Subject Access Request Processing Using a Personal Data Graph
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current Subject Access Request (SAR) solutions are inadequate, failing to efficiently identify and respond to SARs due to reliance on basic keyword searches, leading to non-compliance with privacy regulations like GDPR.
Innovation Solution
An intelligent system utilizing a personal data graph to associate recognized names with identified personal data, enabling efficient and compliant responses to SARs by querying variations of the name provided in the request and returning relevant documents with additional personal information masked.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If basic keyword search is used for SAR identification, then implementation simplicity is maintained, but SAR response accuracy and completeness deteriorate
Solution Approach 1:
The patent introduces a personal data graph as an intermediary structure between the keyword search and the actual data. The graph uses named entity recognition to identify personal data elements and creates relationships between them, serving as a mediator that transforms simple keyword matching into intelligent data association. This resolves the contradiction by maintaining implementation simplicity while dramatically improving SAR response accuracy through structured data relationships.
Solution Approach 2:
The patent replaces the mechanical keyword search system with an intelligent system based on named entity recognition and graph theory. Instead of relying on simple text matching mechanics, the system uses semantic understanding to identify personal data elements and their relationships. This substitution resolves the contradiction by trading implementation complexity for significant improvements in identification accuracy and completeness.
2Reliability
If comprehensive personal data identification is implemented, then SAR compliance quality improves, but system complexity increases
Solution Approach 1:
The patent segments the complex task of SAR compliance into distinct modules: named entity recognition for identifying personal data elements, graph construction for establishing relationships, and query processing for responding to requests. This segmentation resolves the contradiction by making the system manageable and maintainable while achieving comprehensive personal data identification and high compliance quality through specialized processing at each stage.
Solution Approach 2:
The personal data graph serves as an intermediary layer that manages the complexity of comprehensive data identification. Rather than implementing complex identification logic throughout the entire system, the graph structure centralizes the relationship management, simplifying the overall system architecture while enabling thorough personal data tracking and association.
3Object-affected harmful factors
If personal data associations are thoroughly analyzed, then data privacy protection improves, but processing time increases
Solution Approach 1:
The patent performs preliminary action by constructing the personal data graph in advance, identifying all personal data elements and their relationships before SAR requests are received. This pre-processing resolves the contradiction by enabling fast query responses while maintaining thorough privacy protection, as the heavy analysis work is completed beforehand rather than during each SAR processing event.
Solution Approach 2:
The patent creates a copied representation of the data relationships in the personal data graph, separate from the actual data storage. This copying allows thorough analysis of data associations for privacy protection without repeatedly processing the original large volumes of data during SAR requests, thus maintaining strong privacy protection while reducing processing time.
Data Source
AI summary
Systems and methods for serving subject access requests (SARs) are disclosed. A network connection is established with a user. An SAR, including at least one piece of personal data corresponding to an entity associated with said user, is received from the user via the network connection. Text data is extracted from a plurality of data objects, the data objects including personal data associated with the user. The text data is then processed to identify instances of names and instances of personal data within the text data. Associations are generated between identified names and identified personal data. A subset of the identified personal data that corresponds to the entity is identified based on the associations. A response to the SAR is provided, based at least in part on the identified personal data corresponding to the entity.