Sensitive Data Management

Abstract

A method for detecting the sending of sensitive data fields from a user device to an online site is provided. The method determines the data type of the sensitive data field and collects site information stored in a data store along with the current date from the online site. Subsequently, the user can manage the data by displaying the site information on a display of the user device. Each site information record relates to one of a plurality of online sites including the selected online site. The user makes a data management request at the user device related to the selected site information. The method then responsively sends a request to the selected online site, where the request is based on the received data management request. An example of the request is a deletion request requesting the online site to remove the user's sensitive data from the online site.

Description

Background Art

[0001] In today's interconnected world, users typically use many sites and applications and perform personal business and shopping on the Internet from various mobile and fixed devices. When performing these functions, these users are often required to allow access to their personal contact information and other data on their devices or to manually enter it on one of these devices. This data may also include personal information sensitive to the user, such as the user's name, email address, phone number, date of birth, gender, mailing address, etc.

[0002] With the onset of increased rules including user privacy legislation in some jurisdictions, the responsibility for complying with rules regarding the use and retention of user information often falls on website administrators. User privacy concerns also include concerns about whether the user's personal information is deleted upon request when the data is no longer needed or when the data expires. Another issue is whether the user's information has been shared with third parties. This issue is even more relevant given the regular website security breaches and the often-reported illegal sharing of users' information in the media. Summary of the Invention

[0003] A method for detecting the sending of sensitive data fields from a user device to an online site is provided. The method determines the data type of the sensitive data field and collects site information stored in a data store together with the current date from the online site. Subsequently, the user can manage the data by displaying the site information on a display of the user device. Each site information record relates to one of a number of online sites including the selected online site. The user makes a data management request related to the selected site information at the user device. The method then responds by sending a request to the selected online site, where the request is based on the received data management request. An example of the request is a deletion request to request the online site to remove the user's sensitive data from the online site.

[0004] The foregoing is a summary and thus necessarily contains simplifications, generalizations, and omissions of detail; accordingly, those skilled in the art will recognize that the summary is illustrative only and is not intended to limit in any way. Other aspects, inventive features, and advantages of the present invention will become apparent in the non-limiting detailed description set forth below. Brief Description of the Drawings

[0005] The present invention can be better understood by reference to the accompanying drawings, and its various objects, features, and advantages will become apparent to those skilled in the art, in which:

[0006] Figure 1 A network environment including a knowledge manager using a knowledge base is depicted;

[0007] Figure 2is a block diagram of a processor and components of an information processing system such as Figure 1 shown in;

[0008] Figure 3 is a component diagram showing different components in a system for tracking the types of information shared by a user with websites and applications;

[0009] Figure 4 is a depiction of a flowchart showing the logic for registering types of sensitive information and providing the locations where these types are present;

[0010] Figure 5 is a depiction of a flowchart showing the logic used during data processing and storage of sensitive information types and locations;

[0011] Figure 6 is a depiction of a flowchart showing the logic for saving field metadata to a database; and

[0012] Figure 7 is a description of a flowchart showing the logic for providing a user interface (UI) that displays sensitive information types and storage locations to a user and allows the user to request deletion of the user's data from a selected online location. DETAILED DESCRIPTION

[0013] Figure 1-7 describes a method for automatically registering the types of personal information (PI) provided by a user to an online site or application. As used herein, PI is included within the broader scope of "sensitive data fields". The method provides a system that stores the data types of personal information entered on any online site and application, such as the user's name, date of birth, phone number, email address, mailing address, gender, etc., along with information about the site. Information about the site can include the site or company name, the network address of the site, and other information collected when the system crawls the site. In addition, the system also records the date and time when the user's information was provided to the site. The method gives the user a history of the sensitive data fields they have entered on many sites / applications / systems and allows them to review, update, or withdraw that data from these sites / applications as appropriate. In this way, the method gives the user more control over their own personal data and the use of that data by others.

[0014] The system application or tool monitors the sites / applications accessed and recorded by the user and records when the user provides sensitive data fields to the site or application. In one embodiment, the system is constructed as follows. First, the system listens for form POSTs and, when a POST is detected, saves the field names and website URLs to the database. When the transmission of the user's sensitive data fields is detected, a new database entry starts a job that processes the form fields and saves the data to the database. If the sending of sensitive data fields is detected, a web crawler accesses the website and retrieves relevant links, cookie policies, terms and conditions, etc. found on the website page. A request is sent to retrieve the text of these web pages. The text from these web pages is then processed into a format that can be presented to the end user.

[0015] If the user only views the web page and does not submit a form, the system takes no action. However, if the user loads a web page and fills out and submits a form that may contain sensitive data fields, the system detects the POST request from the form. Then, a new entry is input into the database for processing. This entry includes the website URL and the date on which the action occurred. Then, a job starts to enhance the data using information about the rules, laws, and regulations found on the website (e.g., the length of time to retain the user's sensitive data fields, restrictions on what entities can access the user's sensitive data fields, etc.).

[0016] The entry is placed in the database queue for processing. In one embodiment, the system uses natural language processing (NLP) to process the data to determine whether the form contains sensitive data fields. If no sensitive data fields are submitted, no further action is taken. However, if sensitive data fields are submitted, the field names are parsed and stored in the database. Then, a web crawler process is invoked to obtain the data policy for the website or application and the rules, laws, and regulations (e.g., the General Data Protection Regulation (GDPR) framework in the European Union (EU), etc.) that the website follows when using information.

[0017] Once sensitive data fields are detected and the database is updated, the process retrieves the cookie policy of the website, the data policy of the website, and information about the rules, laws, and regulations followed by the website. The web crawler is launched and the website is opened. The web crawler reads the links of the web page and searches for keywords such as "cookie policy", "gdpr", etc. When a useful link is detected, the link is saved to the database for the relevant entry. For each link stored in the database, a request is sent to obtain the web page text of each link, and the text from that page is stored.

[0018] The process then extracts data from the relevant web pages and converts the text on the page into predefined fields, which can then be presented to the user in a readable format on the user interface (UI). Note: Sensitive data fields are not stored by the system, only the data types corresponding to the sensitive data fields. For example, a user may enter his or her bank account number on multiple online forms, each form having a different field name. The system records that these sites have received bank account information (data type), however, the system does not store the actual bank account number in the database.

[0019] To view the stored data, the user utilizes a user interface (UI) that may be in the form of a browser extension or an application. In one embodiment, the user opens a browser plugin or goes to a website to view the data logged into the database (website information and the types of sensitive data fields provided to these sites). In one embodiment, a list of websites is provided, and the user selects ("clicks") on the website of interest to view the website's URL, the types of sensitive data fields provided to the website, the date the data was provided, and other relevant information. Additionally, a link is provided to the user that can be selected to execute a data management request (e.g., "delete account", etc.), which sends a request to the website to remove the user's sensitive data from the site (the data is stored in the sensitive data fields). The URL of this link was previously retrieved from the website during the web crawling phase described above. As used herein, a data management request executed from the user's device is generally a request initiated by the user of the device to send a request to an online site to manage the user's sensitive data, such as a request to delete the user's account from the online site, a request for the current status of the user's account (e.g., whether the account is currently "active", etc.).

[0020] In one embodiment, the database is stored in an online memory (i.e., "the cloud", etc.) that allows the user to access their data from any device capable of connecting to the Internet. In one embodiment, if the system detects that a user's sensitive data field has been held for a specified period of time (e.g., 1 year, etc.), the system alerts the user via the UI or via email. Then, if the user wishes to review or delete their data, they can contact the site.

[0021] In addition to the data types of the sensitive data fields, the system also records the rules, laws, and regulations details applied to the website when the user logs in or last logs in to the website. These rules, laws, and regulations may include partners of the site or application with whom it shares its data, how long the site can keep its data, and when to delete it, etc. Other data that may not be obvious to the user will also be shown. For example, any subsequent requests by the site to other sites that include the user's personal information (such as the user's current physical location).

[0022] In one embodiment, the user will be able to configure the system by adding their own data types and by specifying form field identifiers that can contain sensitive data fields. Also, the user can specify the data types of the sensitive data fields, and this information is used to assist the system in determining whether a form field has a sensitive data field. The user can also configure the system by notifying the system to ignore certain form fields because they are not considered to reference sensitive data fields.

[0023] Since the system will have an expected expiration of the sensitive data fields of the users in the website, if any expiration date has passed, the system provides an alert / notification (e.g., email, UI) to prompt the user to take action to understand the continued use of the data or request deletion. The system can perform a data management request that checks for any security vulnerabilities and cross-references this feed with the stored websites, thereby notifying the user again if any of their websites have vulnerabilities. The system can also notify the user if there is any ongoing fraud (e.g., phishing emails for bank details). The user can execute a data management request to delete the user's account from the online site and request the status of the user's account.

[0024] In one embodiment, the system reminds the user that they are about to submit a sensitive data field, the reminder being based on the field name in the form if the field name matches the field name associated with the type of sensitive data field previously recorded by the system. In one embodiment, the system can provide a warning about a site with a history of data vulnerabilities. In one embodiment, the system includes a 'heritage' feature where the user can indicate 'next of kin' so that another user can view and save the history of sensitive data field submissions that may also be relevant to them and thus equipped with the information they need to delete the data from the public forum. This may be required if someone dies or becomes incapacitated.

[0025] In one embodiment, when the website notifies the user (e.g., via email, etc.) that the user's sensitive data fields have now been removed because they are no longer needed (e.g., in accordance with GDPR rules, etc.), the system records the information. The system can further detect and record deletions from the site / app's account (e.g., sensitive data fields, etc.), and also record the date / time of the data and activities. In one embodiment, if the user unsubscribes from a service, the action will be recorded in the database. If the user continues to receive unwanted notifications, etc., the user can view the registry and see that they have previously unsubscribed, allowing them to contact the sender stating that the notification should not be sent to the user and provide details about the user's unsubscribe request. Then, the user can execute a data management request to delete the user's account from the online site and also request the status of the user's account.

[0026] The present invention may be a system, a method, and / or a computer program product. The computer program product may include a computer-readable storage medium having computer-readable program instructions thereon for causing a processor to perform aspects of the present invention.

[0027] A computer-readable storage medium may be a tangible device that can retain and store instructions for use by an instruction execution device. A computer-readable storage medium may be, for example but not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of the computer-readable storage medium includes the following: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disc (DVD), a memory stick, a floppy disk, a mechanical encoding device such as a punched card or a raised structure in a groove having instructions recorded thereon, and any suitable combination of the foregoing. As used herein, a computer-readable storage medium should not be construed as a transient signal per se, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., an optical pulse through an optical fiber cable) or an electrical signal transmitted through a wire.

[0028] The computer-readable program instructions described herein may be downloaded from a computer-readable storage medium to a corresponding computing / processing device via a network (e.g., the Internet, a local area network, a wide area network, and / or a wireless network), or to an external computer or an external storage device. The network may include copper transmission cables, optical transmission fibers, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in a computer-readable storage medium within the corresponding computing / processing device.

[0029] The computer-readable program instructions for performing the operations of the present invention may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state-setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages (such as Java, Smalltalk, C++) and conventional procedural programming languages (such as the "C" programming language or similar programming languages). The computer-readable program instructions may be executed entirely on the user's computer, partially on the user's computer, as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on the remote computer or server. In the latter case, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider). In some embodiments, an electronic circuit, including, for example, a programmable logic circuit, a field-programmable gate array (FPGA), or a programmable logic array (PLA), can execute the computer-readable program instructions by using the state information of the computer-readable program instructions to personalize the electronic circuit, so as to perform various aspects of the present invention.

[0030] The present invention will now be described with reference to the flowcharts and / or block diagrams of methods, apparatuses (systems), and computer program products according to embodiments of the present invention. It should be understood that each block of the flowcharts and / or block diagrams, and combinations of blocks in the flowcharts and / or block diagrams, can be implemented by computer-readable program instructions.

[0031] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions executed via the processor of the computer or other programmable data processing apparatus create a means for implementing the functions / actions specified in one or more blocks of the flowchart and / or block diagram. These computer-readable program instructions can also be stored in a computer-readable storage medium, which instructions cause a computer, a programmable data processing apparatus, and / or other devices to work in a particular manner, so that the computer-readable storage medium storing the instructions includes a manufacture containing instructions for implementing aspects of the functions / actions specified in one or more blocks of the flowchart and / or block diagram.

[0032] The computer-readable program instructions can also be loaded onto a computer, other programmable data processing apparatus, or other device, such that a series of operation steps are performed on the computer, other programmable apparatus, or other device to produce a computer-implemented process, so that the instructions executed on the computer, other programmable apparatus, or other device implement the functions / actions specified in one or more blocks of the flowchart and / or block diagram.

[0033] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of the possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in the flowchart or block diagram may represent a module, segment, or portion of instructions, which includes one or more executable instructions for implementing the specified logical function. In some alternative implementations, the functions noted in the blocks may occur out of the order noted in the figures. For example, depending on the functionality involved, two blocks shown in succession may in fact be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order. It should also be noted that each block of the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented by a dedicated hardware-based system that performs the specified functions or acts or a combination of dedicated hardware and computer instructions.

[0034] Figure 1 A schematic diagram depicting an illustrative embodiment of a question / answer creation (QA) system 100 in a computer network 102 is shown. The QA system 100 may include a knowledge manager computing device 104 that connects the QA system 100 to the computer network 102 (including one or more processors and one or more memories, and potentially any other computing device elements known in the art, including buses, storage devices, communication interfaces, etc.). The network 102 may include a plurality of computing devices 104 that communicate with each other and with other devices or components via one or more wired and / or wireless data communication links, where each communication link may include one or more of wires, routers, switches, transmitters, receivers, etc. The QA system 100 and the network 102 may implement a question / answer (QA) generation function for one or more content users. Other embodiments of the QA system 100 may be used with components, systems, subsystems, and / or devices other than those described herein.

[0035] The QA system 100 can be configured to receive inputs from different sources. For example, the QA system 100 can receive inputs from a network 102, an electronic document 107, or a corpus of other data, content creators, content users, and other possible input sources. In one embodiment, some or all of the inputs to the QA system 100 can be routed through the network 102. Different computing devices on the network 102 can include access points for content creators and content users. Some of the computing devices can include devices for storing databases of data corpora. In different embodiments, the network 102 can include local network connections and remote connections such that the knowledge manager 100 can operate in environments of any size, including local and global (e.g., the Internet) environments. Additionally, the knowledge manager 100 acts as a front-end system that can make available various knowledge extracted or represented from documents, network-accessible sources, and / or structured data sources. In this manner, some processes populate the knowledge manager with knowledge, and the knowledge manager also includes an input interface for receiving knowledge requests and responding accordingly.

[0036] In one embodiment, a content creator creates content in the electronic document 107 to be used as part of the data corpus of the QA system 100. The electronic document 107 can include any file, text, article, or data source used in the QA system 100. A content user can access the QA system 100 via a network connection or Internet connection to the network 102 and can input questions to the QA system 100 that can be answered by content in the data corpus. As further described below, when a process evaluates a given portion of a document for semantic content, the process can use various conventions to query it from the knowledge manager. One convention is to send a well-formed question. Semantic content is content based on relationships between linguistic symbols such as words, phrases, signs, and symbols and what they represent, their denotations or connotations. In other words, semantic content is content such as that expressed through the use of natural language (NL) processing. Semantic data 108 is stored as part of the knowledge base 106. In one embodiment, the process sends a well-formed question (e.g., a natural language question, etc.) to the knowledge manager. The QA system 100 can interpret the question and provide a response to the content user that includes one or more answers to the question. In some embodiments, the QA system 100 can provide a response in the form of a ranked list of answers to the user.

[0037] In some illustrative embodiments, the QA system 100 can be IBM Watson available from International Business Machines Corporation, Armonk, New York, USA TM QA system, enhanced with the mechanisms of the illustrative embodiments described below. IBM Watson TMA knowledge manager system can receive an input question, then parse the input question to extract the main features of the question, and the main features are then used to formulate a query to be applied to a data corpus. Based on applying the query to the data corpus, a set of hypotheses or candidate answers to the input question is generated by searching across the data corpus for parts of the data corpus that may contain valuable responses to the input question.

[0038] IBM Watson TM The QA system then uses various inference algorithms to perform a deep analysis on the language of the input question and the language used in each part of the data corpus found during the application of the query. There may be hundreds or even thousands of inference algorithms applied, each performing a different analysis (e.g., comparison) and generating a score. For example, some inference algorithms can look at the matching of terms and synonyms within the language of the input question to the parts of the data corpus found. Other inference algorithms can look at temporal or spatial features in the language, while other inference algorithms can evaluate the source of the parts of the data corpus and assess its authenticity.

[0039] The scores obtained from the various inference algorithms indicate the degree of potential responses inferred from the input question based on the specific area of focus of that inference algorithm. Then each resulting score is weighted for a statistical model. The statistical model captures how well the inference algorithm performed during the training of the IBM Watson TM QA system in establishing inferences between two similar paragraphs in a specific domain. Then, the statistical model can be used to summarize the confidence level of the evidence that the IBM Watson TM QA system has regarding inferring potential responses (i.e., candidate answers) from the question. This process can be repeated for each candidate answer until the IBM Watson TM QA system identifies a candidate answer that appears significantly stronger than the other answers and thus generates a final answer or a ranked set of answers to the input question.

[0040] The type of information processing system of the QA system 100 can range from small handheld devices such as handheld computers / mobile phones 110 to mainframe systems such as large computers 170. Examples of handheld computers 110 include personal digital assistants (PDAs), personal entertainment devices such as MP3 players, portable TVs, and CD players. Other examples of information processing systems include pen or tablet computers 120, laptop or notebook computers 130, personal computer systems 150, and servers 160. As shown, different information processing systems can be networked together using a computer network 102. The types of computer network 102 that can be used to interconnect different information processing systems include local area networks (LANs), wireless local area networks (WLANs), the Internet, public switched telephone networks (PSTNs), other wireless networks, and any other network topologies that can be used to interconnect information processing systems. Many information processing systems include non-volatile data storage such as hard disk drives and / or non-volatile memory. Figure 1 Some of the information processing systems shown in Figure 1 depict separate non-volatile data memories (the server 160 utilizes non-volatile data storage 165, while the large computer 170 utilizes non-volatile data storage 175). The non-volatile data storage can be a component external to the various information processing systems or can be a component internal to one of the information processing systems. Figure 2 Illustrative examples of information processing systems are shown in Figure 2 , which show exemplary processors and the various components that a processor typically accesses.

[0041] Figure 2 An information processing system 200 is shown, more specifically, a processor and common components, which is a simplified example of a computer system capable of performing the computing operations described herein. The information processing system 200 includes one or more processors 210 coupled to a processor interface bus 212. The processor interface bus 212 connects the processors 210 to a north bridge 215 - also known as a memory controller hub (MCH). The north bridge 215 is connected to system memory 220 and provides the means for the processors 210 to access the system memory. A graphics controller 225 is also connected to the north bridge 215. In one embodiment, a PCI Express bus 218 connects the north bridge 215 to the graphics controller 225. The graphics controller 225 is connected to a display device 230, such as a computer monitor.

[0042] The North Bridge 215 and the South Bridge 235 are connected to each other by a bus 219. In one embodiment, the bus is a Direct Media Interface (DMI) bus that transfers data at high speed in each direction between the North Bridge 215 and the South Bridge 235. In another embodiment, a Peripheral Component Interconnect (PCI) bus connects the North Bridge and the South Bridge. The South Bridge 235 - also known as the I / O Controller Hub (ICH) - is a chip that typically implements the ability to operate at a slower speed than the capabilities provided by the North Bridge. The South Bridge 235 typically provides various buses for connecting various components. These buses include, for example, PCI and PCI Express buses, ISA buses, System Management Bus (SMBus or SMB), and / or Low Pin Count (LPC) buses. The LPC bus often connects low-bandwidth devices such as the Boot ROM 296 and "legacy" I / O devices (using a "Super I / O" chip). "Legacy" I / O devices (298) can include, for example, serial and parallel ports, keyboards, mice, and / or floppy disk controllers. The LPC bus also connects the South Bridge 235 to the Trusted Platform Module (TPM) 295. Other components typically included in the South Bridge 235 include a Direct Memory Access (DMA) controller, a Programmable Interrupt Controller (PIC), and a storage device controller that connects the South Bridge 235 to a non-volatile storage device 285 (such as a hard disk drive) using a bus 284.

[0043] The High-Speed Card 255 is a slot that connects hot-pluggable devices to the information processing system. The High-Speed Card 255 supports both PCI Express and USB connections as it uses both the Universal Serial Bus (USB) and the PCI Express bus to connect to the South Bridge 235. The South Bridge 235 includes a USB controller 240 that provides USB connections to devices connected to the USB. These devices include a webcam (camera) 250, an Infrared (IR) receiver 248, a keyboard and touchpad 244, and a Bluetooth device 246 that provides a Wireless Personal Area Network (PAN). The USB controller 240 also provides USB connections to various other USB-connected devices such as mice, removable non-volatile storage devices 245, modems, network cards, ISDN connectors, fax machines, printers, USB hubs 242, and many other types of USB-connected devices. Although the removable non-volatile storage device 245 is shown as a USB-connected device, the removable non-volatile storage device 245 can be connected using a different interface (such as a FireWire interface, etc.).

[0044] The wireless local area network (LAN) device 275 is connected to the south bridge 235 via the PCI or PCI Express bus 272. The LAN device 275 typically implements one of the IEEE 802.11 standards for air modulation technology, all of which use the same protocol to wirelessly communicate between the information processing system 200 and another computer system or device. The optical storage device 290 is connected to the south bridge 235 using the Serial ATA (SATA) bus 288. Serial ATA adapters and devices communicate via a high-speed serial link. The Serial ATA bus also connects the south bridge 235 to other forms of storage devices, such as hard disk drives. The audio circuit 260 (e.g., a sound card) is connected to the south bridge 235 via the bus 258. The audio circuit 260 also provides functions such as audio line input and optical digital audio input ports 262, optical digital output and headphone jacks 264, internal speakers 266, and internal microphones 268. The Ethernet controller 270 is connected to the south bridge 235 using a bus such as the PCI or PCI Express bus. The Ethernet controller 270 connects the information processing system 200 to a computer network, such as a local area network (LAN), the Internet, and other public and private computer networks.

[0045] Although Figure 2 an information processing system is shown, the information processing system can take many forms, some of which are shown in Figure 1 it. For example, the information processing system can take the form of a desktop computer, server, portable, laptop, notebook, or other form factor computer or data processing system. Additionally, the information processing system can take other form factors, such as a personal digital assistant (PDA), gaming device, ATM machine, portable phone device, communication device, or other device that includes a processor and memory.

[0046] Figure 3 is a component diagram showing the different components included in a system that tracks the types of information shared by a user with websites and applications. The system 310 registers the data types corresponding to the sensitive data fields that the user has provided to various websites 370 when using one or more user devices 310.

[0047] As shown in the figure, system 310 includes multiple processes that work together to register sensitive data types and the network locations where the user has provided these data types. These processes include a post-detection process 320 that detects when a user is providing a sensitive data field to a website. A data processing and storage process 330 analyzes the data fields entered by the user to determine whether the data fields represent sensitive data fields or non-sensitive data fields. A web crawler process 340 crawls the website that is sending the user's sensitive data and collects a set of website information from the website. The site information includes the data policies of the website, including data retention policies and data sharing policies. In addition, the web crawler process attempts to locate and find links on the website that the user can use to request the deletion of the user's sensitive data from the website. Policy data and deletion link information collected from the website are identified from different pages accessible from the website (e.g., the URL of the link established by the website for requesting the deletion of user account information, etc.). A text parser process 350 parses the text collected from the website into a more useful format, such as parsing it into predefined fields that can be stored in a database for future retrieval. Finally, a user interface (UI) process 360 provides an interface that can be used to display the locations where the user's sensitive information (sensitive data fields) has been provided and the website information collected from the website when the user initially provided the user information to the website. The user interface also provides an interface that allows the user to request the removal of the user's information from the website. In this case, the deletion link (e.g., URL, etc.) collected during the web crawling process is used to request the deletion of the user's sensitive information from the website. The user can use the UI process 360 to initiate data management requests. These data management requests are executed to send requests to the online site to manage the user's sensitive data, such as requests to delete the user's account from the online site, requests for the current status of the user's account (e.g., whether the account is currently "active", etc.).

[0048] The websites accessed by the user are shown in container 370. Some of these websites are those that have been provided with the user's sensitive data fields, while other accessed websites have not received any user sensitive information. The data store 390 (such as a database) is used to store the location information of the websites to which the user has provided his or her sensitive information and the data types of the personal data fields provided to the websites. Importantly, the system avoids storing any actual personal data field information of the user in the data store 390. In one embodiment, the data store 390 is maintained as a network-accessible storage by the online storage manager 380, and the online storage manager 380 provides the user with secure access to the data store 390 and prevents other entities from accessing the data stored in the data store 390 by requiring authentication and credentials (e.g., user identifier, password, etc.) to access the data store 390. To view and manage the data stored in the data store 390 related to the websites 370 to which the user has provided sensitive information, the user invokes a user interface (UI) process 360 from one of the user devices 300, and the UI process accesses the data stored directly or indirectly in the data store 380 on behalf of the user by providing the authentication and credentials (e.g., user identifier, password, etc.) required for the user to access the secure storage 380.

[0049] Figure 4 It is a depiction of a flowchart showing the logic for registering types of sensitive information and providing the locations where these types are present. Figure 4 The processing begins at 400, showing the steps taken by the process of registering the user's sensitive data fields provided to an online website.

[0050] In step 410, the user accesses a website. In step 420, the process monitors the user's use of the accessed website. During the monitoring, the process detects and determines whether the user is sending data to the online site, such as in the form provided by the site (decision 430). If it is detected that the user is sending data to the online site, then decision 430 goes to the 'yes' branch to further analyze the sent data by executing a predefined process 440 that executes data processing and storage routines (see Figure 5 and the corresponding descriptive text). On the other hand, if no data transmission is detected, then decision 430 bypasses the predefined processing 440 and goes to the 'no' branch.

[0051] By monitoring the user's online activities, this process determines whether the user is still on the website or has moved elsewhere (decision 450). If the user is still on the website, then decision 450 goes to the 'Yes' branch, which loops back to step 420 to continue monitoring the user's activities on the website. This loop continues until the user's access to the website terminates, at which point decision 450 goes to the 'No' branch and exits the loop. When the user stops accessing a website, the process determines whether the user is accessing another website or has stopped online activities (decision 460).

[0052] If the user accesses another website, then decision 460 goes to the 'Yes' branch, which loops back to step 410 to start monitoring the user's access to the next website. This loop continues until the user stops online activities (e.g., closes the web browser application, etc.), at which point decision 460 goes to the 'No' branch and exits the loop. After that, Figure 4 the processing ends at 495.

[0053] Figure 5 is a depiction of a flowchart showing the logic used during the processing and storage of sensitive information types and locations. Figure 5 The processing begins at 500, showing the steps taken by the process of performing the data processing and storage routine. At step 510, the process selects the first field of the data being provided (sent) to the online site.

[0054] At step 520, the process submits the selected field information retrieved from the online site (without the user-provided data) to a trained artificial intelligence (AI) system, such as QA system 100, to ask whether the data field requested by the online site involves sensitive data. QA system 100 is trained with a corpus 106 having a lot of training data to identify sensitive data fields (e.g., fields requesting personal information such as user name, email address, date of birth, mailing address, phone number, financial account information, government identification information, gender, etc.). At step 530, the process receives a response from QA system 100, which indicates whether the field is to be provided with user-sensitive information, making the field a sensitive data field.

[0055] Based on the response from QA system 100, the process determines whether the data field is a sensitive data field (decision 540). If the data field is a sensitive data field, then decision 540 goes to the 'Yes' branch, and at step 550, the process stores the sensitive data field information in memory area 560. On the other hand, if the data field is not a sensitive data field, then decision 540 goes to the 'No' branch, bypassing step 550. The process determines whether there are more data fields in the data being sent from the user's device to the online site (decision 570). If there are more data fields in the data being sent, then decision 570 goes to the 'Yes' branch, which loops back to step 510 to select and process the next data field as described above. This loop continues until there are no more data fields in the data being sent, at which point decision 570 goes to the 'No' branch and exits the loop.

[0056] The process determines whether any sensitive data fields have been found in the transmission by checking memory area 560 (decision 575). If sensitive data fields are found, then decision 575 goes to the 'Yes' branch, and predefined processes 580 and 590 are executed to update the database for managing the sensitive data fields of the users provided to the online site. On the other hand, if no sensitive data fields are found, then decision 575 bypasses predefined processes 580 and 590 and goes to the 'No' branch. If it is detected that sensitive data fields are being sent, predefined processes 580 and 590 are executed. In predefined process 580, the process executes a save field metadata routine (for details of the processing, see Figure 6 and the corresponding text), and in predefined process 590, the process executes a user interface routine (for details of the processing, see Figure 7 and the corresponding text). After that, Figure 5 the processing returns to the calling routine at 595 (see Figure 4 ).

[0057] Figure 6 is a depiction of a flowchart showing the logic for saving field metadata to a database. Figure 6 The processing of

[0058] In step 620, the process navigates to a web page and begins "crawling" the website to collect information from the website. In step 625, the process crawls the website for information on the rules, laws, and regulations (such as GDPR, etc.) that the website adheres to or otherwise follows, the website's cookie policy, the website's links, any account deletion links (such as URLs, etc.) found on the website, and retains all this data in data store 390.

[0059] In step 630, the process selects a first sensitive data field from memory area 560. In step 640, the process identifies and retains any policies (such as security, retention, sharing, etc.) for the selected sensitive data field and associates these policies with the selected sensitive data field. The process determines whether there are more sensitive data fields to process (decision 650). If there are more sensitive data fields to process, then decision 650 branches to the 'yes' branch, which loops back to step 630 to select and process the next sensitive data field to collect any field-specific policies for that field as described above. This loop continues until there are no more sensitive data fields to process, at which point decision 650 branches to the 'no' branch and exits the loop.

[0060] The process determines whether there are more links from the current web page (decision 660). If there are more links from the current web page, then decision 660 branches to the 'yes' branch, which performs steps 670, 680, and 690 to select and crawl the next link. This loop continues until all links have been processed, at which point decision 660 branches to the 'no' branch and exits the loop, and then the process returns to the calling routine at 695 (see Figure 5 ).

[0061] To process a link, steps 670, 680, and 690 are performed. In step 670, the process selects a first link and saves the link to data store 390. In step 680, the process reads the data page from the selected link. In step 690, the process processes the text read from the selected link into a defined format (such as into predefined fields, etc.) and saves the data (now in the defined format) to data store 390. Then, the process loops back to determine whether all links have been processed. This loop continues until all links have been processed, at which point the process returns to the calling routine at 695.

[0062] Figure 7 A description of a flowchart showing the logic for providing a user interface (UI) that displays to the user the types of sensitive information and storage locations and allows the user to request deletion of the user's data from a selected online location. Figure 7The processing begins at 700 and shows the steps taken by the processing of the user interface (UI). At step 710, the user selects a website from a list of websites displayed that have provided the user's sensitive information (sensitive data fields) from the data store 390. This selection can be performed manually by the user when using the website, when the user initially sends the sensitive data field, in response to the user's request, or by automatic selection after website registration, such as after a specific period of time has passed since the user provided the sensitive data field to the website (e.g., after one year, etc.).

[0063] At step 720, the process retrieves the website data and the sensitive data field metadata corresponding to the website from the data store 390. At step 725, the process displays the sensitive data field metadata and the website policy data in a readable format, notifying any field-specific policies found at the website. This data is displayed on the device display 730. In one embodiment, at step 740, the process "pings" the website to query the account status (e.g., to determine whether the account is active after the user has requested to delete the account, etc.). The website responds with the account status information. At step 750, the process uses the display 730 to notify the user of any sensitive data fields that have been retained by the website for a longer period than allowed (e.g., by highlighting such fields, etc.).

[0064] At step 760, the process receives the user's action request. The process determines whether the user has requested to delete the user's account from the website (decision 770). If the user has requested to delete the user's account from the website, then decision 770 goes to the 'yes' branch, and subsequently at step 780, the process activates the reserved delete link (e.g., URL, etc.) - which was previously collected from the website and provides the user's website account information (or, if the user is currently in the process of creating a new account at the website, cancels the sending of the sensitive data field). The activation of the delete link sends a delete request from the user's device to the selected website, prompting the website to delete the user's account information and the sensitive data field data provided by the user when opening and using the account. On the other hand, if the user has not requested to delete the user's account from the website, then decision 770 goes to the 'no' branch, bypassing step 780.

[0065] The process determines whether the user has selected another website from the list of websites stored in the data store 390 to which the user has provided sensitive data fields (decision 790). If the user selects another website, then decision 790 goes to the 'yes' branch, which loops back to step 710 to select, display, and process the sensitive data fields that have been provided to the website along with the website policy information as described above. This loop continues until no more websites are selected, at which point decision 790 goes to the 'no' branch, exiting the loop, and then,Figure 7 The processing of Figure 7 ends at 795 (or returns to the calling routine).

[0066] While specific embodiments of the invention have been shown and described, it will be apparent to those skilled in the art that, based on the teachings herein, changes and modifications can be made without departing from the invention and its broader aspects. Accordingly, the appended claims will cover all such changes and modifications that fall within the true spirit and scope of the invention. Those skilled in the art will understand that if a specific number of introduced claim elements is desired, such intent will be explicitly recited in the claims, and in the absence of such recitation, there is no such limitation. As a non-limiting example, for the purpose of aiding understanding, the following appended claims contain the use of the introductory phrases "at least one" and "one or more" to introduce claim elements. However, the use of such phrases should not be construed as implying that the introduction of a claim element by the indefinite article "a" or "an" limits any particular claim containing such introduced claim element to an invention that includes only one such element, even when the same claim includes the introductory phrases "one or more" or "at least one" and the indefinite article "a" or "an"; this applies equally to the use of the definite article in claims.

Claims

1. A method implemented by an information processing system, the information processing system including a processor and a memory accessible by the processor, the method comprising: Storing data type information regarding a set of sensitive data sent by a user device to a selected online site, wherein the data type information includes the date of sending the set of sensitive data to the selected online site and a set of site information regarding the selected online site, wherein the set of site information includes an account deletion network address URL, the data type information and the set of site information are stored in a data storage accessible by the user device, and wherein the storing prohibits storing the sensitive data in the data storage; After the storing, managing the data type information and the set of site information by: Displaying the site information; Receiving, at the user device, a request to remove the user's sensitive data from the selected online site; and Responsively sending a deletion request to the selected online site to remove the user's sensitive data from the selected online site.

2. The method according to claim 1, wherein The data storage is stored on a network-accessible storage device accessible by the user's device through an online service, and the method further comprises: Retrieving a plurality of data fields from the selected online site, wherein one or more of the data fields are related to different parts of the sensitive data; Determining the data type information based on the retrieved data fields, wherein at least one of the data type information is selected from the group consisting of the user's name, the user's email address, the user's date of birth, the user's mailing address, the user's telephone number, the user's financial account number, the user's government identification number, and the user's gender; and Identifying the set of sensitive data based on the determined data type.

3. The method according to claim 2, further comprising: Detecting the sending of the sensitive data from the user's device to the selected online site through a computer network; Submitting the plurality of data fields to a trained artificial intelligence (AI) system; And Receiving a response from the trained AI system, the response indicating which of the plurality of data fields relate to the sensitive data and the data type information corresponding to each of the data fields that relate to the sensitive data.

4. The method according to claim 1, further comprising: Retrieving a set of site information from the selected online site, wherein the retrieving includes retrieving one or more data policies from one or more pages included in the selected online site, wherein at least one of the data policies relates to data retention, and wherein at least one of the data policies relates to data sharing.

5. The method according to claim 1, further comprising: Retrieving the account deletion network address URL from the selected online site; And Using the retrieved account deletion URL to send the deletion request from the user's device to the selected online site.

6. The method according to claim 5, further comprising: After a certain amount of time has elapsed since sending the deletion request to the selected online site, send an account status request to the selected online site, where the amount of time is based on the time allowed for the selected online site to delete the user's sensitive data; Receive an account status response from the selected online site; and In response to the account status response indicating that the user account on the selected online site is still active, send one or more messages to one or more online sites requesting deletion of the user's sensitive data from the selected online site, where one of the one or more online sites is the selected online site.

7. The method according to claim 1, wherein The management further includes: Display a list of multiple online sites on the user device, where the multiple online sites include the selected online site; Receive a selection of the selected online site from the user at the user device, where the selected online site is from a plurality of site information stored in the data store and is displayed on a display of the user device, and where each of the plurality of site information is related to one of the multiple online sites including the selected online site; In response to the selection, retrieve from the data store a set of data types of the sensitive data sent to the selected online site and a data policy retrieved from the selected online site; and Display on the display the selected online site information including the data types and the data policy, where the data policy is arranged in an easily readable format and notifies the user of any field-specific data policies.

8. An information processing system, comprising: One or more processors; A memory coupled to at least one of the processors; And A set of computer program instructions stored in the memory and executed by at least one of the processors to perform operations including: Store data type information about a set of sensitive data sent by a user device to a selected online site, where the data type information includes the date the set of sensitive data was sent to the selected online site and a set of site information about the selected online site, where the set of site information includes an account deletion network address URL, the data type information and the set of site information are stored in a data store accessible by the user device, and where the storage prohibits storing the sensitive data in the data store; After the storage, manage the data type information and the set of site information by: Displaying the site information; Receiving at the user device a request to remove the user's sensitive data from the selected online site; and Responsively sending a deletion request to the selected online site to remove the user's sensitive data from the selected online site.

9. The information processing system according to claim 8, wherein, The data store is stored on a network-accessible storage device accessible by the user's device through an online service, and the operations further include: Retrieve a plurality of data fields from the selected online site, wherein one or more of the data fields are related to different parts of the sensitive data; Determine the data type information based on the retrieved data fields, wherein at least one of the data type information is selected from the group consisting of a user's name, a user's email address, a user's date of birth, a user's mailing address, a user's phone number, a user's financial account number, a user's government identification number, and a user's gender; and Identify the set of sensitive data based on the determined data type.

10. The information processing system according to claim 9, wherein, The operation further includes: Detect the transmission of the sensitive data from the user's device to the selected online site via a computer network; Submit the plurality of data fields to a trained artificial intelligence (AI) system; and Receive a response from the trained AI system, the response indicating which of the plurality of data fields involve the sensitive data and the data type information corresponding to each of the data fields that involve the sensitive data.

11. The information processing system according to claim 8, wherein, The operation further includes: Retrieve a set of site information from the selected online site, wherein the retrieval includes retrieving one or more data policies from one or more pages included in the selected online site, wherein at least one of the data policies relates to data retention, and wherein at least one of the data policies relates to data sharing.

12. The information processing system according to claim 8, wherein, The operation further includes: Retrieve the account deletion network address URL from the selected online site; and Send the deletion request from the user's device to the selected online site using the retrieved account deletion URL.

13. The information processing system according to claim 12, wherein, The operation further includes: After a certain amount of time has elapsed since sending the deletion request to the selected online site, send an account status request to the selected online site, wherein the amount of time is based on the time allowed by the selected online site to delete the user's sensitive data; Receive an account status response from the selected online site; and In response to the account status response indicating that the user account on the selected online site is still active, send one or more messages requesting deletion of the user's sensitive data from the selected online site to one or more online sites, wherein one of the one or more online sites is the selected online site.

14. The information processing system according to claim 8, wherein the management further includes: Display a list of a plurality of online sites on the user device, wherein the plurality of online sites includes the selected online site; Receive a selection of the selected online site from the user at the user device, wherein the selected online site is from a plurality of site information stored in the data store and is displayed on a display of the user device, wherein each of the plurality of site information is related to one of the plurality of online sites including the selected online site; In response to the selection, retrieve from the data store a set of data types corresponding to the sensitive data sent to the selected online site and the data policies retrieved from the selected online site; and Display online site information including the selection of the data type and the data policy on the display, wherein the data policy is arranged in an easily readable format and notifies the user of any field-specific data policies.

15. A computer program product stored in a computer-readable storage medium, comprising computer program code that, when executed by an information processing system, performs operations including the following: Store data type information about a set of sensitive data sent from a user device to a selected online site, where The data type information includes the date of sending the set of sensitive data to the selected online site and a set of site information about the selected online site, wherein the combination of the site information includes an account deletion network address URL, the data type information and the set of site information are stored in a data store accessible to the user device, and wherein the storage prohibits storing the sensitive data in the data store; After the storage, manage the set of data type information and the set of site information by: Displaying the site information; Receiving, at the user device, a request to remove the user's sensitive data from the selected online site; and Responsively sending a deletion request to the selected online site to remove the user's sensitive data from the selected online site.

16. The computer program product according to claim 15, wherein, The data store is stored on a network-accessible storage device accessible by the user's device through an online service, and the operations further include: Retrieving a plurality of data fields from the selected online site, wherein one or more of the data fields are related to different parts of the sensitive data; Determining the data type information based on the retrieved data fields, wherein at least one of the data type information is selected from the group consisting of the user's name, the user's email address, the user's date of birth, the user's mailing address, the user's phone number, the user's financial account number, the user's government identification number, and the user's gender; and Identifying the set of sensitive data based on the determined data type.

17. The computer program product according to claim 16, wherein, The operations further include: Detecting the sending of the sensitive data from the user's device to the selected online site through a computer network; Submitting the plurality of data fields to a trained artificial intelligence (AI) system; and Receiving a response from the trained AI system, the response indicating which of the plurality of data fields involve the sensitive data and the data type information corresponding to each of the data fields that involve the sensitive data.

18. The computer program product according to claim 15, wherein, The operations further include: Retrieving a set of site information from the selected online site, wherein the retrieval includes retrieving one or more data policies from one or more pages included in the selected online site, wherein at least one of the data policies relates to data retention, and wherein at least one of the data policies relates to data sharing.

19. The computer program product according to claim 15, wherein, The operations further include: Retrieving the account deletion network address URL from the selected online site; and Sending the deletion request from the user's device to the selected online site using the retrieved account deletion URL.

20. The computer program product according to claim 19, wherein, The operations further include: After a certain amount of time has elapsed since sending the deletion request to the selected online site, an account status request is sent to the selected online site, where the amount of time is based on the time allowed for the selected online site to delete the user's sensitive data; Receive an account status response from the selected online site; and In response to the account status response indicating that the user account on the selected online site is still active, send one or more messages to one or more online sites requesting deletion of the user's sensitive data from the selected online site, where one of the one or more online sites is the selected online site.

Images