Personal Data Infringement Incident Management System

Abstract

The Personal Data Infringement Incident Management System includes a communication module, an incident input module, a risk assessment module, a decision-making and notification management module, and an approval module. The communication module is used to transmit and receive information. The incident input module is used to input initial incident data and convert it into standardized incident data. The risk assessment module calculates an incident risk score based on a weighted product of data sensitivity, the number of affected individuals, and the type of infringement, combined with regulatory impact factors. The decision-making and notification management module determines the incident level as one of three response levels based on the incident risk score and automatically submits the corresponding forms and initiates SOP task tracking and timeline alerts. The approval module initiates an electronic approval process according to the response level.

Claims

1. A personal data breach incident management system, installed within a bank mainframe server, comprising a plurality of hardware modules consisting of a plurality of electrically connected hardware circuits, the hardware modules including: A communication module that connects a compliance officer's device and multiple supervisor devices; An event input module, communicatively connected to a communication module, allows compliance personnel to input initial event data via the communication module. This initial event data includes a data type, a number of affected individuals, and a type of infringement. The event input module converts this initial event data into standardized event data in a structured format. A risk assessment module, communicatively connected to the event input module, receives the standardized event data and calculates an infringement event risk score based on preset data sensitivity weights (WS), number of affected individuals quantified (NU), and infringement type weights (WT). The formula for calculating the infringement event risk score is (WS x NU x WT) x CR, where CR is a regulatory impact factor. The risk score is increased when the event reaches a legally significant threshold. When the event does not reach the mandatory reporting threshold, CR = 1.

0. When the event reaches the legally significant personal data infringement threshold, CR is greater than 1.0, and the value of CR is increased based on the data sensitivity weight, number of affected individuals quantified, and infringement type weight. A decision-making notification management module, which is communicatively connected to the risk assessment module and the communication module, receives the risk score of the infringement event and compares it with a preset risk threshold to determine a response level. Based on the response level, it initiates a corresponding standard operating procedure. The response level includes a first response level, a second response level, and a third response level. The decision-making notification management module also fills the standardized event data into a major incidental event form or a data infringement incident notification case (non-major incidental event) form. And an audit module, which is connected to the decision notification management module and the communication module, and initiates the corresponding electronic audit process according to the response level; when the audit module receives the major incident form or the data infringement incident report case (non-major incident) form transmitted by the decision notification management module, it sequentially transmits it to the corresponding supervisory device for review.

2. The personal data infringement incident management system as described in claim 1 further includes a historical event database, which is communicatively connected to the review module and the decision notification management module, for receiving and storing personal data infringement incident information.

3. The personal data infringement incident management system as described in claim 2 further includes a query module, which is communicatively connected to the communication module and the historical event database, for querying all personal data infringement incident information in the historical event database.

4. The personal data infringement incident management system as described in claim 1, wherein when the response level is the first response level, the decision notification management module fills in a data infringement incident notification case (non-major accidental event) form based on the standardized event data.

5. The personal data infringement incident management system as described in claim 1, wherein when the response level is the second response level, the decision notification management module fills the standardized event data into a major incident form, initiates an advanced standard operating procedure and sends a timed alert, and notifies the corresponding supervisor device through the communication module.

6. The personal data infringement incident management system as described in claim 1, wherein when the response level is the third response level, the decision notification management module fills the standardized event data into a major incident form and generates a draft notification from the competent authority, and notifies the corresponding competent authority device and initiates the highest emergency standard operating procedure through the communication module.

7. The personal data infringement incident management system as described in claim 1, wherein the decision notification management module also monitors the standard operating procedure corresponding to the response level and tracks the execution status, responsible person and completion time of each task; when the execution progress of any task exceeds a preset time limit, the decision notification management module sends a time alert to the compliance officer's device or the supervisor's device through the communication module.

8. The personal data infringement incident management system as described in claim 1, wherein when the form for a major incident or the form for a personal data infringement incident report (non-major incident) fails to pass the review, the decision notification management module is also available for the law enforcement personnel to make modifications.

Images