Distributed customer data management network handling personally identifiable information

#This invention relates to systems and methods for handling Personally Identifiable Information (PII), and, more particularly, to systems and methods for handling PII in a globally compliant manner, across and within governmental or defined synthetic jurisdictions, without violating the privacy laws or rules of the involved jurisdictions.

#During the last two decades, an explosion of global, interactive, online computing, including, but not limited to, e-commerce, entertainment and research, has greatly increased the communications between and among people and computer systems in almost all parts of the world. With this advent, there has also been an explosion of people and computer systems disclosing, receiving and managing Personally Identifiable Information (PII). Moreover, with the growth and expansion of cloud computing, PII stored away from one's personal computer has become a norm. This growth of the use of PII has caused great concern among both the private sector and government alike. For example, the Ponemon Institute conducts independent research on privacy, data protection and information security policy with the goal to enable organizations in both the private and public sectors to have a clearer understanding of the trends in practices, perceptions and potential threats that will affect the collection, management and safeguarding of personal and confidential information about individuals and organizations.

#In response to the dangers involved with people and computer systems disclosing, receiving and managing PII, governmental jurisdictions, including countries and states, have created privacy laws to protect individuals within their jurisdictions. For example, in the United States, the following federal laws have been created to protect PII (certain laws are identified by acronym): COPPA—protects PII for children online. TCPA and TSR—protect PII used in telemarketing. CAN SPAM—protects PII used in email marketing. Gramm-Leach-Bliley Act—protects PII used with financial transactions. PCI—protects PII used in payment card transactions. FCRA—protects PII used in credit checks and credit reports. Patriot Act—allows the federal government to access PII to obstruct terrorism. HIPAA—protects PII used in healthcare. Cable Act—protects PII regarding a person's viewing habits. Privacy Act—protects one from the government's use of PII. VRPA—protects PII regarding a person's video rental habits. DPPA—protects PII regarding a person's driving records.

#The inventions will now be more particularly described by way of examples with reference to the accompanying drawings. Novel features believed characteristic of the inventions are set forth in the claims. The inventions themselves, as well as the preferred modes of use, further objectives, and advantages thereof, are best understood by reference to the following detailed description of the embodiment in conjunction with the accompanying drawings, in which:

#FIG. 1 shows CDM high level system architecture.

#FIG. 2 shows the pervasiveness of PII.

#The described embodiments are systems and methods for handling Personally Identifiable Information (PII) in a globally compliant manner, across and within governmental or defined synthetic jurisdictions, without violating the privacy laws or rules of the involved jurisdictions. The object of the inventions is to operate and maintain systems that allow one to collect, to store, to manage and to use a subset of customer data, or PII, potentially comprising both sensitive and confidential information elements, in a globally compliant way.

#The DCDMN is comprised of a series of regionalized services that store and manage customer data in a compliant fashion based on the applicable laws of the relevant jurisdictions. These regional services connect to applications through a digital data routing system in a manner that allows applications to display the sensitive data in a legally compliant fashion. The totality of all systems involved in the management and use of customer data is called the Customer Data Management System (CDMS).

#The DCDMN is designed to support the creation, retrieval, updating, and deletion of PII of potentially millions of Data Subjects existing in over 100 countries managed by services deployed in many Synthetic Jurisdictions. These regions may or may not be geographically contiguous. They are defined based on the similarity of regulatory and risk profiles associated with the actual Legal Jurisdictions of which they are comprised. Risk profiles will be based on legal complexity, enforcement activity, and the size of the market for products.