Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Specification
The title of the invention is not descriptive. A new title is required that is clearly indicative of the invention to which the claims are directed.
Drawings
The drawings filed on January 31, 2022 are accepted.
Information Disclosure Statement
The information disclosure statement (IDS) submitted on 02/02/2022, 02/25/2022, 03/29/2022, 04/28/2022, 05/26/2022, 06/29/2022 and 10/19/2022 was filed after the mailing date of the application no. 17/588902. The submission is in compliance with the provisions of 37 CFR 1.97. Accordingly, the information disclosure statement is being considered by the examiner.
Double Patenting
The nonstatutory double patenting rejection is based on a judicially created doctrine grounded in public policy (a policy reflected in the statute) so as to prevent the unjustified or improper timewise extension of the “right to exclude” granted by a patent and to prevent possible harassment by multiple assignees. A nonstatutory double patenting rejection is appropriate where the conflicting claims are not identical, but at least one examined application claim is not patentably distinct from the reference claim(s) because the examined application claim is either anticipated by, or would have been obvious over, the reference claim(s). See, e.g., In re Berg, 140 F.3d 1428, 46 USPQ2d 1226 (Fed. Cir. 1998); In re Goodman, 11 F.3d 1046, 29 USPQ2d 2010 (Fed. Cir. 1993); In re Longi, 759 F.2d 887, 225 USPQ 645 (Fed. Cir. 1985); In re Van Ornum, 686 F.2d 937, 214 USPQ 761 (CCPA 1982); In re Vogel, 422 F.2d 438, 164 USPQ 619 (CCPA 1970); In re Thorington, 418 F.2d 528, 163 USPQ 644 (CCPA 1969).
A timely filed terminal disclaimer in compliance with 37 CFR 1.321(c) or 1.321(d) may be used to overcome an actual or provisional rejection based on nonstatutory double patenting provided the reference application or patent either is shown to be commonly owned with the examined application, or claims an invention made as a result of activities undertaken within the scope of a joint research agreement. See MPEP § 717.02 for applications subject to examination under the first inventor to file provisions of the AIA as explained in MPEP § 2159. See MPEP § 2146 et seq. for applications not subject to examination under the first inventor to file provisions of the AIA . A terminal disclaimer must be signed in compliance with 37 CFR 1.321(b).
The filing of a terminal disclaimer by itself is not a complete reply to a nonstatutory double patenting (NSDP) rejection. A complete reply requires that the terminal disclaimer be accompanied by a reply requesting reconsideration of the prior Office action. Even where the NSDP rejection is provisional the reply must be complete. See MPEP § 804, subsection I.B.1. For a reply to a non-final Office action, see 37 CFR 1.111(a). For a reply to final Office action, see 37 CFR 1.113(c). A request for reconsideration while not provided for in 37 CFR 1.113(c) may be filed after final for consideration. See MPEP §§ 706.07(e) and 714.13.
The USPTO Internet website contains terminal disclaimer forms which may be used. Please visit www.uspto.gov/patent/patents-forms. The actual filing date of the application in which the form is filed determines what form (e.g., PTO/SB/25, PTO/SB/26, PTO/AIA /25, or PTO/AIA /26) should be used. A web-based eTerminal Disclaimer may be filled out completely online using web-screens. An eTerminal Disclaimer that meets all requirements is auto-processed and approved immediately upon submission. For more information about eTerminal Disclaimers, refer to www.uspto.gov/patents/apply/applying-online/eterminal-disclaimer.
Claims 1-20 provisionally rejected on the ground of nonstatutory double patenting as being unpatentable over claims 1-18 of U.S. Patent No. 11238390. Although the claims at issue are not identical, they are not patentably distinct from each other because a later patent claim is not patentably distinct from an earlier patent claim if the later claim is obvious over, or anticipated by, the earlier claim. In re Longi, 759 F.2d at 896,225 USPQ at 651 (affirming a holding obviousness-type double patenting because the claims at issue were obvious over claims in four prior art patents); In re Berg, 140 F.3d at 1437, 46 USPQ2d at 1233 (Fed. Cir. 1998) (affirming a holding obviousness-type double patenting where a patent application claim to a genus is anticipated by a patent claim to a species within that genus). “ELI LILLY AND COMPANY VBARR LABORATORIES, INC., United States Court of Appeals for the Federal Circuit, ONPETITION FOR REHEARING EN BANC(DECIDED: May 30, 2001).
Current application 17/418460
U.S. Patent No. 11238390
A method comprising:
8. A system comprising: a non-transitory computer-readable medium storing instructions; and a processing device communicatively coupled to the non-transitory computer-readable medium, wherein, the processing device is configured to execute the instructions and thereby perform operations comprising:
15. A non-transitory computer-readable medium having program code that is stored thereon, the program code executable by one or more processing devices for performing operations comprising:
receiving, by computing hardware via a first graphical user interface, an indication of a first jurisdiction, an indication of a second jurisdiction, and incident information for a data-related incident impacting an entity; retrieving, by the computing hardware, a first reporting task for the first jurisdiction and a second reporting task for the second jurisdiction from a data structure;
determining, by the computing hardware, a first penalty for violation of the first reporting task and a second penalty for violation of the second reporting task;
identifying, by the computing hardware, a conflict between satisfying the first reporting task and satisfying the second reporting task; determining, by the computing hardware, a first risk level based on the incident information and the first penalty and a second risk level based on the incident information and the second penalty; generating, by the computing hardware, a customized incident response plan by selecting the first reporting task rather than the second reporting task for inclusion in the incident response plan based on the identified conflict, the first risk level, and the second risk level;
generating, by the computing hardware, a second graphical user interface by configuring a presentation element configured for presenting the customized incident response plan on the second graphical user interface;
and transmitting, by the computing hardware, an instruction to a user device to retrieve the customized incident response plan and present the second graphical user interface on the user device.
A computer-implemented data processing method for determining a required data privacy activity comprising:
14. A data breach response system comprising: one or more processors; and computer memory
receiving, by one or more computer processors from a user via a first graphical user interface, an indication of a first jurisdiction and an indication of a second jurisdiction;
retrieving, by the one or more computer processors based at least in part on the first jurisdiction, a first data privacy requirement for the first jurisdiction from a data structure using an ontology mapping the first data privacy requirement for the first jurisdiction to a second data privacy requirement for the second jurisdiction;
retrieving, by the one or more computer processors based on the ontology mapping the first data privacy requirement for the first jurisdiction to the second data privacy requirement for the second jurisdiction, the second data privacy requirement for the second jurisdiction from the data structure using the ontology;
retrieving, by the one or more computer processors based on the first jurisdiction, a first enforcement parameter from the data structure using the ontology, wherein the first enforcement parameter indicates a first number of enforcement actions associated with the first data privacy requirement for the first jurisdiction performed in a particular time period; retrieving, by the one or more computer processors based at least in part on the second jurisdiction, a second enforcement parameter from the data structure using the ontology, wherein the second enforcement parameter indicates a second number of enforcement actions associated with the second data privacy requirement for the second jurisdiction performed in the particular time period; determining, by the one or more computer processors, a first reporting score for the first jurisdiction based on a first business value for the first jurisdiction and the first enforcement parameter; determining, by the one or more computer processors, a second reporting score for the second jurisdiction based on a second business value for the second jurisdiction and the second enforcement parameter;
determining, by the one or more computer processors, that satisfying the first data privacy requirement for the first jurisdiction conflicts with satisfying the second data privacy requirement for the second jurisdiction; in response to determining that satisfying the first data privacy requirement for the first jurisdiction conflicts with satisfying the second data privacy requirement for the second jurisdiction, automatically, by the one or more computer processors: calculating a first risk level associated with not satisfying the first data privacy requirement for the first jurisdiction using the first reporting score for the first jurisdiction; and calculating a second risk level associated with not satisfying the second data privacy requirement for the second jurisdiction using the second reporting score for the second jurisdiction; performing, by the one or more computer processors, a comparison of the first risk level with the second risk level to determine which of the first risk level and the second risk level is a lowest risk level; determining, by the one or more computer processors based on the lowest risk level, a required data privacy activity; mapping, by the one or more computer processors, the required data privacy activity to a master question in a master questionnaire; electronically generating, by the one or more computer processors, a second graphical user interface comprising the master questionnaire;
electronically receiving, by the one or more computer processors, data responsive to the master question via the second graphical user interface;
generating, by the one or more computer processors, an electronic link associating the data responsive to the master question with the required data privacy activity in the data structure using the ontology; wherein: calculating the first risk level associated with not satisfying the first data privacy requirement for the first jurisdiction comprises determining a first fine imposition rate for violations of the first data privacy requirement for the first jurisdiction; and calculating the second risk level associated with not satisfying the second data privacy requirement for the second jurisdiction comprises determining a second fine imposition rate for violations of the second data privacy requirement for the second jurisdiction.
All the limitation of independent claims 1, 8 and 15 are taught by the U.S. Patent application except for the underlined limitation. Whites et al (US 20160125680) teaches the underlined limitation of receiving an incident information for a data-related incident impacting an entity along with first and second jurisdiction. One would be motivated to do so in order to automatically identify verification system runs the risk of violating such rules in various jurisdictions based on identifying applicable rules on incident information (White on [0009-0011]).
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claim 1-20 is rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more. The claim recites receiving jurisdiction information and incident information, retrieving reporting task for each jurisdiction, determining penalty of violation of each reporting task of corresponding jurisdiction, identifying conflict between reporting task of jurisdiction, determining risk level based on incident information and penalty of violation of each reporting task, selecting reporting task with less penalty based on risk level and transmitting the information to user device.
The limitations receiving jurisdiction information and incident information, retrieving reporting task for each jurisdiction, determining penalty of violation of each reporting task of corresponding jurisdiction, identifying conflict between reporting task of jurisdiction, determining risk level based on incident information and penalty of violation of each reporting task, selecting reporting task with less penalty based on risk level and transmitting the information to user device is a process that, under its broadest reasonable interpretation, covers performance of the limitations in the mind mentally or physically nothing in the claim precludes the steps from practically being performed in the mind or using paper and pencil. Receiving jurisdiction information and incident information, retrieving reporting task for each jurisdiction, determining penalty of violation of each reporting task of corresponding jurisdiction, identifying conflict between reporting task of jurisdiction, determining risk level based on incident information and penalty of violation of each reporting task, selecting reporting task with less penalty based on risk level and transmitting the information to user device as drafted is a process that, under its broadest reasonable interpretation, covers performance of the limitations in the mind. If a claim limitation, under its broadest reasonable interpretation, covers performance of the limitation in the mind but for the recitation of generic computer components, then it falls within the “Mental Processes” grouping of abstract ideas. Accordingly, the claim recites an abstract idea.
This judicial exception is not integrated into a practical application because the claim recites Graphical user interface to select and display information via computing hardware. These elements in the claim are recited at a high-level of generality such that it amounts no more than mere instructions to apply the exception using a generic computer component. Accordingly, this additional element does not integrate the abstract idea into a practical application because it does not impose any meaningful limits on practicing the abstract idea. The claim is directed to an abstract idea.
The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception. As discussed above with respect to integration of the abstract idea into a practical application, the additional element of devices to perform receiving jurisdiction information and incident information, retrieving reporting task for each jurisdiction, determining penalty of violation of each reporting task of corresponding jurisdiction, identifying conflict between reporting task of jurisdiction, determining risk level based on incident information and penalty of violation of each reporting task, selecting reporting task with less penalty based on risk level and transmitting the information to user device, steps amounts to no more than mere instructions to apply the exception using a generic computer component see spec para of instant application [0097, 0100-0101 and 0104-0105]. Mere instructions to apply an exception using a generic computer component cannot provide an inventive concept. The claim is not patent eligible.
Further recited elements within dependent claims 2-7, 9-14 and 16-20 taken individually do not amount to “significantly more” than just the abstract idea as previously identified above. Therefore, the claims do not amount to significantly more than the previously defined abstract idea. Some of the evidences of “significantly more” are a) improvement to another technology or field; b) applying judicial exception with or by a “particular machine’; c) transforming particular article/data into different state or thing; d) adding unconventional or non-routine steps, producing useful application; and e) other meaningful limitations beyond generic link to particular technological environment.
As a result, the claims are directed to non-statutory subject matter. See Also Alice, 134 S. Ct. at 2360. Under Alice, that is not sufficient "to transform an abstract idea into a patent-eligible invention." See Alice Corporation v. CLS Bank International, (S.Ct.2014) and Ultramercial, Inc. v. Hulu, LLC. (Fed.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-4, 8-11 and 14-18 are rejected under 35 U.S.C. 103 as being unpatentable over White et al (hereinafter White) (US 20160125680) in view of Morris (US 20080281649).
Regarding claims 1, 8 and 15 White teaches a method comprising: (White on [0010] teaches a method);
A system comprising: a non-transitory computer-readable medium storing instructions; and a processing device communicatively coupled to the non-transitory computer-readable medium, wherein, the processing device is configured to execute the instructions and thereby perform operations comprising: (White on [0034] teaches system comprising processor executing instruction stored in memory);
A non-transitory computer-readable medium having program code that is stored thereon, the program code executable by one or more processing devices for performing operations comprising: (White on [0034] teaches system comprising processor executing instruction stored in memory);
receiving, by computing hardware (White Fig 1 and on [0011-0013 and 0017-0019] teaches receiving identification information (i.e., incident information) of user via input device such as scanner in compliance with applicable rules set by plurality of jurisdiction A, B and C (i.e., indication of first and second jurisdiction));
retrieving, by the computing hardware, a first reporting task for the first jurisdiction and a second reporting task for the second jurisdiction from a data structure (White Fig 1 and on [0011-0013 and 0017-0019] teaches jurisdiction A may prohibit transmission of identification information retrieved from any Jurisdiction A driver licenses to a third party (i.e., reporting task for first jurisdiction ). The current location of the identification document when it is being scanned can be another factor. Various jurisdictions have rules on electronic scans of identification documents that happen within their territories. For example, Jurisdiction B can prohibit a seller from recording or maintaining certain sensitive information (e.g., name and address) derived from electronic scans of identification documents (i.e., reporting task for second jurisdiction). Proposed uses of the scanned information by the operator of the document scanner can be another factor to consider. For example, Jurisdiction C may expressly prohibit the storage and use of identification information derived from electronic scans of identification documents for mailing list purposes);
determining, by the computing hardware, a White on [0009] teaches an automatic identify verification system runs the risk of violating such rules in various jurisdictions. See on [0026-0027] teaches a federal rule may prevail when it conflicts with a state rule, and therefore a high priority is assigned to the federal rule while a low priority is assigned to the state rule. As another example, if two rules conflict, the system may selectively apply the most restrictive aspects of each of the rules to ensure that the system abides by the minimum requirements of both rules. For example, if one rule indicates that information can be used for marketing purposes but not for loyalty purposes, and another rule indicates that the information can be used for loyalty purposes but not marketing purposes, the system may bar the use of scanned information for either marketing purposes or for loyalty purposes);
identifying, by the computing hardware, a conflict between satisfying the first reporting task and satisfying the second reporting task (White Fig 2 block 217-219 and text on [0026-0027] teaches after retrieving the applicable rules, processing proceeds to decision block 217 to determine whether there is any conflict among the identified applicable rules. For example, conflicts may arise between a federal rule and a state rule. If there is a conflict, the system continues to block 219 to prioritize the identified applicable rules in conflict. For example, a federal rule may prevail when it conflicts with a state rule, and therefore a high priority is assigned to the federal rule while a low priority is assigned to the state rule. As another example, if two rules conflict, the system may selectively apply the most restrictive aspects of each of the rules to ensure that the system abides by the minimum requirements of both rules. For example, if one rule indicates that information can be used for marketing purposes but not for loyalty purposes, and another rule indicates that the information can be used for loyalty purposes but not marketing purposes, the system may bar the use of scanned information for either marketing purposes or for loyalty purposes. By applying the most conservative interpretation, the system helps ensure that all applicable rules are being met);
determining, by the computing hardware, a first risk level based on the incident information and the first penalty and a second risk level based on the incident information and the second penalty (White Fig 2 block 217-219 and text on [0026] teaches after retrieving the applicable rules, processing proceeds to decision block 217 to determine whether there is any conflict among the identified applicable rules. For example, conflicts may arise between a federal rule and a state rule. If there is a conflict, the system continues to block 219 to prioritize the identified applicable rules in conflict. For example, a federal rule may prevail when it conflicts with a state rule, and therefore a high priority (i.e., high risk if violated) is assigned to the federal rule while a low priority (i.e., lower risk) is assigned to the state rule. As another example, if two rules conflict, the system may selectively apply the most restrictive aspects of each of the rules to ensure that the system abides by the minimum requirements of both rules. For example, if one rule indicates that information can be used for marketing purposes but not for loyalty purposes, and another rule indicates that the information can be used for loyalty purposes but not marketing purposes, the system may bar the use of scanned information for either marketing purposes or for loyalty purposes. By applying the most conservative interpretation, the system helps ensure that all applicable rules are being met);
generating, by the computing hardware, a customized incident response plan by selecting the first reporting task rather than the second reporting task for inclusion in the incident response plan based on the identified conflict, the first risk level, and the second risk level (White Fig 2 block 217-219 and text on [0026-0027] teaches after retrieving the applicable rules, processing proceeds to decision block 217 to determine whether there is any conflict among the identified applicable rules. For example, conflicts may arise between a federal rule and a state rule. If there is a conflict, the system continues to block 219 to prioritize the identified applicable rules in conflict. For example, a federal rule may prevail when it conflicts with a state rule, and therefore a high priority (i.e., high risk if violated) is assigned to the federal rule while a low priority (i.e., lower risk) is assigned to the state rule. As another example, if two rules conflict, the system may selectively apply the most restrictive aspects of each of the rules to ensure that the system abides by the minimum requirements of both rules. For example, if one rule indicates that information can be used for marketing purposes but not for loyalty purposes, and another rule indicates that the information can be used for loyalty purposes but not marketing purposes, the system may bar the use of scanned information for either marketing purposes or for loyalty purposes. By applying the most conservative interpretation, the system helps ensure that all applicable rules are being met. Further teaches If there is a conflict of rules, then the rules are applied based on the priorities thereof. For example, when a rule with high priority conflicts with a rule with low priority, the rule with high priority is applied and the rule with low priority is ignored. An operator of the system can modify the rules manually (e.g., override an identified rule). In such case, the system can provide a warning to the operator so as to inform the operator that a manual modification may result in a violation of the identified rule);
generating, by the computing hardware, a second graphical user interface by configuring a presentation element configured for presenting the customized incident response plan on the second graphical user interface (White Fig 2 block 223, Fig 3 block 325 and text on [0012, 0023 0028 and 0033] teaches the system displays the processed identification information based on the applied rules. In some embodiments, the system presents the processed identification information to an operator or a user of the system (e.g., a sales clerk, a gate keeper, a used-car dealer, a loan officer, a police officer, or other suitable individual). The information may be presented on a computing device display. Further teaches the system displays the processed identification information based on the applied rules. In some embodiments, the system presents the processed identification information to an operator or a user of the system (e.g., a sales clerk, a gate keeper, a used-car dealer, a loan officer, a police officer, or other suitable individual). The information may be presented on a computing device display);
and transmitting, by the computing hardware, an instruction to a user device to retrieve the customized incident response plan and present the second graphical user interface on the user device (White Fig 2 block 223, Fig 3 block 325 and text on [0012, 0023 0028 and 0033] teaches the system displays the processed identification information based on the applied rules. In some embodiments, the system presents the processed identification information to an operator or a user of the system (e.g., a sales clerk, a gate keeper, a used-car dealer, a loan officer, a police officer, or other suitable individual). The information may be presented on a computing device display. Further teaches the system displays the processed identification information based on the applied rules. In some embodiments, the system presents the processed identification information to an operator or a user of the system (e.g., a sales clerk, a gate keeper, a used-car dealer, a loan officer, a police officer, or other suitable individual). The information may be presented on a computing device display).
White fails to explicitly teach receiving, by computing hardware via a first graphical user interface……, determining a penalty for violation of the first reporting task and a second penalty for violation of the second reporting task, however Morris from analogous art teaches
receiving, by computing hardware via a first graphical user interface, entity (Morris on [0058] teaches the user interface programs provide a graphical user interface for settlement agents 105. The user interface programs allow agents to manually enter current lien information and other transaction data, relating to one or more real estate transactions);
determining, by the computing hardware, a first penalty for violation of the first reporting task and a second penalty for violation of the second reporting task (Morris on [0071-0072] multiple jurisdictions that are used generate the legal forms, including release instruments, and demand letters. All jurisdictions further impose a fine on lenders or lien creditors that do not release the lien, within a specified amount of time, after receipt of the payoff funds and notice of full payment or demand.)
Thus, it would have been obvious to one ordinary skill in the art before the effective filing date to implement the teaching of Morris into the teaching of White by receiving information via graphical user interface and determining penalty for violation of reporting task. One would be motivated to do so in order to prioritize the reporting tasks based on identified penalty of violation (Morris [0003 and 0012]).
Regarding claims 2 and 10 the combination of White and Morris teaches all the limitations of claims 1 and 8 respectively, Morris further teaches wherein: the first reporting task comprises a requirement to report the incident within a first time period; the second reporting task comprises a requirement to report the incident within a second time period; and identifying the conflict between satisfying the first reporting task and satisfying the second reporting task comprises determining that the first time period does not intersect with the second time period (Morris on [0055-0056] teaches all jurisdictions, the lender or lien creditor holding a paid off lien in a real estate transaction is given a specific amount of time after the settlement date to release the deed to the property. When the lien is released, the title of the real property is "clear" and allows the Originating Lender in the transaction to hold a priority position. See on [0071] teaches All jurisdictions further impose a fine on lenders or lien creditors that do not release the lien, within a specified amount of time, after receipt of the payoff funds and notice of full payment or demand. The tracking program continues to track the record after a demand letter is sent. If the deed is not released within the specified amount of time, then the legal forms program is notified and prepares the proper legal forms required to take action against the delinquent lender).
Thus, it would have been obvious to one ordinary skill in the art before the effective filing date to implement the teaching of Morris into the teaching of White by receiving information via graphical user interface and determining penalty for violation of reporting task. One would be motivated to do so in order to prioritize the reporting tasks based on identified penalty of violation (Morris [0003 and 0012]).
Regarding claim 3 the combination of White and Morris teaches all the limitations of claim 1 white further teaches wherein: identifying, by the computing hardware, the conflict between satisfying the first reporting task and satisfying the second reporting task comprises determining that the first reporting task comprises a requirement to delete data after a deadline and the second reporting task comprises a requirement to retain the data after the deadline (White on [0002] teaches various jurisdictions have different rules and regulations regarding the scanning of identification documents and the retention of information gained from the scans. For example, some jurisdictions may prohibit retention or dissemination of information retrieved from identification documents by electronic scans, while other jurisdictions may allow the same. See on [0019-0021] teaches for example, Jurisdiction B may have specific rules regarding electronic scans of identification documents within its jurisdiction. Examples of specific rules include: (1) a prohibition of retention of any scanned data after use, (2) a prohibition of dissemination of scanned data to third parties. Further teaches for example, if Jurisdiction B prohibits retention of age information from electronic scans of any identification documents, the system can apply this rule by processing the retrieved identification information to delete the age information retrieved from an identification card issued by any jurisdiction. For example, Jurisdiction C may only allow information electronically scanned from identification documents to be stored or shared for specific purposes i.e., conflicting requirement from plurality of jurisdictions of simultaneously retaining users’ data and deleting users’ data).
Regarding claims 4, 9 and 18 the combination of White and Morris teaches all the limitations of claims 1, 8 and 15 respectively, Morris further teaches wherein: the method further comprises configuring, by the computing hardware, the first graphical user interface by configuring a map on the first graphical user interface that includes the first jurisdiction and the second jurisdiction; and receiving the indication of the first jurisdiction and the indication of the second jurisdiction comprises receiving, via the map on the first graphical user interface, a selection of the first jurisdiction and the second jurisdiction (Morris on [0058-0060 and 0086] teaches the user can enter number of liens for payoff as at 410, select a default court as at 415, generate a listing of past lien disbursements as at 420, manage files as at 425, generate a status report covering a specified time period as at 430, and view settlement release letters as at 435. Further teaches displaying all interfaces via menu selection, toggle selections and other well-known display manipulation techniques).
Regarding claim 11 the combination of White and Morris teaches all the limitations of claim 8, White further teaches the operations further comprise identifying a conflict between satisfying the first reporting task and satisfying the second reporting task; and generating the customized incident response plan is further based on the identified conflict (White Fig 2 block 217-219 and text on [0026-0027] teaches after retrieving the applicable rules, processing proceeds to decision block 217 to determine whether there is any conflict among the identified applicable rules. For example, conflicts may arise between a federal rule and a state rule. If there is a conflict, the system continues to block 219 to prioritize the identified applicable rules in conflict. For example, a federal rule may prevail when it conflicts with a state rule, and therefore a high priority (i.e., high risk if violated) is assigned to the federal rule while a low priority (i.e., lower risk) is assigned to the state rule. As another example, if two rules conflict, the system may selectively apply the most restrictive aspects of each of the rules to ensure that the system abides by the minimum requirements of both rules. For example, if one rule indicates that information can be used for marketing purposes but not for loyalty purposes, and another rule indicates that the information can be used for loyalty purposes but not marketing purposes, the system may bar the use of scanned information for either marketing purposes or for loyalty purposes. By applying the most conservative interpretation, the system helps ensure that all applicable rules are being met. Further teaches If there is a conflict of rules, then the rules are applied based on the priorities thereof. For example, when a rule with high priority conflicts with a rule with low priority, the rule with high priority is applied and the rule with low priority is ignored. An operator of the system can modify the rules manually (e.g., override an identified rule). In such case, the system can provide a warning to the operator so as to inform the operator that a manual modification may result in a violation of the identified rule).
Regarding claim 14 the combination of White and Morris teaches all the limitations of claim 8, White further teaches determining a compliance cost of an action included in the customized incident response plan by querying a database using the incident information, the database storing past incidents in correlation with respective response times to comply with respective reporting tasks; and deleting the action from the customized incident response plan in response to the compliance cost exceeding a threshold (White on [0012] teaches after identifying applicable rules, the present technology can process the retrieved identification information based on the applicable rules. The “processing” of scanned identification information includes applying use restrictions specified by the applicable rules to the identification information, such as redacting, masking, removing, not storing, not transmitting, using only for limited purposes, etc. some of the retrieved identification information. For example, the system can delete, hide, mask, obscure, or edit the retrieved identification information, so as to make sure that an operator of the system. See on [0027] teaches If there is a conflict of rules, then the rules are applied based on the priorities thereof. For example, when a rule with high priority conflicts with a rule with low priority, the rule with high priority is applied and the rule with low priority is ignored. As discussed above, applying the applicable rules can include processing (e.g., delete, hide, mask, obscure, or edit) the identification information).
Regarding claim 16 the combination of White and Morris teaches all the limitations of claim 15, White further teaches wherein generating the second graphical user interface by configuring the presentation element configured for presenting the customized incident response plan on the second graphical user interface comprises: configuring a map on the second graphical user interface, the map including the first jurisdiction and the second jurisdiction; modifying the map such that the map includes: a first indicator indicating a first urgency level for the first reporting requirement associated with the first jurisdiction on the map, wherein the first urgency level is based on the customized incident response plan; and a second indicator indicating a second urgency level for the second reporting requirement associated with the second jurisdiction on the map, wherein the second urgency level is based on the customized incident response plan (White Fig 2 block 217-219 and text on [0026-0027] teaches after retrieving the applicable rules, processing proceeds to decision block 217 to determine whether there is any conflict among the identified applicable rules. For example, conflicts may arise between a federal rule and a state rule. If there is a conflict, the system continues to block 219 to prioritize the identified applicable rules in conflict. For example, a federal rule may prevail when it conflicts with a state rule, and therefore a high priority (i.e., high risk if violated) is assigned to the federal rule while a low priority (i.e., lower risk) is assigned to the state rule. As another example, if two rules conflict, the system may selectively apply the most restrictive aspects of each of the rules to ensure that the system abides by the minimum requirements of both rules. For example, if one rule indicates that information can be used for marketing purposes but not for loyalty purposes, and another rule indicates that the information can be used for loyalty purposes but not marketing purposes, the system may bar the use of scanned information for either marketing purposes or for loyalty purposes. By applying the most conservative interpretation, the system helps ensure that all applicable rules are being met. Further teaches If there is a conflict of rules, then the rules are applied based on the priorities thereof. For example, when a rule with high priority conflicts with a rule with low priority, the rule with high priority is applied and the rule with low priority is ignored. An operator of the system can modify the rules manually (e.g., override an identified rule). In such case, the system can provide a warning to the operator so as to inform the operator that a manual modification may result in a violation of the identified rule).
Regarding claim 17 the combination of White and Morris teaches all the limitations of claim 15, White further teaches wherein the incident information regarding the data-related incident comprises at least one of a number of data subjects affected by the data-related incident, a discovery date of the data-related incident, a type of data affected by the data-related incident, and a volume of the data affected by the data-related incident (White on [0036] teaches the scanning device 500 is configured to receive identification information from an identification card, which includes a front side 501 and a back side 503. In the illustrated embodiment, the identification information can include an expiration date 505 of the identification card, a photograph 507, an identification number 511, a name 513, an address 515, a set of personal information 517 (including sex/gender, height, weight, and eye color), and a date of birth 519. See on [0019] teaches types of information that can be collected (e.g., a date of birth, an identification number, an expiration date, a name, or an address), and (5) a prohibition of storing certain types of information (e.g., a photograph, a social security number, a height, a weight, a race, or a signature)).
Claims 5-7, 12, 13, 19 and 20 are rejected under 35 U.S.C. 103 as being unpatentable over White et al (hereinafter White) (US 20160125680) in view of Morris (US 20080281649) and further in view of Alvarez et al (hereinafter Alvarez) (US 20110270645).
Regarding claim 5 the combination of White and Morris teaches all the limitations of claim 1 the combination fails to teach determining, by the computing hardware, the first risk level based on the incident information and the first penalty comprises: calculating, by the computing hardware, a first penalty enforcement likelihood based on a first jurisdiction enforcement rate corresponding to the first penalty; calculating, by the computing hardware, a first penalty magnitude; and setting, by the computing hardware, the first risk based on the first penalty enforcement likelihood and the first penalty magnitude, however Alvarez from analogous art teaches
wherein: determining, by the computing hardware, the first risk level based on the incident information and the first penalty comprises: calculating, by the computing hardware, a first penalty enforcement likelihood based on a first jurisdiction enforcement rate corresponding to the first penalty; calculating, by the computing hardware, a first penalty magnitude; and setting, by the computing hardware, the first risk based on the first penalty enforcement likelihood and the first penalty magnitude (Alvarez Fig 2 and text on [0065-0077] teaches jurisdiction information 216 is received. In this example, jurisdiction information 216 identifies Jurisdiction A and Jurisdiction B. Regulatory oversight factors 6220 identify the regulatory activity of each jurisdiction 6100 and the penalties that may be incurred for failing to obey regulations of each jurisdiction 6100. Example regulatory oversight factors 6220 include the civil and criminal penalties for failure to comply with data movement regulations and the activity level of the jurisdiction's regulatory body. Further teaches jurisdictional matrix 6000 also includes weights 6300. Weights 6300 define a relative value for each matrix factor 6200. As one example, acquiring customer consent may be more complex than providing customer notification; accordingly, the weight assigned to the customer consent regulatory information 6210 is higher than the weight assigned to the customer notification regulatory information 6210. Applying weights 6300 to regulatory information 6210, regulatory oversight factors 6220, data volume factors 6230, and business criticality factors 6240 yield corresponding regulatory information scores. Further teaches the jurisdiction risk scores 6600 identified in jurisdictional matrix 6000 may be compared to a break value, set at 255 in the exemplary jurisdictional matrix 6000. The break value represents a threshold that may be used to classify the jurisdictional risk scores 6600 as either high or low);
and determining, by the computing hardware, the second risk level based on the incident information and the second penalty comprises: calculating, by the computing hardware, a second penalty enforcement likelihood based on a second jurisdiction enforcement rate corresponding to the second penalty; calculating, by the computing hardware, a second penalty magnitude; and setting, by the computing hardware, the second risk level based on the second penalty enforcement likelihood and the second penalty magnitude (Alvarez Fig 2 and text on [0065-0077] teaches jurisdiction information 216 is received. In this example, jurisdiction information 216 identifies Jurisdiction A and Jurisdiction B. Regulatory oversight factors 6220 identify the regulatory activity of each jurisdiction 6100 and the penalties that may be incurred for failing to obey regulations of each jurisdiction 6100. Example regulatory oversight factors 6220 include the civil and criminal penalties for failure to comply with data movement regulations and the activity level of the jurisdiction's regulatory body. Further teaches jurisdictional matrix 6000 also includes weights 6300. Weights 6300 define a relative value for each matrix factor 6200. As one example, acquiring customer consent may be more complex than providing customer notification; accordingly, the weight assigned to the customer consent regulatory information 6210 is higher than the weight assigned to the customer notification regulatory information 6210. Applying weights 6300 to regulatory information 6210, regulatory oversight factors 6220, data volume factors 6230, and business criticality factors 6240 yield corresponding regulatory information scores. Further teaches the jurisdiction risk scores 6600 identified in jurisdictional matrix 6000 may be compared to a break value, set at 255 in the exemplary jurisdictional matrix 6000. The break value represents a threshold that may be used to classify the jurisdictional risk scores 6600 as either high or low).
Thus, it would have been obvious to one ordinary skill in the art before the effective filing date to implement the teaching of Alvarez into the combined teaching of White and Morrison by determining risk level calculating based on penalty enforcement and penalty weight. One would be motivated to do so in order to prioritize the reporting tasks based on identified penalty of violation and minimize the risk of violating the reporting requirement based on calculated weight (Alvarez [0004-0005 and 0070-0075]).
Regarding claim 6, 12 and 19 the combination of White and Morris teaches all the limitations of claim 1 the combination fails to teach wherein: (determining, by the computing hardware, the first risk level based on the incident information and the first penalty comprises determining a first reporting task urgency based on at least one of a first reporting task deadline proximity or a first cure period availability; and determining, by the computing hardware, a second risk level based on the incident information and the second penalty comprises determining a second reporting task urgency based on at least one of a second reporting task deadline proximity or a second cure period availability, however Alvarez from analogous art teaches determining, by the computing hardware, the first risk level based on the incident information and the first penalty comprises determining a first reporting task urgency based on at least one of a first reporting task deadline proximity or a first cure period availability; and determining, by the computing hardware, a second risk level based on the incident information and the second penalty comprises determining a second reporting task urgency based on at least one of a second reporting task deadline proximity or a second cure period availability (Alvarez on [0046] teaches project files 210 are arranged according to a time stamp (e.g., in the order received). In some embodiments, a user 50 associated with the organization may manually change the order of project files 210 within queue 215. In another embodiment, project files 210 are automatically prioritized according to factors such as project type (e.g., proposed or active), data type, project deadlines, line of business, number of jurisdictions, regulation complexity, project purpose, project phase and/or project risk. One example of overall project risk is described with regards to FIG. 2, which shows a risk workflow 2000 for calculating jurisdictional risk and project risk).
Thus, it would have been obvious to one ordinary skill in the art before the effective filing date to implement the teaching of Alvarez into the combined teaching of White and Morrison by determining risk level calculating based on penalty enforcement and penalty weight. One would be motivated to do so in order to prioritize the reporting tasks based on identified penalty of violation and minimize the risk of violating the reporting requirement based on calculated weight (Alvarez [0004-0005 and 0070-0075]).
Regarding claims 7, 13 and 20 the combination of White and Morris teaches all the limitations of claim 1 the combination fails to teach wherein generating, by the computing hardware, the second graphical user interface comprises: generating an interactive list of actions corresponding to the customized incident response plan in an order based on at least one of respective action deadlines or respective penalties for noncompliance; generating a map comprising a plurality of jurisdictions, the plurality of jurisdictions comprising a jurisdiction corresponding to a selected reporting task, wherein an indicator on the map for at least one jurisdiction affected by an incident corresponding to the incident information is based on an urgency of the first reporting task; and configuring the second graphical user interface to include the interactive list of actions and the map, however Alvarez from analogous art teaches
wherein generating, by the computing hardware, the second graphical user interface comprises: generating an interactive list of actions corresponding to the customized incident response plan in an order based on at least one of respective action deadlines or respective penalties for noncompliance; generating a map comprising a plurality of jurisdictions, the plurality of jurisdictions comprising a jurisdiction corresponding to a selected reporting task, wherein an indicator on the map for at least one jurisdiction affected by an incident corresponding to the incident information is based on an urgency of the first reporting task; and configuring the second graphical user interface to include the interactive list of actions and the map (Alvarez on [0027-0028] teaches system 1000 may also identify action items required for regulatory compliance. As one example, if a jurisdiction requires outsourcing agreements with third parties to include certain terms, then system 1000 may analyze a project to determine whether the organization needs to include the certain terms in its outsourcing agreements. Teachings of certain embodiments recognize that identifying action items and completing those action items may reduce risk associated with moving data out of a jurisdiction. Action items may include specific actions that an organization may take to comply with a rule or regulation, or to otherwise mitigate risk associated with moving data out of a jurisdiction. Action items may be managed and tracked over time. For example, action items may include recurring actions to be completed, and action items may change over time due to changes in the project or changes in any governing regulations. Teachings of certain embodiments also recognize that tracking execution of action items may allow an evaluator to later confirm that the project is complying with any governing regulations).
Thus, it would have been obvious to one ordinary skill in the art before the effective filing date to implement the teaching of Alvarez into the combined teaching of White and Morrison by determining risk level calculating based on penalty enforcement and penalty weight. One would be motivated to do so in order to prioritize the reporting tasks based on identified penalty of violation and minimize the risk of violating the reporting requirement based on calculated weight (Alvarez [0004-0005 and 0070-0075]).
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
Broudou et al (US 20160321582) is directed towards system for mitigating risk by determining compliance with predetermined regulations or rules. More particularly, the system may provide a risk assessment based on whether predetermined regulations or rules are violated.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to MOEEN KHAN whose telephone number is (571)272-3522. The examiner can normally be reached 7AM-5PM EST M-TH Alternate Fridays.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Shewaye Gelagay can be reached at (571)272-4219. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/MOEEN KHAN/ Primary Examiner, Art Unit 2436
