Computer system for processing anonymous data and method of operating the same

Abstract

A system and method are proposed to enable computers to communicate and exchange personal data in a secure system, wherein security is achieved by computers de-identifying personal data by removing all personal identifiers and subsequently re-identifying the data using an anonymous identifier generated by a computer operated by a data subject. Even if the personal data and the data subject are anonymous, the computer in the present system is able to establish a communication session between the computer of the anonymous data subject and the computer system holding the data subject's information of interest and send that information to its owner.

Description

Technical Field

[0001] The present application is in the field of computer systems and cryptography and relates to improving the protection of user identity and privacy by using an intrinsically secure system architecture.

[0002] CROSS-REFERENCE TO RELATED APPLICATIONS

[0003] This application claims the benefit of and priority to Portuguese Patent Application No. 115.479, filed on April 29, 2019. Background Art

[0004] This section is intended to provide a background or context to the invention described in the claims, and may include concepts that may be pursued and novel. Such disclosures should not be considered prior art to the description and claims in this application unless the context clearly or explicitly states that it is prior art.

[0005] The Internet has enabled the creation of computer systems that process the personal data of billions of people. They have brought the information age from the realm of corporate and state entities to the level of the individual. They have given people unparalleled access to information useful for their work, social interactions and business, as well as actions that enable them to work, interact and transact easily, quickly, conveniently and at very low cost. Internet-based companies are often able to provide services to customers for free, because the data collected from customers by these companies during computer-based Internet-connected interactions has an economic value. Consumer preferences and choices collected during these interactions and transactions allow Internet-based companies to build consumer profiles, enabling them to target commercial offers precisely to consumers included in the defined profiles, thereby reducing targeting, marketing and sales costs and even directing commercial offers to individual consumers. This has resulted in more consumer choices, lower prices and more sales, and is therefore very beneficial to the economy and society. This is achieved by citizens through costless actions - simply granting companies access to their personal data.

[0006] This ease of identifying consumer preferences creates a second source of value for companies that goes beyond the revenue derived from the sale of traditional products and services, including revenue from the sale of consumers’ personal data to third parties, who use the data to target advertising on the Internet and increase sales of their traditional products and services.

[0007] The ability to combine this mass market targeting with high accuracy has become more sophisticated as the processing of personal consumer data has been combined with data from the physical world. More recently, this ability to combine data from multiple sources has been further enhanced by technologies that allow data processors to determine patterns of behavior and choices and from there predict and sometimes influence citizen actions, which are considered by social and ethical conventions to be sovereign acts, free from third-party interference. Sometimes, personal data that citizens provide to Internet-based companies in good faith in exchange for improved services and financial benefits is used for implicit purposes unrelated to the original purpose and intent for which the personal data was given.

[0008] Yet in other areas, fear of misuse of personal data has led to suboptimal development of computer systems and failure to deliver benefits to citizens. This is particularly evident in certain types of sensitive personal data, such as medical records and health data, which are characterized by being stored in multiple, unconnected, non-interoperable systems, where data atomization has always been an involuntary mechanism for personal data protection. Data are redundantly distributed across so many files, databases, and computer systems belonging to multiple healthcare providers that it is indeed difficult or even impossible for healthcare providers to access a patient's comprehensive clinical history. Collecting personal healthcare data and integrating it into a single system would be of significant public interest.

[0009] Therefore, there is a great need to improve the way computer systems handle personal data, to prevent situations where it is being misused, or to solve problems for others where it is underutilized. This is the invention presented herein, which solves a problem that is rooted in the deficient nature of Internet technology, namely the inability to use personal data in a secure and consented manner that citizens can control and whose privacy rights are protected. Ideally this control problem would be solved not by changing the Internet communication protocols, which is impractical and indeed unnecessary, but by establishing a new relationship model between its various participants via their personal computing devices, and placing the individual as the controlling party of the Internet interaction.

[0010] The solution proposed by the present invention is based on the need for anonymization and encryption of data records. Protecting personal data on the Internet, especially sensitive data such as personal health data or any other type of data that the owner wishes to remain confidential or secret is very important, and various methods have been developed to achieve this. One of these methods involves anonymization and irreversible anonymization that hides the identity of the owner, making re-identification impossible. In applications where it is necessary to maintain the data subject anonymously but maintain the ability to aggregate the data according to identification terms, anonymous identifiers with a one-to-one relationship with the owner can be used. In this way, data belonging to the same person can be stored, organized and processed under the owner's anonymous identifier key.

[0011] Care must also be taken to avoid computer systems and computer applications that have access to means of re-identification, the technical method of doing so is to use anonymous identifiers in these computers that are not related to the original name or personal identifier, such as the owner's date of birth, address or personal identification number. In addition, especially in cases where computers are connected to very large networks (such as the Internet) and have the possibility of public access, storing and transmitting data in clear text, that is, it can be immediately read and understood by any party, is a privacy risk. The use of cryptographic methods is an effective way to solve the problem and can be used to protect sensitive information of interest, such as purchase records, medical records, financial records, tax records, property records, consumer preferences, etc., which are processed in these networked computer systems.

[0012] Using these techniques, even if the personal identifier of the data subject is encrypted and the information of interest is anonymized, it is necessary that the information of interest does not contain data that could allow the identity of the data subject to be inferred by matching the plaintext data with other databases that contain similar data of interest and for which the identity of the subject is known. Therefore, an effective way to protect the privacy rights of the data subject would seem to be to hide his or her identity. In order to hide it completely, it might even be useful to eliminate the traditional username / password authentication method, which in order to operate might require the computer to know the username of the data subject and store his or her password.

[0013] However, there are multiple applications where it is necessary to restore the anonymization of the owner's personal data. Such applications include healthcare, where the owner needs to be re-identified, for example, when there is a need to change medical treatment and thus identify the patient with certainty. In addition to healthcare, there are other cases where it is necessary to restore the anonymization of the owner, which includes all cases where the owner needs or wants to be contacted by a data or service provider - to prove ownership of an asset, receive information about pending bills, changes to terms and conditions, product information, the provision of new services, consent requests, etc.

[0014] Reversible anonymization is known as pseudonymization, which is defined in the EU General Data Protection Regulation as the processing of personal data in such a way that the personal data can no longer be attributed to a specific data subject without the use of additional information. A practical implementation of this approach is to configure a computer system to select data records containing information of interest related to their data subject owner, identified with a confidential code, where the code is also stored in a different file location on the same computer, or stored in another computer, which also contains the data subject's name and personal identifier. By matching the information in the two files, the data subject can be re-identified. In this way, computer files containing pseudonymous health records or other sensitive information from multiple data subjects can be processed without revealing their identities, but each data record can be traced back to the identity of the data subject through a second data file when necessary.

[0015] Unfortunately, this division of data, where the real identity of the data subject is kept separately in another computer file, is susceptible to abuse, especially when both files are under the control of the same data controller computer server, which is operated by an entity that, among other activities, uses its computer systems to process data belonging to the data subject and originating from the data subject's computer. Unless deliberate misuse or accidental re-identification is absolutely prevented by appropriate configuration of all the computers involved, there is always a risk of data breaches and personal data being disclosed and used for purposes to which the data subject did not initially consent, either explicitly or implicitly. For this purpose, the data controller computer server needs to be configured to prevent the recovery of the pseudonymous identifier accidentally or intentionally by internal operators or malicious external operators, but such configuration should not prevent the data controller computer server from being able to establish communication with the data subject's computer to transfer and exchange the subject's data.

[0016] The present application proposes a solution to this paradox and describes a secure computer system and method in which a data subject's computer is configured to generate an anonymous identifier for hiding the data subject's name identity and personal identifiers, thereby preventing such identifying data from being transmitted to a data controller computer server, thus making them insensitive to accidental release or malicious destruction. The data subject's computer is further configured to allow the data subject to indicate his or her consent to the transfer of his or her personal data, to whom, for what purposes and for how long, and to establish communication with the data controller computer server in such a way that the data controller computer server can verify the identity of the data subject's computer.

[0017] There are several references in the literature that mention variable anonymization models that allow for the measurement of known or discoverable personal data.

[0018] Patent application WO / 2018 / 201009 describes systems and methods that achieve similar objectives to those of the present application, but by using dynamic identifiers for each user. Dynamic identifiers work very well in terms of anonymizing users, but raise the question of legal liability, i.e. which entity is responsible for attributing identifiers to users, managing dynamic changes to identifiers, and guaranteeing that dynamically changing identifiers always refer to the same person. Static, strictly protected identifiers and data minimization methods may provide a better compromise between security, operability, and legal assurance.

[0019] U.S. Patent Application Publication 2015 / 0149208 describes a system for collecting and anonymizing health data from multiple healthcare providers, with an emphasis on increasing confidence that anonymous identifiers always refer to the same person.

[0020] US Patent Application Publication 2002 / 0091650 describes a system that provides marketers with confidential information about consumer choices while protecting their privacy and identity by providing a clear understanding of customers as a group or as specific subgroups in terms of geography, lifestyle, purchasing habits, etc. However, the proposed solution cannot reach specific individuals.

[0021] US Patent 8234698 describes a system where a data subject is able to access a network service in a way that still allows the network service provider to positively identify the customer, for example, to ensure payment for a subscription or transaction, while preventing access to the customer's personal identifiers. This is done through face-to-face authentication by a third-party anonymous authentication authority and a reliable organization such as a bank or securities company. This is a complex and expensive process.

[0022] Both US Patent 7,840,813 and US Patent Application Publication 2010 / 0131765 include some features of the aforementioned cases, but specifically allow for anonymity revocation or abandonment, which is contrary to the objectives of the present application, where anonymity is ideally irreversible and, where possible, reversibility is not within the control of the data controller.

[0023] US Patent Application Publication 2014 / 0372149 attempts to reconcile the need to anonymize a patient's personal data while providing unambiguous access to a patient's health data by storing patient records stored in the cloud, with identification fields anonymized to allow multiple doctors to securely access the patient records. These patient records, primarily images, are accessible on a primary display screen via an authorized computer operated by a patient's designated doctor. The computer contains predefined data about the patient whose data the doctor wants to review, and only displays patient records that match the predefined data. However, the data controller and processor computer servers contain both patient records and patient identification data, and can therefore be programmed to match the former with the latter, thereby re-identifying the patient.

[0024] US Patent 8,635,464 details a comprehensive method for encrypting computer systems, but in which the authentication and revocation authorities are separate entities from the data subject. Here, the data subject has no control over the management of its encryption code, nor can it individually control access to its personal data.

[0025] U.S. Patent 5,369,702 describes a multi-level multimedia encryption system in which an encrypted object is tagged with a code that determines whether the recipient of the encrypted message is authorized to decrypt it. The system employs nested encryption so that the same message can be transmitted from sender to receiver to receiver in a transmission chain, but access will be selective, depending on whether the recipient is an authorized reader as specified by the tag. The invention relates to the distribution of information to a large number of people where access needs to be selectively given based on the permission level of the recipient.

[0026] US Patent 9,910,902 describes a process for anonymizing user identifiable information, but it does not completely hide the identity of the data subject from the data processor computer because the processor maintains an anonymization mapping table that enables it to re-identify the data subject.

[0027] Thus, there are several prior art cases where authentication, encryption and access rights management systems have been used to protect personal data. However, none of them puts the citizen data subject at the center of the protection model, with full and sole power to grant and revoke access to his or her personal data, anonymize it, and possibly maintain encrypted communications with the parties that manage and process the data subject’s anonymized personal data.

[0028] We have now developed a unique computer system and a method for using it to achieve secure data processing and communication, while providing access and preventing access in a way that is automatically controlled by the data subject through his computer using the tools at his disposal and without special knowledge.

[0029] The present invention can be used in any area where personal data is stored in a computer system and where the privacy of the data subject or owner of the data needs to be protected. The list of possible sensitive areas includes scientific or non-scientific research, data collection and data extraction, where the information of interest may include gender, sexual orientation, ethnicity, medical and nursing data, genetic data, criminal records, biometric data, behavior, lifestyle, ability, religion, beliefs, political choices, party affiliation, union affiliation, decision-making, opinion polls and surveys, responses to advertisements, focus groups, human resources recruitment, business management, consumer tastes and purchase decisions, purchase records and history, tax records and history, investments and investment or savings decisions, likes and dislikes, social relationships, etc. Indeed, these areas are so sensitive that some jurisdictions prohibit processing by default and only allow processing in reasonable exceptions. The present invention allows such sensitive areas to be studied with the strictest respect for the privacy rights of individuals and requires protection for all applicable areas. Summary of the invention

[0030] Inventive Entity. In describing the present invention, reference will now be made to the various actors and functions present in the secure personal data exchange and processing computer system.

[0031] The present invention identifies three categories of actors and their respective computer systems. In the first category, data subjects or subjects are individuals or entities that use computers to process data, including personal data. They are citizens, consumers, professionals, recruiters, managers, taxpayers, patients, companies, organizations, non-profit organizations, non-governmental organizations, countries, intelligence experts, the military, whistleblowers, believers, voters, travelers, writers, photographers, artists, friends, investors, savers, etc., in fact, individuals or entities of any function that produces data as a result of human activity. Data generated by machines such as monitoring sensors are also included in this scope, and the data subject will be the person or entity that generates the data. The actual legal ownership may vary from jurisdiction to jurisdiction, but for the purpose of this application, "data subject" means the person or entity that originally generated the computer data or on whose behalf it was generated. The valuable feature of this data is that when it is generated on a very large scale, new information can be extracted and analyzed for correlations, causes and effects, and patterns of performance, behavior or choice. All such operations require the use of computers, but in general, they are not prepared to provide adequate protection for the privacy rights of data subjects.

[0032] In the second category, data controllers are individuals or entities that use computer systems and are legally responsible for data processing operations, even if they subcontract them to professional data processors. Some data controllers derive financial benefits from access to data subjects’ information as a primary or strategic business objective. This category of data controllers currently includes a) Internet search engine platforms, which record the interests of data subjects; b) Internet business and trade platforms, which store data and may create marketplaces for consumers and providers of goods and services; and c) Internet social networks, which record and help manage social interactions and communications between people. All three such groups record information about data subjects on data searches, purchases, and social interactions to obtain precise consumer profiles of each individual and may use this information and profile data to sell advertising services and precise consumer targeting information and means. In this case, data subjects benefit by being provided with free services of high value and convenience, while data controllers turn the subjects’ free data into a profitable business.

[0033] The present application creates a new type of data controller computer server that accesses, retrieves and consolidates subject data from any source it may be located in and uses it in a manner consistent with protecting citizens' privacy rights and self-determination. This data controller will be selected by the data subject to perform all such data extraction, consolidation, storage and processing on behalf of the subject while protecting privacy rights. In the present invention, this entity is called a trusted data controller, which operates a trusted data controller computer server. As part of the computer system described in the present invention, the trusted data controller computer server is configured to process personal data in a manner that protects the privacy rights of the data subject.

[0034] The third category of actors are data providers. Many corporate entities are primarily engaged in the provision of services or the sale of goods, but in the course of carrying out their primary activities, they acquire or generate large amounts of valuable personal data through the use of computer systems. Examples include the aforementioned data providers, banks, insurance companies, accountants, tax advisors, financial companies, marketing companies, consumer survey companies, pharmaceutical companies, contract research organizations, non-governmental organizations, national health services, census organizations, polling companies, hospitals, doctors' offices, clinical testing services companies, etc. In fact, the line between companies whose primary business is data and service and product companies whose data is increasingly important, sometimes even exceeding the importance of the original business, is increasingly blurred. The latter group is characterized by their computer systems holding large data sets of personal information, which they may be interested in exploiting economically by contracting with professional data controllers. It is part of the present invention to configure the data provider computer servers to operate in a manner that ensures the protection of the privacy rights of data subjects.

[0035] Certain types of data providers are particularly important in the present invention. Healthcare providers are such providers and include physicians, pharmacists, nurses, and anyone who has access to a subject's clinical records for treatment purposes and to add new treatment and health information. Here, the healthcare provider computer server needs to be able to positively identify the data subject as a patient to ensure that the underlying medical records do belong to the patient being observed and treated, but such access must not compromise the privacy of the data subject's information.

[0036] An optional fourth category of participants is an identity verification provider, where a computer server verifies the identity of a data subject so that the identity of that person can be confirmed. In an online embodiment, the identity verification provider is a computer server configured to access and connect to a computer server that manages a large database storing information about citizens and in particular identification data, such as name, personal identifier, and importantly for this application, electronic address, email address or number associated with the data subject's smartphone or tablet or any other personal computing device with communication capabilities. Examples are government databases of driver's license agencies or tax authorities and private databases of mobile phone operators.

[0037] Personal identifiers are information elements that can be used to identify the data subject, including personal name, gender, date of birth, address, any personal identification number (ID card, tax number, social security number, national health number, policy holder number, bank account number, telephone number, mobile phone number, etc.) or personal address (residential address, employer address, user name, social network name, email address, website address, computer name and electronic address, etc.), collectively referred to as personal identifiers. In cases where family members can also help identify an individual, the personal identification information of family members is also included in the scope of the individual's personal identifier.

[0038] Embodiments of the present invention use encryption technology. Encryption is a data manipulation mechanism where a data subject computer or a data controller computer server is used to encrypt a message so that a third computer cannot understand it during transmission, and then the recipient uses a closely related mechanism to restore the message's manipulation process, decrypt it and gain read access to its contents. Encryption methods also include the ability to confirm the identity of the data subject and the recipient, as well as the ability to identify any changes to the encrypted data and guarantee the integrity of its contents.

[0039] Encryption requires a computer cryptographic key. A key is a series of letters, numbers, or bytes of information that are manipulated by an encoding algorithm on the sender's computer to convert readable text or data into a series of unintelligible symbols or characters. The computer receiving the encoded text then uses the key to decrypt the message back to plain text.

[0040] Four types of computer cryptographic systems are important in the present invention.

[0041] In the first type, the sending computer and the receiving computer use the same cryptographic key and the same encoding algorithm. This is called symmetric key cryptography and is a relatively fast encoding system in terms of computer resources. One difficulty here is managing access to this unique key, which makes it more appropriate to encode communications between only two computers - each pair of sending and receiving computers has a symmetric key.

[0042] Computer symmetric key encryption uses a single key, k, for both computer encryption and decryption. There are many different types of computer symmetric key encryption. One example is the Advanced Encryption Standard ("AES"). Typically, computer symmetric key encryption employs a series of deterministic operations for encryption that can be reversed for decryption. For computer symmetric key encryption, the encryption key is typically kept secret by the two communicating computers, as access to the key allows decryption to occur.

[0043] In the second type of computer cryptographic system, called asymmetric key cryptography, the sending and receiving computers use a different pair of cryptographic keys, a public key and a private key. Computer public / private key cryptography is widely used in commercial transactions and information exchange protocols. One widely used public / private key cryptographic system is called the "RSA" cryptography, where RSA includes the initials of the last names of the inventors of the method: Rivest, Shamir, and Adleman. In this computer cryptographic system, a cryptographic key pair is generated. Generally speaking, the public cryptographic key is publicly distributed and is called the "public key", while the private key is held secretly by the computer receiving the encrypted information and is called the "private key" or "key". In normal use, the sending computer of a message will encode it using the receiving computer's public key, which is well known, and the receiving computer will decode it using its private key, which is kept secret.

[0044] Asymmetric key cryptographic methods can also be used to digitally sign messages to provide message authentication between computers. In one example, the message to be signed consists of the sender's public key. The sending computer will encrypt the message using the sender's private key and send the encrypted message to the receiving computer. The receiving computer will decrypt the message using the known public key of the sending computer. If the decrypted message content is equal to the sending computer's public key, the digital signature verification is successful. In order to digitally sign longer messages, it is useful to first hash the entire message, encrypt it with the sender's private key, and then transmit it to the receiving computer for decryption and verification. There are several methods available, and the preferred method here is the Elliptic Curve Digital Signature Algorithm (ECDSA), which is a variant of RSA.

[0045] The third category of useful computer cryptography is blockchain. This is a secure system for recording transactions distributed across a large number of processing nodes, so large that the encryption cannot be broken. Each information object encrypted using a blockchain typically contains a cryptographic hash of the previous block, a timestamp, and the transaction data. By design, blockchain is inherently resistant to modification of data. It is an open, distributed computer ledger that can record transactions between two computers efficiently, in a verifiable and permanent manner. To function as a distributed ledger, a blockchain is typically managed by a peer-to-peer network of computers that collectively adhere to a protocol for inter-node communication and validation of new blocks. Once recorded, the data in any given block cannot be altered retroactively without altering all subsequent blocks, which requires the collusion of a majority of the network.

[0046] In this application, blockchain can be used to record information transactions between computers of data subjects, authenticators, data providers and trusted data controllers, as well as to give data subjects the possibility to customize consent and access to their personal data by using smart contracts (characteristics of blockchain). Smart contracts allow data subjects to specify through their computers who and whose computers can view personal data and data of interest, which categories of data can be viewed and by whom, which can be written and by whom, which actions can be authorized depending on the underlying data of interest, and to grant or remove consent and computer access rights globally or selectively.

[0047] A fourth cryptographic method is a secure hash algorithm, such as SHA-256, SHA-512, or any of their successors. This is a widely used mathematical function that encrypts an expression into an encrypted version with a higher level of security than an asymmetric key. In the current state of technology, a brute force attack to recover a hashed number takes much longer than recovering a number encrypted using a public key. In the present disclosure, hashing can be used to transform an anonymous identifier of a data subject.

[0048] These four computer cryptographic systems - symmetric keys, asymmetric keys, blockchains and hashes - can be effectively combined in the present invention. Other cryptographic functions such as session keys, key rings, temporary keys and tokens and any other cryptographic system can also be used.

[0049] Useful in understanding embodiments of the present invention is the concept of consent. Consent is the clear, specific, and informed authorization by a data subject to identify the parties who have access to the subject's personal data and data of interest; the purposes for which the data is authorized to be used and which survives the revocation of consent; the categories of data that may be accessed and processed, depending on the nature of the different recipients and the subsequent authorization levels; and the length of time that the receiving computer may store and process the data. The right to consent includes the right to revoke consent, with the result that all personal data and all data of interest originating from the data subject must be deleted by all receiving computers included in the consent revocation command. Embodiments of the computer system of the present invention described herein employ this concept of consent and allow for the process of changing consent.

[0050] The consent form includes a data transfer request, as defined in the EU General Data Protection Regulation, which allows the data subject to request that their personal data stored on a data controller's computer server be transferred or copied to another data controller's computer server. In this application, the trusted data controller and its computer server are the recipients of the data transferred pursuant to the data transfer request issued by the data subject.

[0051] Reports are documents generated by a trusted data controller using personal data of interest located in its computer servers and in its application databases, but in a way that excludes or hides the name or any personal identifier of the data subject. Reports use statistical, data science and big data methods. Reports extract new valuable knowledge by calculating and inferring relationships between elements obtained in the personal data of interest. Useful areas include advertising, marketing and selling of goods and services, finance, insurance and medicine, among others. In the field of medicine and healthcare, useful sub-areas include diagnostics, smart prescriptions, ranking of drugs and treatments in terms of effectiveness, efficacy and safety, identification of side effects, adverse reactions and drug interactions, cost / benefit ratio of drugs, medical devices and treatments, all about patient attributes such as age, sex, genetic characteristics, severity of disease, presence of multiple diseases, administration of multiple medications, medication compliance, addiction, intolerance, allergies, vaccinations, microbiome and lifestyle. Reports can also be used to identify patient cohorts with ideal homogeneous or heterogeneous characteristics as candidates for clinical trials.

[0052] Reports use all available information at a point in time in the trusted data controller's application database, which contains information of interest for the entire group of data subjects. When personal data and information of interest to data subjects are obtained through consent, future withdrawal of consent does not affect reports, as they remain valid after the withdrawal of consent under the original consent terms. This concludes the description of entities and functions that are useful in this disclosure.

[0053] Description of the Invention. The present disclosure addresses the privacy issues inherent in large-scale Internet communications by replacing the names and personal identifiers of data subjects in data communications between computers with anonymous identifiers, while still allowing a trusted data controller computer server to absolutely confirm the identity of the anonymous data subject and correctly transmit the anonymized data of interest to the personal computing device that owns the data subject. This allows sensitive personal data to be searched, collected, stored, and processed without the trusted data controller computer server storing the name identity of the data subject, thereby eliminating the risk of abuse and privacy violations characteristic of many Internet-based communications and computer systems. In the healthcare field, this makes it possible to develop electronic health record (EHR) systems that are inherently private.

[0054] The described system and method require a data subject having a personal computing device running a personal software application, one or more data providers each running a data exchange software application in their computer servers, and a trusted data controller running the data exchange software application in their computer servers. The computers of all three participants contain a cryptographic software module capable of creating cryptographic keys and encrypting and decrypting messages. Each of the three software applications is configured to communicate and exchange data securely with the other two software applications. Secure communication should be understood as the use of computer cryptographic means to ensure that only authorized communications are carried out in the manner described in the present disclosure. It is useful that the anonymous identifier of the data subject will be used as part of the encryption key or encryption system in the present disclosure.

[0055] In one embodiment - a general embodiment - any cryptographic means employed by a cryptographic software module running on the computer systems of all participants that can securely encrypt the anonymous identifier and transmitted data so that it can only be decrypted by the legitimate receiving computer system is useful.

[0056] In another embodiment - an asymmetric key embodiment - the cryptographic device uses a public / private key asymmetric cryptographic system employed by a cryptographic software module running in the computer systems of all participants. These devices can securely encrypt anonymous identifiers and transmitted data so that they can only be decrypted by the intended receiving computer system that holds and uses the appropriate key. In order to authenticate communications between a personal computing device and a data provider computer server or a trusted data controller computer server, the anonymous identifier can be used in a digital signature program. The digital signature ensures that each computer receiving the data is certain of the identity of the sending computer, cannot claim that the sending computer is not the source of the data, and that the data exchange is confidential. Therefore, the anonymous identifier used as a public key in an asymmetric key cryptographic system is also an authentication key and an encryption key. The implementation and use of these methods are known in the cryptographic community, and only the salient inventive aspects will be described in this disclosure.

[0057] To make communications and processing more secure, the third embodiment adds a hash function to the second embodiment, so that both hashing and asymmetric keys are used to encrypt the anonymous identifier of the data subject and the transmitted data.

[0058] The data subject's personal computing device may be, for example, a smartphone or tablet. It is also possible to use personal accounts in a personal computer or server computer, but since they are not personal devices, they are not sufficient for these tasks. It is worth noting that personal accounts in server systems may require a user-defined login username and system password, which may be data known to the data controller and may therefore allow the data subject's personal data to be associated with a personal identifier. In some computer systems, the system administrator can reset the password, allowing the administrator to immediately access personal and identifiable data. However, the present invention is not limited to smartphones or tablets, and any device developed in the future with sufficient computing power and within the reach of the data subject and under the control of the data subject is suitable.

[0059] The data subject's personal computing device can be configured to perform the steps described herein by downloading a personal software application to the personal computing device from a website or from an application distribution service such as Appstore or Google Play. In all cases, the personal software application is provided by a trusted data controller. The purpose of this personal software application is to collect personal information about the data subject in a single computing device, which is usually distributed in a large number of data provider computer servers.

[0060] The computer server systems described herein include computer servers operated by data providers and by trusted data controllers, and they are typically server systems with considerable computing power, storage, and communication capabilities. Data is processed by data providers through their data exchange software applications stored in one or more data provider computer servers. Data is processed by trusted data controllers through their data exchange software applications stored in trusted data controller computer servers.

[0061] All computer systems in the present invention include a processor, a memory capable of storing program instructions, a communication subsystem, a storage medium, an input device (such as a keyboard, a mouse, a pointer, a touch screen, a microphone or a camera), and an output device (such as a display screen and a speaker). The computer systems can communicate with each other using private or public telecommunication networks, but public networks are preferred, and the preferred medium is the Internet.

[0062] Computer operations in the present disclosure include manual steps and automatic steps. Manual operations are operations in which the data subject enters data to set up a personal software application in his or her personal computing device. During the installation of the personal software application, the data subject enters personal identification data by which the data provider computer server will be able to identify the health data of the data subject. This can be a name or a personal identifier, or both. Optionally, the data subject also enters a consent statement and a data transfer request, as well as any other instructions required to establish user preferences or data required for subsequent program operations, which will vary depending on the specific functional requirements of the software application. Other manual tasks of the data subject include selecting menu options in the personal software application during use.

[0063] All other tasks described herein are automated tasks that occur automatically under the control of a computer program to manage all data processing in the personal computing device of the data subject and in the computer servers of one or more data providers and trusted data controllers, as well as the communication and data exchange between them.

[0064] The present invention is intended to implement a sequence of requesting, retrieving, storing, processing and exchanging data in a personal computing device under the control of a computer program executed on the personal data of a data subject, searching, anonymizing and transmitting anonymized data of interest related to the data subject in one or more data provider computer servers, and receiving, storing and accumulating the anonymized data of interest in a trusted data controller computer server and returning it to the personal computing device of the anonymous data subject.

[0065] The trusted data controller computer server does not store any information about or related to the data subject's name or personal identifier, nor does it store any electronic address information, such as the mobile phone number, electronic address or Internet address of the data subject's personal computer device. Not storing this data is an effective way to prevent the computer from accidentally, negligently or maliciously invading the data subject's personal data and related privacy rights. Therefore, no data items that identify the data subject (such as name or personal identifier) ​​shall be transmitted to the trusted data controller computer server, nor shall the trusted data controller computer server be provided with means to identify the data subject by name, personal identifier, login name or system password. Therefore, the computer in the present invention is not configured to use traditional login usernames and system passwords to identify the data subject. The system password is a confidential code usually selected by the data subject and stored in the computer system of any data controller that manages the data subject's computer user account.

[0066] In contrast, personal software applications in personal computing devices use a unique number to identify data subjects - an anonymous identifier. The dimensions of this number are such that the probability that at least two people share the same anonymous identifier and that different computers store and use the same anonymous identifier to identify more than one person is considered close to zero. Therefore, the anonymous identifier is also the identification key of the data subject.

[0067] There are at least two ways that a computer system can generate an anonymous identifier, both employing a cryptographic software module running in a personal computing device. The first is by generating a single complex random number that will be used for cryptographic communications between all computer systems. They will also use the data subject's anonymous identifier as a cryptographic key in a symmetric key cryptographic system. The second way is to use an asymmetric encryption key cryptographic system. In a first step, the cryptographic software module generates a random number that will be the data subject's private cryptographic key. From the private key, the cryptographic software module mathematically derives a public cryptographic key, such as using the public method of the elliptic curve digital signature algorithm. This can be used for encrypted communications between the data subject's computer system, one or more data providers, and a trusted data controller.

[0068] The data subject's public cryptographic key will also be its anonymous identifier, but its use will differ from the usual practice as it will remain confidential and known only to the data subject and the computers of the trusted data controller. Since the anonymous identifier can be an identification key, an authentication key, and an encryption key, it must be strictly protected by cryptographically generating an encrypted anonymous identifier.

[0069] For greater security, the original anonymous identifier of the data subject can be hashed by the data subject's cryptographic software module in the personal computing device so that it can be transmitted to the data provider in a way that hides the original anonymous identifier. In this embodiment, when the data subject installs the personal software application in its personal computing device, the installation process is configured to send the original anonymous identifier to the trusted controller computer server. Upon receiving it, the trusted data controller computer server applies the hashing algorithm to the original anonymous identifier and obtains the hashed anonymous identifier, and stores it in the data subject entry record in its user registration database. In subsequent transmissions of information of interest related to the data subject, between the data provider computer server and the trusted data controller computer server, the subject's data is identified by the former through the hashed anonymous identifier of the subject. Upon receiving it, the trusted data controller computer server searches for the hashed anonymous identifier in its data registration database, and when a match is found, reads the original anonymous identifier of the data subject in the same record, and stores the received data of interest under the identity of the anonymous identifier.

[0070] In all cryptographic embodiments, it is intended that the encrypted anonymous identifier be decrypted only by the trusted data controller computer server. Thus, the encrypted anonymous identifier and the cryptographic key required for decryption will only be known to the data subject's personal computing device and the cryptographic software module running in the trusted data controller computer server, and will be secret to all other computers, such as the data provider computer server.

[0071] In view of the existence of a variety of encryption and data conversion methods, and in order to simplify the present disclosure, the expressions "encryption", "hashing", "encrypted anonymous identifier", "encrypted data", "digital signature" (and their counterparts "decryption", "decrypted anonymous identifier", "decrypted data", "verified digital signature") will now be used without further reference to the encryption or data conversion method used, using only the words "encryption" and "decryption" unless the context requires. However, a person with reasonable cryptographic skills will be able to determine the most appropriate method for each use.

[0072] The present disclosure will now describe the operation of the present system and method for processing anonymized personal data. The system and method for searching and obtaining identified personal data related to a data subject includes downloading and installing a personal software application in a personal computing device, and the data subject enters at least a name or a personal identifier or both and optional consent, data transfer request and user preferences. A cryptographic software module is also downloaded and installed, and generates an anonymous identifier for the data subject and an encrypted version, i.e., an encrypted anonymous identifier. The personal software application sends the data and the encrypted anonymous identifier to one or more data provider computer servers, which search and obtain the information of interest of the data subject stored in one or more of their application databases, remove all personal identifiers to de-identify and anonymize the information and the data subject, and transmit the anonymized information and the encrypted anonymous identifier to a trusted data control computer server, which decrypts and verifies the anonymous identifier of the data subject, and stores, processes and then returns the anonymized data to the personal computing device of the anonymous data subject.

[0073] In more detail, immediately after installation, the personal software application in the personal computing device contacts all participating data provider computer servers that may have personal data related to the data subject. The data provider computer servers run a data exchange software application configured to communicate securely with the personal software application. The data provider computer server receives data from the personal software application, including at least the name or personal identifier or both and optional consent, data transfer request, user preferences and encrypted anonymous identifier, and searches the application database for the personal data of interest related to the data subject by the personal identifier and obtains the identified data. Upon finding it, the data exchange software application removes any and all personal identifiers from the identified data of interest: name, full date of birth, address, personal identification number, mobile phone number, email address, Internet address, etc., de-identifying and anonymizing the data subject's data of interest. These operations are performed by all data provider computer servers contacted by the data subject's personal software application.

[0074] The data exchange software application in each data provider's computer server then adds the data subject's encrypted anonymous identifier and optional information to the anonymized data of interest and transmits it to the data exchange software application in the trusted data controller's computer server.

[0075] The trusted data controller computer server receives the data transfer and verifies whether it relates to a new or existing data subject. This is done by the data exchange software application decrypting the encrypted anonymous identifier of the data subject and searching for the decrypted anonymous identifier of the data subject in the user registration database of the trusted data controller computer server.

[0076] If not found, the data subject is new and the data exchange software application opens a new entry for the data subject by recording its anonymous identifier, optional consent, data transfer request and preferences in the user registration database and in the transfer metadata (e.g. timestamp of the communication, original data provider identity and address, etc.) in the transfer log file of the trusted data controller's computer server. If found, the data subject is therefore an existing subject and the data exchange software application records the transfer metadata in the transfer log file in the trusted data controller's computer server. Thereafter, in both cases, the data exchange software application records the anonymous identifier and the anonymized data of interest in the application database of the trusted data controller's computer server.

[0077] The transmission of anonymous data from the data provider computer servers to the trusted data controller computer servers will occur periodically whenever new personal data relating to a data subject is entered into the application database of one or more of the participating data provider computer servers. The data exchange software applications in the data provider computer servers will be configured to recognize new data for subsequent transmission to the trusted data controller computer servers. This periodic transmission will occur as long as the data subject does not revoke his or her consent to the access and processing of personal data through his or her individual software application, which revocation will be propagated to all servers participating in the current computer and data exchange system. Over time, the data provider computer servers will continue to transmit new data and the trusted data controller computer servers will accumulate a large amount of anonymized data of interest that is identified only by the data subject's anonymous identifier.

[0078] A method for returning anonymized data of interest to a personal software application of an anonymous data subject by a trusted data controller computer server will now be described. The personal software application in the personal computing device and the data exchange software application of the trusted data controller computer server establish communication via a communication network, and the data exchange software application transmits the anonymized data of interest to the personal software application, thereby returning the personal data of interest and information to the personal computing device of the anonymous data subject.

[0079] This is achieved through a communication session, which is always initiated by a personal software application in the personal computing device of the data subject, connecting to the known electronic address of the computer server of the trusted data controller. The data exchange software application in the computer server of the trusted data controller has to wait for the communication session to be initiated by the personal software application, and the computer server of the trusted data controller is blocked from initiating such communication session because it does not have any contact element, number or address.

[0080] Secure communication between the data subject's personal computing device and the trusted data controller's computer server is achieved by the personal software application sending a data exchange request to the trusted data controller's computer server, which can be verified in two different ways. The personal software application and the cryptographic software module can send the request and the data subject's anonymous identifier in a digitally signed format, where the anonymous identifier is encrypted with the cryptographic software module's private key and then the data subject's public key is appended. The cryptographic software module in the trusted data controller's computer server decrypts the message using the public key appended to the message. If the content of the decrypted message is the same as the public key used to decrypt it, the digital signature and message will be verified.

[0081] In the second method, a request uniquely identified by the data subject's anonymous identifier can be verified by a data exchange software application in a trusted data controller computer server, which receives the request and compares it to similar entries in the user registration database in the trusted data controller computer server. If a match is found, it is confirmed that a valid request has been received and that the stored anonymous identifier and the received anonymous identifier do correspond to the same anonymous data subject.

[0082] Following either of these two verification methods, the data exchange software application in the trusted data controller computer server ensures that the anonymized data of interest is returned to the personal computing device of its legitimate owner, the data subject. The method and system provide the computer of the present invention with a level of operational security regarding privacy that has heretofore been absent or deficient in Internet-based communication and computer systems.

[0083] The selection of an asymmetric key cryptographic system to generate anonymous identifiers and providing asymmetric cryptographic key pairs to all computers in the present invention—those of the data subject, the data provider, and the trusted data controller—and the use of hash functions to transform the original anonymous identifiers meet the deficiencies of existing computer systems in terms of the privacy risks associated with the misuse of personal data with greater efficiency and security.

[0084] Thus, when the personal software application first contacts one or more data provider computer servers and transmits the subject data entered during the installation of the personal software application in the personal computing device of the data subject, the original anonymous identifier of the data subject will be hashed or encrypted, and thus will still serve as a unique identifier of the data subject, but the original anonymous identifier will not be revealed. Therefore, the data provider computer server cannot associate the name and personal identifier of the data subject stored in and known to the data provider computer server with the original anonymous identifier of the data subject. This ensures the confidentiality of the public key of the data subject, which is also its anonymous identifier. When the data provider computer server transmits the anonymized data of interest and the encrypted anonymous identifier to the trusted data controller computer server, the trusted data controller computer server decrypts the original anonymous identifier of the data subject using its private cryptographic key. Thus, it is impossible for any party using a computer or any computer, other than the data subject and the trusted data controller and their respective computers, to know the anonymous identifier of the data subject and use it to illegally or maliciously retrieve the data subject's data of interest from the trusted data controller computer server and then use the data to violate the privacy rights of the data subject. Even if an intercepting computer could gather a large amount of information of interest, without the data subject’s name or personal identifier it would not be able to identify or correlate to a known person.

[0085] When a personal software application in a personal computing device and a data exchanging software application in a trusted data controller's computer server communicate and transfer data, the communication session is in most cases initiated automatically based on the default preferences present in the personal software application, usually on a daily, weekly or monthly or even longer cycle. The frequency depends on the nature of the data. In the case of healthcare, an appropriate default value is monthly, but if the individual is hospitalized, a more appropriate interval would be daily updates. For this purpose, the data subject can change the update frequency in his personal software application to the desired time interval and can even select the Update Now option button in the personal software application.

[0086] For timed updates, the frequency will be communicated by the personal software application to the data exchange software application in one or more data provider computer servers. For immediate updates, a request will be sent directly to the data exchange software in the trusted data controller computer server to retrieve the most recently acquired data of interest.

[0087] In all embodiments, during the communication of messages containing anonymized data of interest from one or more data provider computer servers to a trusted data controller computer server, and during the registration of new anonymous data subjects in the trusted data controller user registration database, and during the communication of anonymized data of interest from the trusted data controller computer server to the anonymous data subject's personal computing device, the data subject never uses, nor does the personal software application ever require the use of, a traditional user-defined username and system password, which would undesirably identify the data subject. Access to the personal software application may be protected by the use of a local screen lock password stored specifically on the personal computing device, or by biometric means such as fingerprint or facial recognition that resides locally on the personal computing device. Authentication is only and always performed through an anonymous identifier.

[0088] There are a variety of software applications that collect personal data of data subjects, which is the case in healthcare and electronic health record applications. However, such applications are usually associated with healthcare providers or insurance companies and do not cover all data providers that may store records of data subjects. The present application discloses a method and system in which personal data can be collected from anywhere in various situations, where the personal data is stored in multiple participating data provider computer servers and then forwarded in an anonymous form and returned to the personal computing device of the data subject in an organized, easily understandable manner.

[0089] Returning the data subject’s information of interest in a communication session that is always initiated by the data subject’s personal software application and identified by an anonymous identifier resolves the anonymization reversibility / irreversibility paradox and allows a trusted data controller computer server to securely communicate with the data subject’s personal computing device and transmit valuable personal information and scientific knowledge derived from large-scale processing of personal data without knowing the data subject’s name, mobile phone number, email address, or personal computing device address.

[0090] In one embodiment of the present invention, a parent may store a child's information of interest on the parent's personal computing device and then allow the child's information to be removed from the parent's device and transferred to the child's device, such as upon reaching a certain legal age.

[0091] In another embodiment of the present invention applicable to healthcare, the data subject can specify a healthcare professional who will be authorized to receive the data subject's medical records through a personal software application. To do this, the data subject causes the personal software application to send the data subject's anonymous identifier and the name of the healthcare professional to a data exchange software application in a trusted data controller computer server. The healthcare professional will run the application in his computer, which is connected to the same data exchange software application through a communication network. This application in the trusted data controller computer server will receive the data subject's request and the anonymous identifier and the name of the healthcare professional. It will then retrieve the data subject's medical records from its application database and send it to a computer connected to a health data exchange software application whose user identity matches the name of the healthcare professional specified by the data subject. Therefore, the data subject can share the medical health data exchange software application records with the selected healthcare professional, and the data sharing is performed without the trusted data controller computer server knowing the name of the data subject.

[0092] In another embodiment, the personal software application is configured to detect the presence of the same personal software application installed in other personal computing devices of other data subjects in the vicinity, and via Wi-Fi or Bluetooth, the personal software applications broadcast, receive and store each other's encrypted anonymous identifiers. This embodiment is particularly useful in epidemic situations, where the identity of everyone in the vicinity of an infected person needs to be known, preferably anonymously, in order to contact each relevant person and send relevant recommendations to their personal software applications.

[0093] Another embodiment relates to a personal software application, during the installation process of which a known authentication computer server is first contacted to absolutely guarantee that the data subject is indeed the person indicated by his name, and not another person who attempts to impersonate the data subject to illegally obtain the data subject's personal information of interest. Only when the authentication is verified, as described in patent application PT115.304, can the personal software application successfully complete its installation in the personal computing device through the authentication computer server message allowing it. The authentication computer server can also store a list of data provider computer servers that may store the data subject's information of interest. In this case, the authentication computer server can be programmed to ensure that the user registration data of the data subject is distributed to all participating data provider computer servers. This frees the personal computing device from being bound by the potentially lengthy data subject registration process. This possible role of the authentication computer server does not substantially change the present disclosure, because after verifying the identity of the data subject, it transmits the data to the data provider computer server in exactly the same way as described herein for data exchange and transmission between the personal computing device and one or more data provider computer servers. The way to control the secure exchange of data in this embodiment can include asymmetric encryption keys, digital signatures, hash functions, and blockchains.

[0094] Another embodiment relates to the possibility of recovering the data subject's information of interest in the event that the data subject's personal computing device is lost, destroyed, stolen, reinstalled or upgraded. Here, a new personal computing device can be used, the personal software application can be re-downloaded and installed, a new anonymous identifier can be generated and the data subject's computer user account can be recovered, restarting the data flow process through one or more data provider computer servers and allowing the previously existing information of interest stored in the trusted data controller computer server to be re-associated with the new data subject anonymous identifier without transmitting or revealing the data subject's name identity or personal identifier to the trusted data controller computer server. This recovery method includes the computer storing at least the data subject's name, personal identifier and the original encrypted anonymous identifier before the recovery process. Therefore, the data provider computer server and the authentication computer server can be useful in this recovery. BRIEF DESCRIPTION OF THE DRAWINGS

[0095] Figure 1a is a block diagram of a system architecture for downloading and installing personal software applications into a personal computing device according to an example embodiment of the present disclosure.

[0096] Figure 1bis a block diagram of a computer system architecture for connecting a personal computing device, a data provider computer server, a trusted data controller computer server, and establishing communications between all of them according to an example embodiment of the present disclosure.

[0097] Figure 2 is a block diagram of a personal computing device according to an example embodiment of the present disclosure.

[0098] Figure 3 is a block diagram of a data provider computer server according to an example embodiment of the present disclosure.

[0099] Figure 4 is a block diagram of a trusted data controller computer server according to an example embodiment of the present disclosure.

[0100] Figure 5 is a flow chart of a program flow that begins with the installation of a personal software application in a personal computing device and ends with the transmission of information of interest to a trusted data controller computer server according to an example embodiment of the present disclosure.

[0101] Figure 6 is a flow chart of a program flow that begins with a data exchange request transmission by a personal software application and ends with a data subject accessing and using personal information of interest in his or her personal computing device according to an example embodiment of the present disclosure.

[0102] Throughout the drawings, like numbers refer to like elements and features throughout the description. DETAILED DESCRIPTION

[0103] exist Figure 1a In the embodiment of the present invention, a data subject connects his personal computing device to a public mobile digital communication network, such as the GSM system, for example, or to the Internet, or to any other communication network - collectively referred to as a communication network. The data subject then downloads and installs a personal software application 100 and a cryptographic software module 101 to his personal computing device 110. The personal software application 100 and the cryptographic software module 101 are downloaded from an appropriate software distribution system 105, such as the AppStore or Google Play, or an Internet website to which the data subject connects using his personal computing device 110. The data subject becomes aware of the personal software application 100 by word of mouth, social networks or traditional advertising, identifying it as a personal software application published by a trusted data controller to securely collect personal data relating to the data subject.

[0104] exist Figure 1bIn, once the download has occurred, installation of the personal software application 100 occurs and the data subject enters at least his name and may enter other personal identifiers and agree to the terms. The personal software application 100 generates an anonymous identifier and its encrypted version using the known public key of the trusted data controller.

[0105] The personal software application 100 of the personal computing device 110 sends the entire data message - the data entered by the data subject and the encrypted anonymous identifier - to one or more data provider computer servers 120 known to the personal software application, which may hold personal data related to the data subject. The one or more data provider computer servers 120 include a data exchange software application 125, which is configured to securely exchange data with the personal software application 100 and store it.

[0106] The data exchange software application 125 searches the application database of the data provider computer server 120 and extracts the information of interest related to the data subject. The data exchange software application 125 anonymizes the information of interest by removing the name and personal identifiers and replacing them with the encrypted anonymous identifier of the data subject and transmits it to the trusted data controller computer server 130. The server 130 also includes a data exchange software application 135, which is configured to securely exchange data with the data exchange software application 125 in one or more data provider computer servers 120. This extraction, anonymization and transmission of data then occurs periodically under the control of the data exchange software application 125 running in one or more data provider computer servers 120.

[0107] The data exchange software application 135 in the trusted data controller computer server 130 receives the data message from the data exchange software application 125 in the data provider computer server 120 , including the anonymized information of interest and the encrypted anonymous identifier.

[0108] The data exchange software application 135 decrypts or verifies the anonymous identifier of the data subject and stores the anonymized information of interest. The data exchange software application 135 of the trusted data controller computer server 130 transmits the newly received information of interest to the personal software application 100 in the personal computing device 110 of the data subject, who is identified by the same anonymous identifier as the anonymized information of interest, at regular intervals.

[0109] exist Figure 2, the personal computing device 110 is illustrated in terms of its basic hardware and software components. The personal computing device 110 includes a main processor 200, a communication subsystem 210 designed to communicate with all data provider computer servers 120 and trusted data controller computer servers 130 via a communication network, an input device 220, a display 230, and a storage media subsystem 235 that stores computer programs and data. The processor 200 interacts with a memory 240 containing computer programs and data retrieved from the media storage subsystem 235. The processor 200 loads program instructions 250, personal software applications 100, cryptographic software modules 101, and data from files and application databases storing information of interest 280 received from the trusted data controller computer servers 130 into the memory 240 as needed.

[0110] Figure 3 The basic hardware and software components of one or more data provider computer servers are illustrated.

[0111] One or more of the data provider computer servers 120 include a main processor 300, a communication subsystem 310 (designed to communicate with all data subject personal computing devices 110 and trusted data controller computer servers 130 via a communication network), an input device 320, a display 330, and a storage media subsystem 335 that stores computer programs and data. The processor 300 interacts with a memory 340 containing computer programs and data retrieved from the media storage subsystem 335. The processor 300 loads program instructions 350, data exchange software applications 125, cryptographic software modules 301, user registration databases 370, application databases 380 (containing identified personal data of data subjects), and transaction log files 390 (containing communication metadata from all data exchange sessions, including at least the identity of the originating computer and the timestamp of the data exchange events) into the memory 340 as required.

[0112] Figure 4 Diagram showing the basic hardware and software components of a trusted data controller computer server.

[0113] The trusted data controller computer server 130 comprises a main processor 400, a communication subsystem 410 (designed to communicate with the data subject personal computing device 110 and the data provider computer server 120 via a communication network), an input device 420, a display 430 and a storage medium subsystem 435 storing computer programs and data. The processor 400 interacts with a memory 440 containing computer programs and data retrieved from the media storage subsystem 435. The processor 400 loads into the memory 440 program instructions 450, the data exchange software application 135, the cryptographic software module 401, the user registration database 470, the application database 480 containing anonymized information of interest for the data subject, the transaction log file 490 (containing communication metadata from all data exchange sessions including at least the identity of the originating computer and the timestamp of the data exchange event), and the data science software application 495. In use, it is this data science software application that will process the anonymized information of interest stored in the application database 480 on a very large scale to produce the previously described reports from which new information and new knowledge is derived. These reports will have significant economic value and, in some areas, such as health care, considerable public interest.

[0114] Now it will pass Figure 5 and Figure 6 Detailed explanation of the flowchart in Figure 1a , Figure 1b , Figure 2 , Figure 3 and Figure 4 The program steps are numbered by numbers in the 500 and 600 series, but also refer to elements of the previous figures.

[0115] Figure 5 The process of registering a data subject in the computer system of the present disclosure is shown, and how data of interest is collected from one or more data provider computer servers 120 and transmitted to a trusted data controller computer server 130. In step 500, the data subject downloads the personal software application 100 and the associated cryptographic software module 101 from a suitable application distribution service or website 105 to his personal computing device 110. During the installation process, the data subject enters personal identification data into the personal software application 100 via the input device 220, such as name, gender, date of birth, address, zip code, and personal identifiers such as national identification number, driver's license number, social security number or tax number - as many as possible, which will facilitate the subsequent retrieval of personal data in the data provider computer server.

[0116] Where required by law protecting personal data, the data subject indicates to the personal software application 100, through the data input device 220, that he or she consents to have his or her personal data retrieved from any data provider computer server 120 where it may be stored, transferred to and processed by the trusted data controller computer server 130. Typically, the personal software application 100 will be developed and published by a specific trusted data controller, and will be configured to display the name of that trusted data controller on the screen of the personal computing device 110 so that the data subject is fully aware of whose computer system his or her anonymous personal data will be transferred or copied. The data subject may also use the input device 220 to enter any preference or option data requested by the personal software application 100.

[0117] Once the data entry phase is complete, the cryptographic software module 101 in the personal computing device 110 generates an anonymous identifier and an encrypted version thereof in step 510. The anonymous identifier may be generated using a symmetric key system or an asymmetric key system, depending on the embodiment and the level of security required, but regardless of the system employed to generate it, the anonymous identifier and the encrypted anonymous identifier will always be associated with the originating data subject and will identify all personal data subsequently retrieved in one or more data provider computer servers 120 and transmitted to the trusted data controller computer server 130 as an identification key.

[0118] In a general embodiment, when a symmetric cryptographic key is used, an advanced encryption standard included in the cryptographic software module 101 of the personal computing device 110 may be used to generate an anonymous identifier to implement the functionality of the cryptographic key.

[0119] In an asymmetric key embodiment, a preferred system using an elliptic curve digital signature algorithm generates asymmetric cryptographic keys. A private key will be randomly generated by the cryptographic software module 101 in the personal computing device 110, and the cryptographic software module 101 will mathematically derive a public cryptographic key from the private key. This public key will also be an anonymous identifier for the data subject. The cryptographic software module 101 then selects the generated public key / anonymous identifier and uses the known public cryptographic key of the trusted data controller computer server 130 or uses any other cryptographic or transformation method described in this disclosure to produce an encrypted version. The public key of the trusted data controller computer server 130 is publicly known and it is stored in the cryptographic software module 101 in the personal computing device 110. This means that if the encrypted public key of the data subject is transmitted to other computers or intercepted by other computers and the other computers have no way to decrypt the encrypted anonymous identifier, they will never know the original anonymous identifier of the data subject. Therefore, when used as Figure 5When a portion of the initial registration process described in is transmitted to one or more data provider computer servers 120, the data provider computer servers 120 are prevented from knowing the clear text anonymous identifier of the data subject and therefore being unable to use its function as an identification, authentication and encryption key.

[0120] In step 520, the personal software application 100 in the personal computing device 110 contacts all participating data provider computer servers 120 that hold data of interest to the data subject, such as health records, tax records, transaction records, financial records, consumer preferences - any information that may be private or sensitive in nature - and which are stored in the application database 380. This contact is performed using a communications network. The electronic addresses of the data provider computer servers 120 may be written to a list stored in the personal computing device 110 and accessed by the personal software application 100, or the personal software application 100 may contact a trusted network server (not shown) from which it can retrieve an up-to-date list of the electronic addresses of the participating data provider computer servers 120.

[0121] The personal software application 100 and the data exchange software application 125 in one or more data provider computer servers 120 are configured to exchange data securely with each other. The data exchange software application 125 will be developed by a trusted data controller. This is the first time that the personal software application 100 contacts the data provider computer server 120.

[0122] After the connection is established, the personal software application 100 sends the data subject's name, personal identification data, personal identifier, optional consent terms, optional data access request, optional personal preferences and encrypted anonymous identifier to the data exchange software application 125 in the data provider computer server 120.

[0123] In step 530, the data exchange software application 125 in one or more data provider computer servers 120 receives the data subject's transmitted identification data and stores it in their user registration database 370 located in one or more data provider computer servers 120. Thus, the user registration database 370 will record the data subject's name, all personal identifiers, optional consent terms, optional data transfer requests, optional user preferences, and encrypted anonymous identifiers.

[0124] Once the process has concluded, the data exchange software application 125 sends a message to the personal software application 100 that the registration process is concluded at that particular data provider computer server 120 .

[0125] The personal software application 100 then selects the following data provider computer server in the data provider computer server list and restarts the user registration process at all data provider computer servers 120 until the data subject is registered as a new user at all data provider computer servers 120 in the list.

[0126] The data exchange software application 125 searches the application database 380 in the one or more data provider computer servers 120 and uses the data subject's name and personal identifier to locate and collect therefrom all personal data of interest associated with the identified data subject.

[0127] In step 540, upon finding the data of interest and placing it in the data provider computer server's memory 340, the data exchange software application 125 removes the data subject's name and any and all personal identifiers and replaces them with the data subject's encrypted anonymous identifier. Thus, the subject's data of interest is stripped of any personally identifying elements and is therefore anonymized and de-identified.

[0128] In step 550, the data exchange software application 125 in the one or more data provider computer servers 120 then contacts the data exchange software application 135 located in the trusted data controller computer server 130 via the communication network. Once contact is established, the data exchange software application 125 in the data provider computer server 120 sends the data subject's de-identified, anonymized information of interest, optional consent terms, optional data access and transfer requests, optional user preferences, and the data subject's encrypted anonymous identifier to the data exchange software application 135 in the trusted data controller computer server 130. The data exchange software application 125 records the transmission metadata (at least the identity of the communicating computers and a timestamp of the data exchange) in the log file 390 of the one or more data provider computer servers 120.

[0129] It will be noted that the data subject's name and personal identifier are not transmitted to the trusted data controller computer server 130. Then, whenever new data of interest - new medical records, new tax records, new financial records, etc. - is acquired by the application database 380 in one or more of the data provider computer servers 120, the transmission of the anonymized data of interest occurs periodically, as long as the data subject's consent has not been revoked in the personal software application 100 and transmitted to the data exchange software application 125. The data exchange software application 125 is configured to perform this periodic search, anonymize the data of interest, and transmit the data of interest to the trusted data controller computer server 130. In order to transmit only the most recent information of interest, the data exchange software application 125 will refer to the metadata of the previous transmission contained in the log file 390 and transmit only the information of interest obtained after that event.

[0130] In step 560, the trusted data controller server 130 receives the transferred data from one or more data provider computer servers 120. The data exchange software application 135 records the transfer metadata (at least the identity of the computer and a timestamp of the data exchange) in a log file 490 of the trusted data controller computer server 130.

[0131] Upon receiving a data message from one or more data provider computer servers 120, the data exchange software application 135 in the trusted data controller computer server 130 must first read the encrypted anonymous identifier. In a general embodiment, the anonymous identifier will be decrypted by the cryptographic software module 401 using a method corresponding to the method used to originally encrypt it. In an asymmetric key embodiment, the cryptographic software module 401 reads the encrypted anonymous identifier of the data subject and decrypts it using the private key of the trusted data controller computer server 130, thereby obtaining the original anonymous identifier of the data subject and its public key.

[0132] In step 570, the trusted data controller computer server 130 uses the now decrypted anonymous identifier to determine if the data subject is new. The data exchange software application 135 searches the user registration database 470 located in the trusted data controller computer server 130 and compares the received anonymous identifier with the anonymous identifiers stored in the user registration database 470.

[0133] In step 575, if no match is found, a new entry is recorded in the user registration database 470 in the trusted data controller computer server 130, including the data subject's anonymous identifier, optional consent terms, optional data transfer request, optional user preferences, and metadata of the transfer recorded in the log file 490 located in the trusted data controller computer server 130. The computer program flow continues to step 580.

[0134] If a match is found or on program flow continuing from step 575, then in step 580 the data subject has been recorded in the user registration database 470 of the trusted data controller computer server 130 and the data exchange software application 135 records the data subject's anonymized data of interest in the application database 480 of the trusted data controller computer server 130, identified only by the data subject's anonymous identifier.

[0135] After several data transfer events, the trusted data controller computer server 130 stores a large amount of anonymized personal information of interest related to the data subject in its application database 480. Therefore, the trusted data controller computer server 130, without any personally identifiable information about the data subject - no name, no personal identifier, no mobile phone number, no email address - has no address to contact and establish communication with the personal software application 100 in the data subject's personal computing device 110 and return the information of interest that it obtains regularly from multiple data provider computer servers 120. The trusted data controller computer server 130 has no way to contact the personal computing device 110 and re-identify the data subject, which prevents the data subject's identified personal data from being accessed by computer by accident, negligence or malicious intent. The disclosure presented in the following figure provides a computer system that is configured to access and process the personal data of the data subject in a manner that does not violate their privacy rights.

[0136] Figure 6 It is shown how the data of interest is returned anonymized to the personal software application 100 in the personal computing device 110 of the anonymous data subject once all steps 500 to 580 are successfully performed.

[0137] In step 600, it is the personal software application 100 in the personal computing device 110 that opens a communication session over the communication network with the data exchange software application 135 of the trusted data controller computer server 130. This is possible because the personal software application 100 has the electronic address of the trusted data controller computer server 130 and is configured to contact it regularly.

[0138] In step 610, the personal software application 100 sends a data exchange request to the data exchange software application 135 of the trusted data controller computer server 130, including the anonymous identifier of the data subject, preferably encrypted in the form of a digital signature. The metadata (anonymous identifier and timestamp) of the data exchange software application 135 communication session will be recorded in the log file 490 of the trusted data controller computer server 130.

[0139] In step 620, the data exchange software application 135 in the trusted data controller computer server 130 reads the anonymous identifier and its digital signature (if present) and must determine if it is a valid request.

[0140] In step 630, the data exchange software application 135 searches the user registration database 470 located in the trusted data controller computer server 130 and compares the received anonymous identifier with the anonymous identifiers stored in the user registration database 470. If it is a digital signature, the cryptographic software module 401 verifies it using the received anonymous identifier as the decryption key of the digital signature.

[0141] In step 635, if there is no match between the received anonymous identifier and any stored anonymous identifier, then the received anonymous identifier is invalid. In the event that the decrypted digital signature is different from the received anonymous identifier, the request is also invalid. The data exchange software application 135 of the trusted data controller computer server 130 stops responding to the personal software application 100 in the communication session.

[0142] In step 640, if there is a match between the received anonymous identifier and any stored anonymous identifiers, or if the decrypted digital signature matches the received anonymous identifier, then the received anonymous identifier and data exchange request are valid.

[0143] The data exchange software application 135 searches the application database 480 in the trusted data controller computer server 130 for the anonymized data of interest identified by the verified anonymous identifier and obtains the most recent data of interest of the anonymous data subject by referring to the log file 490 containing the dates of previous communication sessions between the data subject's personal software application 100 and the data exchange software application 135 in the trusted data controller computer server 130.

[0144] In step 650 , the data exchange software application 135 in the trusted data controller computer server 130 sends the most recent information of interest to the personal software application 100 in the personal computing device 110 .

[0145] In step 660 , the personal software application 100 receives the information of interest, organizes it and stores it in the information of interest database 280 in the personal computing device 110 of the data subject.

[0146] In step 670 , the data subject opens the personal software application 100 in his personal computing device 110 and views and uses the information of interest 280 .

[0147] It should be appreciated that in the case where the information of interest includes very large files, which is the case when images and photographs are transferred, the transfer time may be very long. In order to shorten the transfer time of such a large file, the data exchange software application 135 in the trusted data controller computer server 130 may transfer the link address of the file stored in the application database 480 of the trusted data controller computer server 130 to the personal software application 100 instead of transferring the large file. In this embodiment, whenever the data subject wishes to view and use these large files, selecting the link address in the personal software application 100 automatically triggers the data exchange request and anonymous identifier verification process described in steps 610 to 640, and the large file is then actually transferred by the data exchange software application 135 in the trusted data controller computer server 130 to the information of interest database 280 for display in the personal software application 100. In similar embodiments, this bandwidth saving process can be used for all regular transfers of data of interest between the personal software application 100 of the data subject and the data exchange software application 135 in the trusted data controller computer server 130.

[0148] Thus, the trusted data controller computer server 130 is able to collect anonymized data of interest from multiple data provider computer servers 120 and transmit it to its legitimate but anonymous owner's personal software application 100. This represents an advancement in protecting the privacy rights of data subjects when exchanging personal data.

[0149] As the application database 480 acquires more interesting information from a large number of data subjects running personal software applications 100 in the data subject's personal computing device 110 and from all participating data provider computer servers 120, the trusted data controller computer server 130 is able to build up a very large application database 480 and perform large-scale computer processing of anonymous data, using data science software applications 495 to obtain new information from the stored data using techniques such as statistical processing, big data processing, machine learning and artificial intelligence. This is particularly relevant in the case of health data and healthcare, establishing new relationships between drugs, treatments and therapies and quantifying their impact on each individual or class of individuals, leading to precision medicine using real-world data and better personal and public health. This is also useful for businesses that identify consumer preferences, purchasing patterns or social interactions from large-scale processing of personal data, but do not know the name of the data subject. Such useful processing is only possible if a large amount of personal data is collected in a computer. The present invention allows the accumulation of such a large amount of personal data in a way that prevents the computer processing the personal data from associating the data with an identified person, and thus solves the problem of protecting the privacy rights of people whose personal data are processed by these computers.

[0150] Although specific embodiments of the systems and methods of the present invention have been shown in the accompanying drawings and described in the foregoing detailed description, it will be understood that the present invention is not limited to the disclosed embodiments, i.e., in the use of more or less cryptographic means and various combinations thereof, but is capable of various rearrangements, modifications and substitutions without departing from the spirit of the present invention.

Claims

1. A method, the method using a personal software application (100) installed on a personal computing device (110) of a data subject to perform a login process for the data subject to a trusted data controller computer server (130), and returning information of interest to the data subject to the personal software application (100) of the data subject by the trusted data controller computer server (130), wherein the data subject uniquely identifies itself via an encrypted anonymous identifier, the method comprising the following steps: a. the data subject downloads and installs the personal software application (100) and the cryptographic software module (101) in his personal computing device (110) and enters at least the personal name and personal identifier and optional consent, b. the cryptographic software module (101) in the personal computing device (110) generates an anonymous identifier and an encrypted version of the anonymous identifier, c. the personal software application (100) in the personal computing device (110) contacts a data exchange software application (125) in one or more data provider computer servers (120) storing data related to the data subject, the data provider computer servers (120) and the data exchange software application (125) being configured to securely exchange data and transmit the data subject's name, personal identifier, encrypted anonymous identifier and the optional consent to the data exchange software application (125) receiving the data subject's name, personal identifier, encrypted anonymous identifier and the optional consent, d. the data exchange software application (125) of the one or more data provider computer servers (120) receiving and recording at least the name, personal identifier, encrypted anonymous identifier and the optional consent of the data subject and searching the data provider computer server (120) application database (380) for data related to the data subject by means of the name and personal identifier of the data subject, e. Upon finding the data of interest, the data exchange software application (125) of the one or more data provider computer servers (120) creates a message and adds the data of interest, the encrypted anonymous identifier of the data subject to the message, and removes the name and all personal identifiers of the data subject to anonymize the data of interest, f. the data exchange software application (125) of the one or more data provider computer servers (120) transmitting a message containing the anonymized data of interest identified only by the encrypted anonymous identifier of the data subject to the trusted data controller computer server (130), g. the data exchange software application (135) in the trusted data controller computer server (130) being configured to securely exchange data with the data exchange application of one or more data provider computer servers (120), receive the message and read the message, decrypt the encrypted anonymous identifier to obtain the original anonymous identifier, verify whether the anonymous identifier has been recorded in a user registration database (470) located in the trusted data controller computer server (130), and i. upon failure to find the anonymous identifier, recording the anonymous identifier as a new user in the user registration database (470), recording the anonymous identifier and message metadata in a log file (490), and storing at least the data subject's anonymized data of interest and the anonymous identifier in an application database (480) of the trusted data controller computer server (130), the anonymized data of interest being identified only by the data subject's anonymous identifier, or ii. upon finding the anonymous identifier, recording the anonymous identifier and the message metadata in a log file (490) and storing at least the anonymized data of interest of the data subject in an application database (480) of the trusted data controller computer server (130), the anonymized data of interest being identified only by the anonymous identifier of the data subject, h. the transmission of said anonymized data of interest occurs periodically between said data exchange software application (125) of said one or more data provider computer servers (120) and said data exchange software application (135) of said trusted data controller computer server (130), so that new anonymized data of interest related to the same data subject is continuously added to said application database (480) in said trusted data controller computer server (130), i. the personal software application in the personal computing device (110) of the data subject and the data exchange software application (135) of the trusted data controller computer server (130) are configured to communicate securely with each other, establish communication, and the data exchange software application (135) of the trusted data controller computer server (130) transmits the anonymized data of interest to the personal software application (100) in the personal computing device (110), thereby returning the anonymized data to the data subject, wherein the transmission of the anonymized data of interest between the trusted data controller computer server (130) and the personal computing device (110) of the data subject occurs by way of a communication session that is always initiated by the personal software application (100) in the personal computing device (110) of the data subject to connect to a known electronic address of the trusted data controller computer server (130), and wherein the data exchange software application (135) in the trusted data controller computer server (130) must wait for the communication session to be initiated by the personal software application (100), the trusted data controller computer server (130) being blocked from initiating such a communication session without any information about the data subject's name, personal identifier or electronic address of the personal computing device (110).

2. A method as claimed in claim 1, wherein the communication session between the personal software application (100) in the personal computing device (110) of the data subject and the data exchange software application (135) in the trusted data controller computer server (130) is initiated by the personal software application (100) sending a data exchange request uniquely identified by the anonymous identifier or digital signature of the data subject, the data exchange software application (135) receiving the data exchange request and confirming that a valid request has been received and that the stored anonymous identifier and the received anonymous identifier correspond to the same data subject.

3. A method as claimed in claim 1, wherein the anonymous identifier is generated by a cryptographic software module (101) in the personal computing device (110) as an asymmetric public key, the asymmetric public key being extracted from a randomly generated private cryptographic key and encrypted using the cryptographic software module (101) with the aid of a known public cryptographic key of the trusted data controller computer server (130), and the personal software application (100) transmits the at least the name of the data subject, the personal identifier and the encrypted anonymous identifier to each data provider computer server (120), the data exchange software application (125) in the one or more data provider computer servers (120) receiving the encrypted anonymous identifier and including the encrypted anonymous identifier in a message containing the anonymized data of interest, transmitting it to the data exchange software application (135) of the trusted data controller computer server (130), the cryptographic software module (101) in the trusted data controller computer server (130) receiving and decrypting the encrypted anonymous identifier with the aid of the private cryptographic key of the trusted data controller computer server (130).

4. The method of claim 1, wherein the anonymous identifier is an identification key, an authentication key, and a cryptographic key.

5. A method as claimed in claim 1, wherein the cryptographic software module (101) for encrypting communications between the data subject personal computing device (110), the one or more data provider computer servers (120) and the trusted data controller computer server (130) uses an asymmetric cryptographic key, preferably an elliptic curve digital signature algorithm.

6. A method as claimed in claim 1, wherein the personal software application (100) in the personal computing device (110) of the data subject opens a communication session with the data exchange software application (135) in the trusted data controller computer server (130) at a default time interval configured in the personal software application (100), or at a preferred time interval configured by the data subject, or at any time under the command of the data subject.

7. A method as claimed in claim 1, wherein the transmission of a message containing anonymized data of interest from the one or more data provider computer servers (120) to the trusted data controller computer server (130), or the registration of a new data subject in the trusted data controller user registration database, or the transmission of the anonymized data of interest from the trusted data controller to the data subject's personal computing device (110), occurs without the data subject using a traditional user-defined username and system password stored in any computer server, and the data exchange software application (125) in the trusted data controller computer server (130) verifies the identity of the data subject only by means of the data subject's anonymous identifier.

8. A method as claimed in claim 1, wherein the personal data of the data subject is collected from the application database (380) in the one or more data provider computer servers (120), anonymized and transmitted to a trusted data controller computer server (130), where the personal data is collected and organized under the identity of the data subject's anonymous identifier and returned by the data exchange software application (135) in the trusted data controller computer server (130) to the personal software application (100) in the personal computing device (110) of the data subject.

9. A non-transitory computer medium storing source code which, when executed by a processor, performs a method for executing a login process for a data subject to a trusted data controller computer server (130) using a personal software application (100) installed on a personal computing device (110) of the data subject, and returning information of interest to the data subject to the personal software application (100) of the data subject by the trusted data controller computer server (130), wherein the data subject uniquely identifies itself via an encrypted anonymous identifier, the method comprising the following steps: a. the data subject downloads and installs the personal software application (100) and the cryptographic software module (101) in his personal computing device (110) and enters at least the personal name and personal identifier and optional consent, b. the cryptographic software module (101) in the personal computing device (110) generates an anonymous identifier and an encrypted version of the anonymous identifier, c. the personal software application (100) in the personal computing device (110) contacts a data exchange software application (125) in one or more data provider computer servers (120) storing data related to the data subject, the data provider computer servers (120) and the data exchange software application (125) being configured to securely exchange data and transmit the data subject's name, personal identifier, encrypted anonymous identifier and the optional consent to the data exchange software application (125) receiving the data subject's name, personal identifier, encrypted anonymous identifier and the optional consent, d. the data exchange software application (125) of the one or more data provider computer servers (120) receiving and recording at least the name, personal identifier, encrypted anonymous identifier and the optional consent of the data subject and searching the data provider computer server (120) application database (380) for data related to the data subject by means of the name and personal identifier of the data subject, e. Upon finding the data of interest, the data exchange software application (125) of the one or more data provider computer servers (120) creates a message and adds the data of interest, the encrypted anonymous identifier of the data subject to the message, and removes the name and all personal identifiers of the data subject to anonymize the data of interest, f. the data exchange software application (125) of the one or more data provider computer servers (120) transmitting a message containing the anonymized data of interest identified only by the encrypted anonymous identifier of the data subject to the trusted data controller computer server (130), g. the data exchange software application (125) in the trusted data controller computer server (130) being configured to securely exchange data with the data exchange application of one or more data provider computer servers (120), receive the message and read the message, decrypt the encrypted anonymous identifier to obtain the original anonymous identifier, verify whether the anonymous identifier has been recorded in a user registration database located in the trusted data controller computer server (130), and i. upon failure to find the anonymous identifier, recording the anonymous identifier as a new user in the user registration database, recording the anonymous identifier and message metadata in a log file (490), and storing at least the data subject's anonymized data of interest and the anonymous identifier in an application database (480) in the trusted data controller computer server (130), the anonymized data of interest being identified only by the data subject's anonymous identifier, or ii. upon finding the anonymous identifier, recording the anonymous identifier and the message metadata in a log file (490) and storing at least the anonymized data of interest of the data subject in an application database (480) in the trusted data controller computer server (130), the anonymized data of interest being identified only by the anonymous identifier of the data subject, h. the transmission of said anonymized data of interest occurs periodically between said data exchange software application (125) of said one or more data provider computer servers (120) and said data exchange software application (135) of said trusted data controller computer server (130), so that new anonymized data of interest related to the same data subject is continuously added to said application database (480) in said trusted data controller computer server (130), i. the personal software application (100) in the personal computing device (110) of the data subject and the data exchange software application (135) of the trusted data controller computer server (130) are configured to communicate securely with each other, establish communication, and the data exchange software application (135) of the trusted data controller computer server (130) transmits the anonymized data of interest to the personal software application (100) in the personal computing device (110), thereby returning the anonymized data to the data subject, wherein the transmission of the anonymized data of interest between the trusted data controller computer server (130) and the personal computing device (110) of the data subject occurs by way of a communication session that is always initiated by the personal software application (100) in the personal computing device (110) of the data subject to connect to a known electronic address of the trusted data controller computer server (130), and wherein the data exchange software application (135) in the trusted data controller computer server (130) must wait for the communication session to be initiated by the personal software application (100), the trusted data controller computer server (130) being blocked from initiating such a communication session without any information about the data subject's name, personal identifier or electronic address of the personal computing device (110).

10. A computer system for data anonymization, the computer system comprising: a. A personal computing device (110) having a cryptographic software module (101) configured to generate an anonymous identifier of a user and an encrypted version thereof; b. a plurality of data provider computer servers (120) configured to receive personal data from the personal computing device, the personal data comprising a user's name and an encrypted anonymous identifier, store the personal data in a user registration database, search for the user data in an application database (380), and replace the user's name with the encrypted anonymous identifier to create anonymized data; and c. a trusted data controller computer server (130) configured to receive the anonymized data and the encrypted anonymous identifiers from the plurality of data provider computer servers (120); The trusted data controller computer server (130) is configured to wait for and respond to a valid data exchange request from a personal software application (100) of the personal computing device (110) identified by the user's anonymous identifier.

Images