PII Deletion Fingerprints for Verifiable Data Disposal
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The complexity of data privacy regulations across various jurisdictions creates challenges for companies in managing and deleting personal data, with potential compliance issues and risks of data breaches, and the deletion process itself can create new data privacy concerns.
Innovation Solution
A system and method for active data disposal using customizable rules-based deletion, involving the creation of a unique encrypted fingerprint of personal data before deletion, stored separately, allowing verification of deletion without revealing the original data, and maintaining compliance with regulations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If personal data is deleted to comply with privacy regulations and minimize liability, then compliance and security are improved, but the ability to verify deletion and respond to user inquiries is compromised
Solution Approach 1:
The patent creates a cryptographic hash (fingerprint) copy of the personal data before deletion. This hash serves as a verifiable record that the data existed and was deleted, without containing the actual personal information. The hash can be stored and used to verify deletion compliance while the original sensitive data is permanently removed.
Solution Approach 2:
The cryptographic hash acts as an intermediary between the deleted personal data and the verification process. It provides a middle ground that allows verification of deletion without exposing the original sensitive information, solving the contradiction between complete deletion and verifiable proof of deletion.
2Ease of operation
If a record of deleted data is maintained to confirm deletion to users, then user inquiry response capability is improved, but the risk of the record itself being considered personal data increases
Solution Approach 1:
Instead of storing copies of the actual personal data in the deletion record, the patent stores only cryptographic hashes. These hashes can be used to verify whether specific data was deleted without containing any personally identifiable information themselves, thus maintaining ease of verification while eliminating the harm of retaining sensitive data.
Solution Approach 2:
The patent transforms the personal data into a different parameter form (cryptographic hash) that loses its identifying characteristics. The hash function changes the data from a recognizable personal identifier into an unrecognizable string that can still serve as a unique identifier for verification purposes.
3Reliability
If cryptographic hashing is applied to create verifiable deletion records, then security and compliance are improved, but system complexity increases
Solution Approach 1:
The cryptographic hash function is a deterministic algorithm that automatically generates the fingerprint without requiring manual intervention. Once the personal data is input, the hash is generated self-service style, reducing operational complexity while maintaining high security standards.
Solution Approach 2:
The system performs the cryptographic hashing operation as a preliminary step before actual data deletion. This advance preparation creates the verification record in advance, simplifying the overall deletion process and making the verification mechanism ready before any compliance inquiries arise.
Data Source
AI summary
A computerized method is provided for automated deletion of data. Methods can include identification of personally identifiable information (PII) or other data that may be subject to regulation. Methods can include creating an encrypted record of deletion for future verification. In some embodiments, the record may include PII and the record may be encrypted via a one-way cryptographic hash such that foreknowledge of the PII is required to search the deletion record.