US 2025/0094634 A1 · ACCESS CONTROL OF DATA BASED ON PURPOSE AND/OR CONSENT

Abstract

Aspects of the present invention provide methods, apparatuses, systems, computing devices, computing entities, and/or the like for implementing and managing access to particular data based on access controls for implementing purpose restrictions and/or consent restrictions. In various aspects, a method is provided that comprises: receiving a request transmitted by an application executing on a client computing system and requesting access to a dataset, wherein each data record of the dataset comprises data elements; identifying, based on the application, a purpose for the application requesting access to the dataset; referencing, based on the purpose, an applicable purpose-based access-control policy to identify an authorization token; and providing the authorization token, wherein the storage computing system provides the client computing system with a view of the dataset based on the token with the view having a data element returning modified data in a manner compliant with the applicable purpose-based access-control policy.

Claims21

Dependent claims

A method comprising:

receiving a request associated with an application that is executing on a client computing system and requesting access to a dataset comprising a plurality of data records handled by a storage computing system, wherein each data record of the plurality of data records comprises a plurality of data elements;
identifying, based on the application, a purpose for the application requesting access to the dataset;
referencing, based on the purpose, an applicable purpose-based access-control policy to identify an authorization token;
and
providing the authorization token to at least one of the client computing system or the storage computing system, wherein the storage computing system provides, based on the authorization token, the client computing system with a view of the dataset having a data element of the plurality of data elements returning modified data in a manner that is compliant with the applicable purpose-based access-control policy.

2 more elements

A non-transitory computer-readable medium storing computer-executable instructions that, when executed by computer hardware, configure the computer hardware to perform operations comprising:

identifying, based on consent data for a data subject, that a first consent has not been obtained from the data subject for processing data for a first purpose associated with a first consent-based access-control policy;
identifying, based on the consent data, that a second consent has been obtained from the data subject for processing the data for a second purpose associated with a second consent-based access-control policy;
generating, based on the first consent not being obtained for processing the data for the first purpose and the second consent being obtained for processing the data for the second purpose, a consent tag for the data subject, wherein the consent tag comprises a data structure identifying the first purpose and first consent data for the first purpose and the second purpose and second consent data for the second purpose;
and
providing the consent tag to a storage computing system, wherein the consent tag is associated with a data record for the data subject found in a plurality of data records of a dataset handled by the storage computing system, and associating the consent tag with the data record causes:
(a) the data record to be excluded from results of a first query of the dataset returned for the first purpose based on the first consent data, and
(b) the data record to be included in second results of a second query of the dataset returned for the second purpose based on the second consent data.

4 more elements

A system comprising a processing device configured to perform operations comprising:

identifying, based on an identifier received for a data subject originating from a storage computing system, consent data for the data subject;
identifying an applicable consent-based access-control policy;
identifying, based on the consent data, consent has not been obtained from the data subject for processing data for a purpose associated with the applicable consent-based access-control policy;
generating, based on the consent not being obtained for processing the data for the purpose, consent-based access-control policy data for the data subject, wherein the consent-based access-control policy data comprises a logical operation for the purpose;
and
providing the consent-based access-control policy data to the storage computing system, wherein the storage computing system processes a query of a dataset for the purpose, the dataset comprising a plurality of data records, to cause the logical operation to be executed to exclude a data record associated with the data subject found in the plurality of data records from the query.

3 more elements

Dependencies are inferred from the claim text.

Access control of data based on purpose and/or consent

Life of this patent

Access control of data based on purpose and/or consent

Life of this patent

Abstract

Claims21