detecting the occurrence of the triggering event, causing a recapture of the consent from the data subject.
9. The system of claim 8 , wherein at least a portion of the receipt definition is provided to demonstrate that the data subject has provided the consent for the at least one of collecting or processing the personal data as part of the processing activity undertaken by the entity; and
wherein associating the receipt definition with the unique consent receipt key comprises generating a link between the unique consent receipt key and metadata of the receipt definition that identifies the purpose for the at least one of collecting or processing the personal data.
10. The system of claim 8 , wherein the receipt definition further comprises a link to a privacy policy associated with the transaction and the triggering event comprises a change to the privacy policy.
11. The system of claim 8 , wherein the receipt definition further comprises a location of the data subject and the triggering event comprises a change in the location.
12. The system of claim 8 , wherein the receipt definition further comprises a retention period for the personal data and the triggering event comprises a passage of the retention period.
13. The system of claim 8 , wherein the triggering event comprises a change to a privacy policy associated with the transaction and causing the recapture of the consent from the data subject comprises providing a second graphical user interface providing a prompt for the consent and an updated version of the privacy policy.
14. The system of claim 8 , wherein the triggering event comprises a change to the purpose for the at least one of collecting or processing the personal data and causing the recapture of the consent from the data subject comprises providing a second graphical user interface providing a prompt for the consent and an updated purpose for the at least one of collecting or processing the personal data.
15. A non-transitory computer-readable medium having program code that is stored thereon, the program code executable by one or more processing devices for performing operations comprising:
receiving information regarding a request to initiate a transaction between an entity and a data subject, wherein the transaction involves a computing system associated with the entity performing at least one of collecting or processing personal data associated with the data subject as part of a processing activity undertaken by the entity that the data subject provides consent as part of the transaction;
receiving a unique transaction identifier associated with the transaction;
receiving a unique subject identifier for the data subject;
responsive to receiving the information regarding the request:
generating a unique consent receipt key for the transaction;
associating a receipt definition with the unique consent receipt key, wherein the receipt definition comprises the unique transaction identifier and a purpose for the at least one of collecting or processing the personal data, wherein the personal data is identified using one or more machine learning techniques; and
generating a consent receipt set comprising the unique subject identifier, the unique consent receipt key, and the unique transaction identifier;
detecting, based on data in the receipt definition, an occurrence of a triggering event that causes the consent to expire according to the association of the receipt definition with the unique consent receipt key; and
responsive to detecting the occurrence of the triggering event, causing a recapture of the consent from the data subject.
16. The non-transitory computer-readable medium of claim 15 , wherein at least a portion of the receipt definition is provided to demonstrate that the data subject has provided the consent for the at least one of collecting or processing the personal data as part of the processing activity undertaken by the entity; and
wherein associating the receipt definition with the unique consent receipt key comprises generating a link between the unique consent receipt key and metadata of the receipt definition that identifies the purpose for the at least one of collecting or processing the personal data.
17. The non-transitory computer-readable medium of claim 15 , wherein the receipt definition further comprises a link to a privacy policy associated with the transaction and the triggering event comprises a change to the privacy policy.
18. The non-transitory computer-readable medium of claim 15 , wherein the receipt definition further comprises a location of the data subject and the triggering event comprises a change in the location.
19. The non-transitory computer-readable medium of claim 15 , wherein the receipt definition further comprises a retention period for the personal data and the triggering event comprises a passage of the retention period.
20. The non-transitory computer-readable medium of claim 15 , wherein the triggering event comprises at least one of:
a passage of a particular amount of time from generation of the unique consent receipt key;
a change to the purpose for the at least one of collecting or processing the personal data;
a change to a privacy policy associated with the transaction;
a change to a rule that govern the transaction; or
a change in location of the data subject.