CONSENT RECEIPT MANAGEMENT SYSTEMS AND RELATED METHODS
A consent receipt management system may, for example, be configured to track data on behalf of an entity that collects and/or processes persona data related to: (1) who consented to the processing or collection of personal data; (2) when the consent was given (e.g., a date and time); (3) what information was provided to the consenter at the time of consent (e.g., a privacy policy, what personal data would be collected following the provision of the consent, for what purpose that personal data would be collected, etc.); (4) how consent was received (e.g., one or more copies of a data capture form, webform, etc. via which consent was provided by the consenter); (5) when consent was withdrawn (e.g., a date and time of consent withdrawal if the consenter withdraws consent); and/or (6) any other suitable data related to receipt or withdrawal of consent.
1 . A consent receipt management system comprising:
one or more processors; and
computer memory, wherein the consent receipt management system is configured for:
receiving a request to initiate a transaction between an entity and a data subject, the transaction involving collection or processing of personal data associated with the data subject by the entity as part of a processing activity undertaken by the entity that the data subject is consenting to as part of the transaction;
in response to receiving the request:
identifying a transaction identifier associated with the transaction;
generating, a unique consent receipt key for the transaction; and
determining a unique subject identifier for the data subject;
electronically storing the unique subject identifier, the unique consent receipt key, and the transaction identifier in computer memory;
electronically associating the unique subject identifier, the unique consent receipt key, and the transaction identifier;
generating a consent record for the transaction, the consent receipt comprising at least the unique subject identifier and the unique consent receipt key; and
electronically transmitting the consent record to the data subject.
2 . The consent receipt management system of claim 1 , wherein the computer memory stores a plurality of consent records associated with the unique subject identifier, each of the plurality of consent records being associated with a respective transaction of a plurality of transactions involving the data subject and the entity.
3 . The consent receipt management system of claim 2 , wherein the consent receipt management system is further configured for:
providing a consent receipt management portal;
displaying, to the data subject, via the consent receipt management portal, the plurality of consent records.
4 . The consent receipt management system of claim 3 , wherein the consent receipt management system is further configured for:
enabling the data subject to rescind, via the consent receipt management portal, a consent for the collection or processing of personal data associated with the data subject that the data subject has previously provided as part of a particular transaction of the plurality of transactions.
5 . The consent receipt management system of claim 4 , wherein the consent receipt management system is further configured for:
receiving an indication that a data system has collected, stored, or processed a new piece of personal data associated with the data subject;
determining, based on the plurality of consent records, whether the data subject has provided valid consent for the collection, storage, and processing of a type of the new piece of personal data for a purpose for which the new piece of personal data was collected, stored, or processed by the data system;
in response to determining that the data subject has provided valid consent, generating an indication that the data subject has provided consent.
6 . The consent receipt management system of claim 5 , wherein the consent record comprises a hyperlink to the consent receipt management portal.
7 . The consent receipt management system of claim 1 wherein the consent receipt management system is further configured for:
providing a user interface for creating a new transaction;
receiving a request to create a new transaction, the request comprising one or more transaction definitions; and
in response to receiving the request, generating a piece of computer code associated with the new transaction for placement in a location in which consent from one or more data subjects will be requested as part of the new transaction.
8 . The consent receipt management system of claim 1 . wherein the transaction comprises a sign up, by the data subject, for a user account with the entity.
9 . The consent receipt management system of claim 1 , wherein the consent record further comprises a type of personal data that the data subject consented to the collection nor processing of as part of the processing activity via the transaction.
10 . A computer-implemented data processing method for managing a consent receipt under a transaction, the method comprising:
providing a user interface for initiating a transaction between an entity and a data subject;
receiving a request to initiate a transaction between the entity and the data subject;
in response to the request, generating, by a third party consent receipt management system, a unique consent receipt key;
receiving, from the data subject, a unique subject identifier
electronically storing the unique subject identifier, the unique consent receipt key, and a unique transaction identifier associated with the transaction in computer memory;
electronically associating the unique subject identifier, the unique consent receipt key, and the unique transaction identifier; and
in response to receiving the request, transmitting a consent receipt to the data subject, the consent receipt comprising at least the unique subject identifier and the unique consent receipt key.
11 . The computer-implemented data processing method of claim 10 , wherein:
the transaction comprises processing, by the entity, one or more pieces of personal data associated with the data subject; and
the user interface displays information identifying the one or more pieces of personal data.
12 . The computer-implemented data processing method of claim 11 , further comprising:
providing a consent receipt management portal;
displaying, to the data subject, via the consent receipt management portal, each of one or more consent receipts provided by the data subject.
13 . The computer-implemented data processing method of claim 11 , wherein the consent receipt comprises a mechanism for the data subject to withdraw consent for the entity to process the one or more pieces of personal data.
14 . The computer-implemented data processing method of claim 13 , wherein the mechanism comprises a hyperlink in a consent receipt transmitted to the data subject.
15 . The computer-implemented data processing method of claim 10 , further comprising:
providing a user interface for creating a new transaction;
receiving a request to create a new transaction, the request comprising one or more transaction definitions; and
in response to receiving the request, generating a piece of computer code associated with the new transaction for placement in a location in which consent from a data subject will be requested as part of the new transaction.
16 . The computer-implemented data processing method of claim 15 , wherein the one or more transaction definitions are selected from the group consisting of: (1) the unique transaction identifier; (2) an identity of one or more controllers of the entity that is engaging in the transaction with the data subject; (3) one or more links to a privacy policy associated with the transaction; (4) a listing of one or more data types for which consent to process will be provided; (5) one or more methods used to collect data for which consent to process will be provided; (6) a description of a service provided as part of the transaction; (7) one or more purposes of the processing; (8) a jurisdiction associated with the transaction; and (9) a legal basis for the collection of personal data as part of the transaction.
17 . The computer-implemented data processing method of claim 10 , further comprising:
receiving, at a third party data repository server, an indication that a piece of personal data has been processed for the data subject as part of the transaction;
in response to receiving the indication, electronically storing, on the third part data repository server:
a copy of the piece of personal data; and
the unique subject identifier; and
electronically associating the copy of the piece of personal data and the unique subject identifier on the third party data repository server.
18 . A computer-implemented data processing method for managing a consent receipt under a transaction, the method comprising:
providing a user interface for initiating a transaction between an entity and a data subject;
receiving a request to initiate a transaction between the entity and the data subject;
in response to the request:
initiating the transaction; and
generating, using one or more consent receipt generation means, a unique consent receipt key;
receiving, from the data subject, a unique subject identifier
electronically storing the unique subject identifier, the unique consent receipt key, and a unique transaction identifier associated with the transaction in computer memory using one or more electronic storage means;
electronically associating the unique subject identifier, the unique consent receipt key, and the unique transaction identifier; and
in response to receiving the request, transmitting a consent receipt to the data subject, the consent receipt comprising at least the unique subject identifier and the unique consent receipt key.
19 . The computer-implemented data processing method of claim 18 , further comprising:
providing a consent receipt management portal using one or more consent receipt portal provision means;
displaying, to the data subject, via the consent receipt management portal, each of one or more consent receipts provided by the data subject; and
providing one or more consent modification means via the consent receipt management portal.
20 . The computer-implemented data processing method of claim 18 ,
providing a user interface for creating a new transaction;
receiving a request to create a new transaction, the request comprising one or more transaction definitions; and
in response to receiving the request, generating a piece of computer code associated with the new transaction, using one or more computer code generation means, for placement in a location in which consent from a data subject will be requested as part of the new transaction.