Personal data protection system

Abstract

Personal Data Protection Device The present invention relates to a personal data protection device (1) comprising: a data storage system (70) such as a computer cloud, arranged to store a plurality of identification keys, at least one of the keys being formed by a set of partial identification data based on a person's bodily and / or physiological characteristics, these bodily and / or physiological characteristics possibly including a vital sign such as the person's heart rate or respiratory rate, each identification key being associated with a set of a person's personal data stored in this storage system, the keys and the personal data being anonymous in themselves. Figure for the abstract: Fig. 1

Description

Title of the invention: Personal data protection device

[0001] The present invention relates to a device for protecting personal data.

[0002] The detection of potential COVID 19 patients is currently carried out by taking temperatures and / or additional measures.

[0003] These measurements and the storage of data resulting from them can only be carried out subject to the consent given by the person. It is essential to keep this consent information which is useful in the event, for example, of a dispute by the person.

[0004] It is also essential to keep this consent information, as well as the personal data from the measurements, secure, as this data relates to health.

[0005] The invention makes it possible in particular to meet these needs.

[0006] The invention thus relates to a device for protecting personal data comprising: - a data storage system such as a cloud computing system, arranged to store a plurality of identification keys, at least one of the keys being formed by a set of fragmented identification data based on bodily and / or physiological characteristics of a person, these bodily and / or physiological characteristics being able in particular to include a vital sign such as the heart rate or the respiratory rate of the person, each identification key being associated with a set of personal data of a person stored in this storage system, the keys and the personal data being in themselves anonymous, - a system for measuring bodily and / or physiological characteristics of a person, - a data processing unit designed for: • obtain, using the measuring system, measured data of bodily and / or physiological characteristics of a person, • check whether these measured data and possibly additional required data correspond to the set of parcel identification data of one of the identification keys, • in case of correspondence with one of the identification keys, allow access to personal data associated with this identification key.

[0007] "Personal data" refers to data relating to a person, such as, for example, information on consent that the person has given to carry out vital sign measurements. The protection device according to the invention makes it possible to store personal data anonymously, i.e. even access to this data alone does not make it possible to associate this personal data with an identified person. The association of this personal data with a person must involve measurements of bodily and / or physiological characteristics on the person and a verification of the correspondence with an identification key.

[0008] The identification data are said to be fragmentary in the sense that these data taken individually are insufficient to achieve the correspondence between the identification key and the person. It is necessary to use all the identification data to achieve this correspondence. Each fragmentary identification data is, for example, common to a large number of identification keys stored in the storage system, which does not allow a correspondence to be made between this fragmentary identification data and one of the keys. For example, the number of stored keys may be greater than 500 keys, or 1,000 keys, or even 10,000 or 100,000 keys. Each fragmentary identification data, for example a heart rate value or a hair color, may be common to at least 5% of the total number of keys, which may represent, in certain cases, hundreds or thousands of keys.

[0009] In the invention, the identification key is itself anonymous.

[0010] The keys and personal data are in themselves anonymous in the sense that they do not contain any element allowing the direct identification of the person who is linked to this key and this personal data.

[0011] The invention thus provides a high level of protection of personal data, insofar as a plurality of fragmentary identification data is used (which therefore requires the use of a plurality of data and not just one) and the correspondence with an identification key requires the physical presence of the person in front of the measuring system. The physical presence of the person in front of the measuring system makes it possible to carry out thermal and / or sound measurements and / or measurements of physical appearance characteristics on the person.

[0012] In its absence, it is not possible to carry out these measurements and to say to which person which personal data stored in the data protection device belongs.

[0013] The invention makes it possible to link personal data to individuals without having to store highly sensitive data such as names, security numbers social media or facial photos, data that could be stolen from the storage system.

[0014] Thanks to the invention, even if a hacker gains access to the storage system, this hacker would not find any sensitive data such as names, social security numbers or facial photos, or the possibility of associating personal data with a given person.

[0015] The invention makes it possible to ensure the conservation of consent information anonymously. This conservation allows the traceability of this consent information, since the invention makes it possible to find this information within anonymous data, following measurements on the person. For example, if a person contests the storage of data on the grounds that they did not give their consent, it is possible to find, or not, this consent information.

[0016] According to one aspect of the invention, the set of fragmentary identification data which forms each identification key comprises at least some of the personal data.

[0017] In other words, personal data can be used to form the identification key.

[0018] According to one aspect of the invention, the storage system does not store any data chosen from: names, social security numbers, facial photos.

[0019] According to one aspect of the invention, the number of keys stored in the storage system is greater than 500 keys, or 1,000 keys, or even 10,000 or 100,000 keys.

[0020] According to one aspect of the invention, each piece of partial identification data, for example a heart rate value or a hair color, may be common to at least 5% or at least 10% of the total number of keys.

[0021] According to one aspect of the invention, each identification key is composed of a number of partial identification data between 5 and 30, in particular between 4 and 7 or between 7 and 15.

[0022] According to one aspect of the invention, the parcel identification data are chosen from the following list: height, weight, build, body posture, skull shape, gestures, age, eye color, - the phenotype, - a path of the person's center of gravity, - an element of the person's voice, - a vital sign such as respiratory rate, heart rate, oximetry rate.

[0023] According to one aspect of the invention, the system for measuring bodily and / or physiological characteristics is arranged to measure at least one of the bodily and / or physiological characteristics on a person with a low resolution, for example the heart rate being measured with a low resolution resulting in a result having a relatively high predetermined margin of error. For example, the heart rate or heartbeat may have a resolution of less than 10%. Thus a heartbeat value at 50 bpm (50 beats per minute) is given with an uncertainty of 5 bpm. In another example, a height value may be 175 cm with an uncertainty of 5 cm. For example again, a thermal image may have a relatively poor resolution.

[0024] This makes it possible to further blur certain parcel identification data and to make the complete combination of parcel identification data essential to find the associated identification key.

[0025] According to one aspect of the invention, at least one of the personal data relating to a person is information on consent that the person has given with a view to carrying out vital sign measurements.

[0026] According to one aspect of the invention, the information on the consent of the person is obtained following a first step in which the person has confirmed that he has understood the type of measurements which will be carried out on the person and a second step in which the person has confirmed his acceptance for the carrying out of the measurements as presented in the first step.

[0027] According to one aspect of the invention, the first and second steps are carried out using a human-machine interface allowing the person to answer the questions asked on the interface.

[0028] According to one aspect of the invention, the data processing unit is arranged to: - check whether the measured data and additional required data correspond to the parcel identification data set of one of the identification keys, - in the event of a match with one of the identification keys, authorize access to the personal data associated with this identification key.

[0029] According to one aspect of the invention, the additional data required are answers provided by the person to one or more questions.

[0030] These responses form fragmentary identification data, insofar as the responses are individually generic enough to be common to a large sample of people.

[0031] These questions belong to a questionnaire, and these questions are for example: - What is the name of your high school? - What is the make of your first car?

[0032] According to one aspect of the invention, the parcel identification data is stored in several separate memories of the storage system.

[0033] Thus all of this data is not stored in the same location in the storage system.

[0034] According to one aspect of the invention, the storage system may be arranged to store dummy identification keys, in addition to the identification keys actually associated with personal data.

[0035] This increases the complexity of finding the exact association between measurement data and the corresponding key, due to a larger total number of keys.

[0036] According to one aspect of the invention, the data processing unit is arranged For: - in the case where the parcel identification data is a numerical value, for example an age, check whether the measured data is equal to the numerical value of the parcel identification data and, in the event of equality, conclude that there is a correspondence between the measured data and the parcel identification data.

[0037] According to one aspect of the invention, the data processing unit is arranged to: - in the case where the parcel identification data is a range of numerical values, for example a range of heart rate values, check whether the measured data is within the range of numerical values ​​and, if so, conclude that there is a correspondence between the measured data and the parcel identification data.

[0038] The data processing unit is arranged to: - in the case where the parcel identification data is a category, for example a skull shape category, check whether the measured data falls within the category of the parcel identification data and, if so, conclude that there is a correspondence between the measured data and the parcel identification data.

[0039] According to one aspect of the invention, the processing unit is arranged to confirm the correspondence between measured data and data of parcel identification only if the confidence level of these matches is higher than a predetermined confidence threshold, for example this threshold being equal to 80% or 90%.

[0040] According to one aspect of the invention, the system for measuring bodily and / or physiological characteristics comprises a plurality of sensors for measuring bodily and / or physiological characteristics of a person.

[0041] According to one aspect of the invention, these sensors are of different types, for example one of the sensors being a radar capable of measuring a person's heart rate and one of the other sensors being a thermal camera capable of measuring the person's body temperature.

[0042] The invention also relates to a method for protecting personal data comprising: - storing a plurality of identification keys, at least one of the keys being formed by a set of fragmentary identification data based on bodily and / or physiological characteristics of a person, these bodily and / or physiological characteristics being able in particular to include a vital sign such as the heart rate or the respiratory rate of the person, each identification key being associated with a set of personal data of a person stored in a storage system, the keys and the personal data being in themselves anonymous, - obtain, using a measuring system, measured data of bodily and / or physiological characteristics of a person, - check whether these measured data and possibly additional required data correspond to the set of parcel identification data of one of the identification keys, - in the event of a match with one of the identification keys, authorize access to the personal data associated with this identification key.

[0043] According to one aspect of the invention, the method comprises the steps of saving, in the storage system, the measured data as well as the information relating to the consent given by the person, and using this data to form an identification key.

[0044] According to one aspect of the invention, the sensors of the measuring system comprise at least one of the following elements: - a temperature sensor operating in the infrared and arranged to measure at least one temperature of the person's skin, in particular on at least one notable area or point of the person's face, this sensor being in particular an infrared camera, - a camera, in particular a Red Green Blue camera, or RGB camera in English, arranged to define on the person's face the notable temperature measurement point, or the notable temperature measurement points, for the temperature sensor, - a microphone to record a person's breath, or heartbeat, or a sound produced by the person's body or vocal responses, - a radar used to measure a person's heart rate or breathing rate.

[0045] According to one aspect of the invention, the method uses a plurality of authentication keys which are each based on bodily and / or physiological characteristics of the person which vary from one key to another.

[0046] It is thus possible to authorize access to the data only if the correspondence is verified successively on the plurality of keys.

[0047] For example, in an initial match check, the key used is based on height, heart rate, and eye color data.

[0048] If the data measured by the measurement system does not match this key, access to the data is prohibited.

[0049] If the measured data correspond to this key, the processing unit triggers a second correspondence check during which the key used is based on the person's gestures, age and breathing rate.

[0050] If the data measured by the measurement system does not match this key, access to the data is prohibited.

[0051] If the measured data corresponds to this key, the processing unit authorizes access to the data.

[0052] The number of correspondence checks can of course be greater than 3, thus using a number of keys greater than or equal to 3.

[0053] According to one aspect of the invention, the level of confidence required for confirmation of correspondence with the keys used is increased as one progresses through the verification series.

[0054] According to one aspect of the invention, the authentication key is based on a set of bodily and / or physiological characteristics of a person which are randomly selected from the characteristics available in the storage system.

[0055] According to one aspect of the invention, the processing unit is arranged to be able to communicate with a cloud computing service, in particular to send measurement data, for example for storing the data or processing this data in the cloud computing service.

[0056] According to one aspect of the invention, the communication between the processing unit and the cloud is achieved by a wireless protocol, preferably a WiFi protocol.

[0057] According to one aspect of the invention, the device comprises a Human-Machine interface arranged to allow a person to communicate with the device.

[0058] According to one aspect of the invention, this Human-Machine interface comprises a screen, in particular a touch screen such as a tablet.

[0059] The computing cloud, or Cloud, can include health data storage or HDS in English abbreviation.

[0060] The invention and its various applications will be better understood upon reading the following description and examining the accompanying figures:

[0061] [Fig.l] schematically illustrates a personal data protection device according to a non-limiting embodiment of the invention,

[0062] [Fig.2] illustrates different stages of saving information on the person's consent,

[0063] [Fig.3] schematically illustrates a mask of measurement points placed on the person's face,

[0064] [Fig.4] illustrates steps of the protection method according to the invention.

[0065] [Fig.l] shows a device 1 for protecting personal data comprising: - a data storage system 70 such as a cloud computing system, arranged to store a plurality of identification keys K, at least one of the keys K being formed by a set of fragmentary identification data DIP based on bodily and / or physiological characteristics of a person P, each identification key K being associated with a set of personal data of a person stored in this storage system 70, the keys K and the personal data DP being in themselves anonymous, - a system for measuring 2 bodily and / or physiological characteristics of a person, - a data processing unit 50 arranged for: • obtain, using the measuring system 2, measured data of bodily and / or physiological characteristics of a person, • check whether these measured data and possibly additional required data correspond to the DIP parcel identification data set of one of the K identification keys, • if there is a match with one of the DIP identification keys, authorize access to the DP personal data associated with this identification key K.

[0066] The measuring system 2 comprises a sensor which is a radar 5, here a radar func-

[0067]

[0068]

[0069]

[0070]

[0071]

[0072]

[0073]

[0074]

[0075]

[0076]

[0077]

[0078]

[0079] giving 120 GHz or 130 GHz, and this radar is controlled by the processing unit 50. This radar 5 is arranged to measure a person's heart rate or breathing rate. In the example described, the measuring system 2 further comprises: - a temperature sensor 7 operating in the infrared and arranged to measure a temperature of the person's skin, on a plurality of notable points of the person's face, this sensor 7 being an infrared camera, - two 8 cameras, here Red Green Blue cameras, or RGB cameras in English, arranged to define on the person's face, the remarkable points of temperature measurement, for the temperature sensor. The use of several RGB cameras makes it possible to obtain a plurality of remarkable measurement points. These points form a mask of measurement points 20 placed on the face 21 of the person 22, as illustrated in [Fig.3]. The system 2 further comprises a microphone 10 for recording a person's breath, heartbeat, sound produced by the body or vocal responses of the person. In the example described, one of the cameras 8, here the one above the sensor 7, has a viewing direction 25 making a non-zero angle Al with the viewing direction 26 of the sensor 7 to take into account the parallax effect. This angle Al is chosen to be approximately equal to 5°. Parallax correction allows for better juxtaposition of infrared images from the temperature sensor 7 and images from the RGB camera 8, resulting in better measurement accuracy. The radar 5 has a sighting direction 27 which is inclined at an angle A2, here 15°, relative to the sighting direction 26 of the temperature sensor 7. Thus, in the case where the radar 5 is used to measure a person's heart rate or breathing rate, this radar is advantageously directed towards the person's torso while the temperature sensor 7 is centered on the person's face. Communication between the processing unit 50 and the cloud 70 is carried out by a wireless protocol, preferably a Wifi protocol. A housing 42 is provided in which the sensors and the processing unit 50 are arranged. The housing 42 is for example made of plastic. The system 1 includes a Human-Machine Interface 44 arranged to allow a person to communicate with the system. This Human-Machine interface includes a screen, in particular a touch screen such as

[0081]

[0082]

[0083]

[0084]

[0085]

[0086]

[0087]

[0088]

[0089]

[0090]

[0091] than a tablet. The person whose vital signs are to be measured may be sitting or standing in front of the box 42. The set of parcel identification data DIP that forms each identification key K includes at least some of the personal data DP. In other words, the personal data DP are used to form the identification key K. In the invention, the storage system 70 does not store any data selected from: names, social security numbers, facial photos. The number of keys K stored in the storage system 70 is greater than 500 keys, or 1,000 keys, or even 10,000 or 100,000 keys. Each piece of DIP identification data, for example a heart rate value or a hair color, can be common to at least 5% or at least 10% of the total number of keys. Each identification key K is composed of a number of DIP parcel identification data between 5 and 30, in particular between 4 and 7 or between 7 and 15. The DIP parcel identification data are chosen from the following list: - the size, - the weight, - corpulence, - body maintenance, - the shape of the skull, - a gesture, age, - eye color, - the phenotype, - a path of the person's center of gravity, - an element of the person's voice, - a vital sign such as respiratory rate, heart rate, oximetry rate. The system 2 for measuring bodily and / or physiological characteristics is arranged to measure at least one of the bodily and / or physiological characteristics on a person with low resolution. So a thermal image taken by the RGB 8 camera can have relatively poor resolution. This allows to further combine some DIP parcel identification data and makes the complete combination of DIP parcel identification data essential to find the associated identification key K.

[0092] At least one of the personal data DP relating to a person is information on consent that the person has given in order to carry out vital sign measurements.

[0093] We will now describe with reference to [Fig.2] the different stages of saving information on the person's consent.

[0094] In step 100, the device 1 displays via the interface 44 information concerning the measurements and tests which will be carried out by the measuring system 2, as well as the recording of data resulting therefrom.

[0095] In step 101, the person responds whether they understood the information using the interface 44.

[0096] If the person responds that they did not understand the information, the following steps are not carried out (end at step 102).

[0097] If the person responds that they have understood the information, the device 1 displays a request for consent to carry out the measurements and tests (step 103).

[0098] In step 104, the person responds whether they give their consent.

[0099] If the person responds that he or she does not give his or her consent, the following steps are not carried out (end at step 105).

[0100] If the person responds that they give their consent, measurements of bodily and / or physiological characteristics are carried out using the measurement system 2, on the person and the device 1 asks questions to which the person responds (step 106), as described in more detail above.

[0101] In step 107, the personal data DP obtained in step 106 is stored on the computer cloud 70.

[0102] This data is used to create an identification key K (step 108).

[0103] The time and date of the measurements are captured and stored with the personal data DP (step 109).

[0104] The data processing unit 50 is arranged to: - checking whether the measured data and required additional data correspond to the DIP parcel identification data set of one of the identification keys K (step 110 of [Fig.4]), - in case of correspondence with one of the identification keys K, authorize access to the personal data DP associated with this identification key K (step 111 of [Fig.4]).

[0105] The additional data required are answers provided by the person to one or more questions.

[0106] These questions belong to a questionnaire, and these questions are for example: - What is the name of your high school? - What is the make of your first car?

[0107]

[0108]

[0109]

[0110] [YES]

[0112]

[0113]

[0114]

[0115] The data processing unit 50 is arranged to: - in the case where the DIP parcel identification data is a numerical value, here an age, check whether the measured data is equal to the numerical value of the parcel identification data and, in the event of equality, conclude that there is a correspondence between the measured data and this DIP parcel identification data. The data processing unit 50 is arranged to: - in the case where the DIP parcel identification data is a range of numerical values, here a range of heart rate values, check whether the measured data is within the range of numerical values ​​and, if so, conclude that there is a correspondence between the measured data and the DIP parcel identification data. The data processing unit 50 is arranged to: - in the case where the DIP parcel identification data is a category, here a skull shape category, check whether the measured data falls into the category of the DIP parcel identification data and, if so, conclude that there is a correspondence between the measured data and the parcel identification data. The processing unit 50 is arranged to confirm the correspondence between measured data and DIP parcel identification data only if the confidence level of these correspondences is greater than a predetermined confidence threshold, for example this threshold being equal to 80% or 90%. For example, the identification key K is formed by five pieces of information DIP: age, weight, heart rate, skull shape and the answer to a question. The identification key K thus uses personal data DP. The data processing unit 50 is arranged to verify the correspondence between the five measured or acquired values ​​with the five values ​​of the key K, and to conclude, with a confidence level greater than a threshold of 90%, that the person who is physically in front of the measuring system 2 is indeed the person associated with the set of stored personal data DP and that this person had indeed given his consent for the obtaining and saving of his personal data DP. It is furthermore possible to access the date and time at which the person had given his consent. Following confirmation of this correspondence on the five data, access to the DP personal data is authorized. The K keys are thus combinations of values ​​on these five data.

Claims

Claims

1. Personal data protection device (1) comprising: - a data storage system (70) such as a computer cloud, arranged to store a plurality of identification keys (K), at least one of the keys being formed by a set of partial identification data (PID) based on bodily and / or physiological characteristics of a person, these bodily and / or physiological characteristics being able in particular to include a vital sign such as the heart rate or the respiratory rate of the person, each identification key being associated with a set of personal data (PD) of a person (P) stored in this storage system, the keys and the personal data being in themselves anonymous in the sense that they do not contain any element making it possible to directly identify the person who is linked to this key and to this personal data,- a system (2) for measuring bodily and / or physiological characteristics of a person, - a data processing unit (50) arranged to: • obtain, using the measuring system, measured data of bodily and / or physiological characteristics on a person, • check whether these measured data and possibly additional required data correspond to the set of partial identification data (PID) of one of the identification keys (K), • in the event of correspondence with one of the identification keys, authorize access to the personal data (PD) associated with this identification key.,

2. System according to the preceding claim, in which the set of parcel identification data (DIP) which forms each identification key (K) comprises at least some of the personal data (DP).

3. System according to one of the preceding claims, in which the Partial identification data (PID) are chosen from the following list: - height, - weight, - build, - body posture, - skull shape, - gestures, age, - eye color, - phenotype, - a path of the person's center of gravity, - an element of the person's voice, - a vital sign such as respiratory rate, heart rate, oximetry rate.

4. System according to one of the preceding claims, in which the data processing unit (50) is arranged to: - check whether the measured data and additional required data correspond to the set of parcel identification data (DIP) of one of the identification keys (K), - in the event of correspondence with one of the identification keys (K), authorize access to the personal data associated with this identification key.

5. System according to one of the preceding claims, in which the data processing unit (50) is arranged to: - in the case where the parcel identification data is a numerical value, for example an age, check whether the measured data is equal to the numerical value of the parcel identification data (DIP) and, in the event of equality, conclude that there is a correspondence between the measured data and the parcel identification data.

6. System according to one of the preceding claims, in which the unit data processing unit (50) is arranged to: - in the case where the parcel identification data (PID) is a range of numerical values, for example a range of heart rate values, check whether the measured data is within the range of numerical values ​​and, if so, conclude that there is a correspondence between the measured data and the parcel identification data (PID).

7. System according to one of the preceding claims, in which the data processing unit (50) is arranged to: - in the case where the parcel identification data (DIP) is a category, for example a skull shape category, check whether the measured data falls into the category of the parcel identification data (DIP) and, if so, conclude that there is a correspondence between the measured data and the parcel identification data (DIP).

8. System according to one of the preceding claims, in which the processing unit (50) is arranged to confirm the correspondence between measured data and parcel identification data (PID) only if the confidence level of these correspondences is greater than a predetermined confidence threshold, for example this threshold being equal to 80% or 90%.

9. System according to one of the preceding claims, wherein the system for measuring bodily and / or physiological characteristics comprises a plurality of sensors for measuring bodily and / or physiological characteristics of a person.

10. Method for protecting personal data comprising: - storing a plurality of identification keys (K), at least one of the keys being formed by a set of partial identification data (PID) based on bodily and / or physiological characteristics of a person, these bodily and / or physiological characteristics being able in particular to include a vital sign such as the heart rate or the respiratory rate of the person, each identification key (K) being associated with a set of data personal data of a person stored in a storage system, the keys and personal data (PD) being in themselves anonymous in the sense that they do not contain any element allowing the direct identification of the person who is linked to this key and this personal data, obtain, using a measurement system, measured data of bodily and / or physiological characteristics on a person, check whether this measured data and possibly additional required data correspond to the set of partial identification data (PID) of one of the identification keys, in the event of a match with one of the identification keys, authorize access to the personal data (PD) associated with this identification key (K).

Images