International Business Machines Corporation

Nigel Howard Julian Brown

Michael Waidner

Charles Campbell Palmer

Steven B Adler

Arthur Miles Gilbert

Michael Schnyder

Jan Leonard Camenisch

Endre Felix Bangerter

Dogan Kesdogan

Adam Charles Nelson

Michael Robert McCullough

Xuan Liu

Matthias Schunter

Guenter Karjoth

Edith Gail Schonberg

Kathryn Ann Bohrer

Calvin Stacy Powers

Elsie A Van Herreweghen

Martin Joseph Clayton Presler-Marshall

Howard Young

Yim Y Chan

Christopher James Dolder

Marie-Paule Christyne Gauthier

Matthew P Leonard

Elsie Van Herreweghen

In a computer, a first set of object classes are provided representing active entities in an information-handling process and a second set of object classes are provided representing data and rules in the information-handling process. At least one object class has rules associated with data. The above-mentioned objects are used in constructing a model of an information-handling process, and to provide an output that identifies at least one way in which the information-handling process could be improved. One aspect is a method for handling personally identifiable information. Another aspect is a system for executing the method of the present invention. A third aspect is as a set of instructions on a computer-usable medium, or resident in a computer system, for executing the method of the present invention.

Using an object model to improve handling of personally identifiable information

A method, apparatus, and computer program product for providing a consulting assessment environment. Consultants may use the environment to define templates that encode questionnaires and domain knowledge regarding business practices, as well as reporting criteria to specify the content and format of the assessment results. Consultants or their clients may use the environment to automate the process of performing assessments and generating reports from those assessments. These assessments may analyze the current state of the business, compare the business's current state with desired states or with best practices, and perform risk/benefit and/or cost/benefit analyses, according to the specifications made in the templates on a real-time basis for producing immediate assessment results and actions. An information hiding feature is provided to allow sensitive domain knowledge encoded within the templates, such as trade secrets, to be made inaccessible to clients.

Consulting assessment environment

The invention entails identifying the parties involved in a process of handling personally identifiable information; identifying the data involved in said process; classifying the data; expressing each relationship between each pair of said parties in terms of a privacy agreement; and representing the parties, data, and privacy agreements graphically in one or more privacy agreement relationship diagrams. The invention has the advantage of identifying opportunities to reduce privacy-related risks, including identifying unnecessary exchanges of data, for possible elimination, and identifying opportunities to transform data into a less sensitive form. Privacy agreements are based on a limited set of privacy-related actions: access, disclose, release, notify, utilize, update, withdrawConsent, giveConsent, delete, anonymize, depersonalize, and repersonalize. One aspect of the present invention is a method for improving the handling of personally identifiable information. Another aspect of the present invention is a system for executing the method of the present invention. A third aspect of the present invention is as a set of instructions on a computer-usable medium, or resident in a computer system, for executing the method of the present invention.

Using a privacy agreement framework to improve handling of personally identifiable information

The present invention is a system and method for handling personally identifiable information, using a rules model. The invention involves defining a limited number of privacy-related actions regarding personally identifiable information; constructing a rule for each circumstance in which one of said privacy-related actions may be taken or must be taken; allowing for the input of dynamic contextual information to precisely specify the condition for evaluation of a rule; creating a programming object containing at least one of said rules; associating the programming object with personally identifiable information; processing a request; and providing an output. The invention does not merely give a 'yes-or-no answer. The invention has the advantage of being able to specify additional actions that must be taken. The invention may use a computer system and network. One aspect of the present invention is a method for handling personally identifiable information. Another aspect of the present invention is a system for executing the method of the present invention. A third aspect of the present invention is as a set of instructions on a computer-usable medium, or resident in a computer system, for executing the method of the present invention.

Using a rules model to improve handling of personally identifiable information

Growing community of inventors

Richmond Hill, Canada

Nigel Howard Julian Brown