Granted Patent B2

US 12,190,330 · App. 17/710,653 · Granted Jan 7, 2025

Inventors: Jonathan Blake Brannon (Smyrna, GA); Steven W. Finch (Kennesaw, GA); Prashanth Sharma (Atlanta, GA); Jeremy Turk (Atlanta, GA); Priya Malhotra (Atlanta, GA); Kevin Jones (Atlanta, GA); Himanshu Arora (Atlanta, GA); Mahashankar Sarangapani (Atlanta, GA); Atul Gupta (Atlanta, GA)

Assignee: OneTrust, LLC

G06Q30/018G06Q50/184H04L63/107

Abstract

Claims (59)

1. A method comprising:

receiving, by computing hardware, a personal data request originating from a computing device that is not a data owner of personal data of a data subject and the personal data request is related to collecting, storing, or processing the personal data of the data subject, wherein the personal data request is for a particular entity that is the data owner of the personal data of the data subject to perform an action with regard to the personal data associated with the data subject;

detecting, by the computing hardware, a state of a browser application executing on the computing device indicating a location of the computing device;

determining, by the computing hardware and based on the location of the computing device, identity verification levels comprising a first type of identity verification and a second type of identity verification;

determining, by the computing hardware, that the first type of identity verification requires first user-provided input to verify an identity of the data subject that contains fewer identity verification steps than second user-provided input required by the second type of identity verification to verify the identity of the data subject;

transmitting, by the computing hardware, an instruction to the computing device to dynamically display a prompt for the first user-provided input to verify the identity of the data subject in connection with the personal data request originating from the computing device;

receiving, by the computing hardware, the first user-provided input via the prompt;

verifying, by the computing hardware, the identity of the data subject based on the first user-provided input by:

providing first information included in the personal data request to an external system;

receiving second information from the external system based on the first information; and

verifying the identity of the data subject based on the first user-provided input and the second information; and

responsive to verifying the identity of the data subject in connection with the personal data request originating from the computing device, causing, by the computing hardware, performance of the action with regard to the personal data associated with the data subject.

2. The method of claim 1 , wherein the action comprises at least one of retrieving and displaying the personal data on the computing device, deleting the personal data from at least one data repository, or updating the personal data in the at least one data repository.

3. The method of claim 1 , wherein the location of the computing device comprises at least one of a current geographical location of the computing device or a past geographical location of the computing device.

4. The method of claim 1 , wherein verifying the identity of the data subject based on the first user-provided input comprises:

providing first information included in the personal data request to an external system; and

receiving second information from the external system based on the first information; and verifying the identity of the data subject based on the first user-provided input and the second information.

5. The method of claim 4 further comprising generating, by the computing hardware, a knowledge-based authentication question based on the second information, wherein the prompt comprises the knowledge-based authentication question and the first user-provided input comprises an answer to the knowledge-based authentication question.

6. The method of claim 1 , wherein the prompt comprises a secure link through which the first user-provided input is provided to prevent outside access to the first user-provided input.

7. The method of claim 1 , wherein dynamically displaying the prompt for the first user-provided input comprises providing a custom user interface for the data subject based on the location.

8. A system comprising:

at least one processor; and

at least one memory device coupled to the at least one processor that causes the system to perform operations comprising:

receiving a personal data request originating from a computing device that is not a data owner of personal data of a data subject and the personal data request is related to collecting, storing, or processing the personal data of the data subject, wherein the personal data request involves a particular entity that is the data owner of the personal data of the data subject to perform an action with regard to the personal data associated with the data subject;

detecting a state of a browser application executing on the computing device indicating a location of the computing device;

determining, based on the location of the computing device, identification verification levels comprising a first type of identity verification and a second type of identity verification;

determining that the first type of identity verification requires first user-provided input to verify an identity of the data subject that contains fewer identity verification steps than second user-provided input required by the second type of identity verification to verify the identity of the data subject;

causing a prompt to display, wherein the prompt requests the first user-provided input to verify the identity of the data subject in connection with the personal data request;

receiving the first user-provided input;

verifying the identity of the data subject based on the first user-provided input by:

providing first information included in the personal data request to an external system;

receiving second information from the external system based on the first information; and

verifying the identity of the data subject based on the first user-provided input and the second information; and

responsive to verifying the identity of the data subject in connection with the personal data request originating from the computing device, causing performance of the action with regard to the personal data associated with the data subject.

9. The system of claim 8 , wherein the action comprises at least one of retrieving and displaying the personal data on the computing device, deleting the personal data from at least one data repository, or updating the personal data in the at least one data repository.

10. The system of claim 8 , wherein the location of the computing device comprises at least one of a current geographical location of the computing device or a past geographical location of the computing device.

11. The system of claim 8 , wherein verifying the identity of the data subject based on the first user-provided input comprises:

providing first information included in the personal data request to an external system; and

receiving second information from the external system based on the first information; and verifying the identity of the data subject based on the first user-provided input and the second information.

12. The system of claim 11 , wherein the operations further comprising generating a knowledge-based authentication question based on the second information, and the prompt comprises the knowledge-based authentication question and the first user-provided input comprises an answer to the knowledge-based authentication question.

13. The system of claim 8 , wherein the prompt comprises a secure link through which the first user-provided input is provided to prevent outside access to the first user-provided input.

14. The system of claim 8 , wherein causing the prompt to display requesting the first user-provided input comprises providing a custom user interface for the data subject based on the location.

15. A non-transitory computer-readable medium having program code that is stored thereon, the program code executable by one or more processing devices for performing operations comprising:

receiving a personal data request originating from a computing device that is not a data owner of personal data of a data subject and the personal data request is related to collecting, storing, or processing the personal data of the data subject, wherein the personal data request is for a particular entity that is the data owner of the personal data of the data subject to perform an action with regard to personal data associated with the data subject;

detecting a state of a browser application executing on the computing device indicating a location of the computing device;

determining, based on the location of the computing device, identification verification levels comprising a first type of identity verification and a second type of identity verification;

determining that the first type of identity verification requires first user-provided input to verify an identity of the data subject that contains fewer identity verification steps than second user-provided input required by the second type of identity verification to verify the identity of the data subject;

causing a prompt to display via the browser application, wherein the prompt requests the first user-provided input to verify the identity of the data subject in connection with the personal data request;

receiving the first user-provided input originating from the computing device;

verifying the identity of the data subject based on the first user-provided input by:

providing first information included in the personal data request to an external system;

receiving second information from the external system based on the first information; and

verifying the identity of the data subject based on the first user-provided input and the second information; and

responsive to verifying the identity of the data subject in connection with the personal data request originating from the computing device, causing performance of the action with regard to the personal data associated with the data subject.

16. The non-transitory computer-readable medium of claim 15 , wherein the action comprises at least one of retrieving and displaying the personal data on the computing device, deleting the personal data from at least one data repository, or updating the personal data in the at least one data repository.

17. The non-transitory computer-readable medium of claim 15 , wherein the location of the computing device comprises at least one of a current geographical location of the computing device or a past geographical location of the computing device.

18. The non-transitory computer-readable medium of claim 15 , wherein providing the personal data request to the external system comprises sending a search request comprising the personal data request to the external system, wherein the search request is for the external system to confirm that the data subject of the personal data request exists.

19. The non-transitory computer-readable medium of claim 18 , wherein the operations further comprise generating a knowledge-based authentication question based on the second information, the prompt comprises the knowledge-based authentication question and the first user-provided input comprises an answer to the knowledge-based authentication question.

20. The non-transitory computer-readable medium of claim 15 , wherein the prompt comprises a secure link through which the first user-provided input is provided to percent outside access to the first user-provided input.

Assignments (2)

Continuity (16)

References Cited (400)