DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
The following is a final office action in response to communications received 10/09/2025. Claims 1, 9, 19 have been amended. Therefore, claims 1-20 are pending and addressed below.
Response to Amendment
Applicant’s amendments and response to the claims are NOT sufficient to overcome the Double Patenting rejections set forth in the previous office action. The double patenting rejection is maintained.
Response to Arguments
Applicant’s arguments filed 10/09/2025 have been fully considered but they are moot in view of new grounds of rejections.
Double Patenting
The nonstatutory double patenting rejection is based on a judicially created doctrine grounded in public policy (a policy reflected in the statute) so as to prevent the unjustified or improper timewise extension of the “right to exclude” granted by a patent and to prevent possible harassment by multiple assignees. A nonstatutory double patenting rejection is appropriate where the conflicting claims are not identical, but at least one examined application claim is not patentably distinct from the reference claim(s) because the examined application claim is either anticipated by, or would have been obvious over, the reference claim(s). See, e.g., In re Berg, 140 F.3d 1428, 46 USPQ2d 1226 (Fed. Cir. 1998); In re Goodman, 11 F.3d 1046, 29 USPQ2d 2010 (Fed. Cir. 1993); In re Longi, 759 F.2d 887, 225 USPQ 645 (Fed. Cir. 1985); In re Van Ornum, 686 F.2d 937, 214 USPQ 761 (CCPA 1982); In re Vogel, 422 F.2d 438, 164 USPQ 619 (CCPA 1970); In re Thorington, 418 F.2d 528, 163 USPQ 644 (CCPA 1969).
A timely filed terminal disclaimer in compliance with 37 CFR 1.321(c) or 1.321(d) may be used to overcome an actual or provisional rejection based on nonstatutory double patenting provided the reference application or patent either is shown to be commonly owned with the examined application, or claims an invention made as a result of activities undertaken within the scope of a joint research agreement. See MPEP § 717.02 for applications subject to examination under the first inventor to file provisions of the AIA as explained in MPEP § 2159. See MPEP § 2146 et seq. for applications not subject to examination under the first inventor to file provisions of the AIA . A terminal disclaimer must be signed in compliance with 37 CFR 1.321(b).
The USPTO Internet website contains terminal disclaimer forms which may be used. Please visit www.uspto.gov/patent/patents-forms. The filing date of the application in which the form is filed determines what form (e.g., PTO/SB/25, PTO/SB/26, PTO/AIA /25, or PTO/AIA /26) should be used. A web-based eTerminal Disclaimer may be filled out completely online using web-screens. An eTerminal Disclaimer that meets all requirements is auto-processed and approved immediately upon submission. For more information about eTerminal Disclaimers, refer to www.uspto.gov/patents/process/file/efs/guidance/eTD-info-I.jsp.
Claims 1-20 are rejected on the ground of nonstatutory double patenting as being unpatentable over claims 1-20 of U.S. Patent No. 11604895. Although the claims at issue are not identical, they are not patentably distinct from each other because Claims of patent application contain every element of claims above instant application or vice versa, and as such they anticipate or anticipated by Instant Application. As to Claims 1, 16, of the Pat. *895 anticipates the claims of the instant application. By way of illustration, consider the respective claim 1 from each disclosure:
Claim 1 of the instant application
Claim 1 of the ‘895 Patent
1. A method, comprising:
generating a plurality of questions for a user, each of the plurality of questions including multiple facets of permissions regarding use of personal data related to the user;
sequentially providing at least two questions of the plurality of questions to the user, the at least two questions covering at least what entities are permitted access to the personal data and for what purposes the personal data can be used;
compiling answers provided by the user to the at least two of the plurality of questions to generate compiled permissions by a consent server;
receiving a request from a third party for access to the personal data of the user for a given purpose, the personal data being stored by a data holder and not stored by the consent server when the request is received; and
providing a response to the third party based on the compiled permissions and the request.
1. A method, comprising:
providing a user with one or more questions regarding permissions for use of personal data related to the user, the one or more questions providing multiple facets of the permissions regarding the use of the personal data related to the user including at least what entities are permitted access to the personal data, what categories of personal data to which access is permitted, and for what purposes the categories of the personal data can be used;
compiling the multiple facets of permissions for the use of the personal data by a consent server; storing, by the consent server, the multiple facets of permissions for the use of the personal data during a first communication session at a first point in time; receiving a request from a third party for access to the personal data during a second communication session at a second point in time later than the first point in time, the request including at least a given entity seeking access to the personal data, one or more given categories of personal data to which access is sought, and one or more given purposes for which the personal data is to be used, the personal data stored by a data holder, the consent server not storing the personal data at the second point in time, the consent server a different entity from the data holder; and providing a response to the third party based on the compiled permissions and the request.
Independent claims 1, 10, 19 of the instant application are substantially similar to independent claims 1, 16, of the Pat. *895 and are rejected for substantially similar reasons as discussed supra. Likewise, dependent claims 2-9, 11-18, 20 of the instant application are substantially similar to dependent claims 2-15, 17-20 (respectively) of the Pat. *895 and are rejected for substantially similar reasons as discussed supra.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-20 are rejected under 35 U.S.C. 103 as being unpatentable over Rahul N/A (Pub. No. US 2022/0284121) in view of Gaspar et al (Pub. No. US 2019/0258820) and in further view of Lacey et al (Pub. No. US 2016/0098577).
As per claim 1, Raul discloses a method, comprising: generating a plurality of questions for a user, each of the plurality of questions including multiple facets of permissions regarding use of personal data related to the user (…the personal information data set is configured in a tabular form…it includes various kinds of data items (interpreted as questions) and data of a privacy status and a consent status for each the data items (interpreted as multiple facets of permissions)…see fig.3 and par. 43-45); sequentially providing at least two questions of the plurality of questions to the user, the at least two questions covering at least what entities are permitted access to the personal data and for what purposes the personal data can be used (see par. 61-62); compiling answers provided by the user to the at least two of the plurality of questions to generate compiled permissions by a consent server (see par. 66-68). Rahul does not explicitly disclose receiving a request from a third party for access to the personal data of the user for a given purpose, the personal data being stored by a data holder and not stored by the consent server when the request is received; and providing a response to the third party based on the compiled permissions and the request. However Gaspar discloses receiving, by the consent server, a request from a third party for access to the personal data of the user for a given purpose, the personal data being stored by a data holder and not stored by the consent server when the request is received; and providing, by the consent server, a response to the third party based on the compiled permissions and the request (…the application may collect information, such as a social security number associated with the information owner…the application also requests consent to perform a data synchronization, such as a soft credit pull, on behalf of the information owner on an ongoing basis…the service provider may receive information, such as a social security number, along with the consent to perform a data synchronization…the service provider stores the consent from the information owner, and uses the information (e.g., social security number) to request a data synchronization from an external third party partner…the service provider receives an ongoing consent from the information owner, in which case the service provider may request data synchronizations from the external third party partner on a periodic basis…the external third party partner receives the information and request from the service provider, confirms the information, generates a credit report, and sends the confirmation and credit report to the service provider…the external third party partner that generates a credit report may be the same as, or may be different from, the external third party partner that verifies identification information…upon receipt of the credit report, the service provider may store the credit report, excluding any personally identifiable information associated with the information owner…the service provider may send the credit report to the information owner for review and confirmation of the credit report… the service provider registers with an external third party partner and issues a redirect to and aggregation tool associated with the external third party partner…see par. 73, 84). Therefore one ordinary skill in the art would have found it obvious before the effective filling date of the claimed invention to use Gaspar in Rahul for including the above limitations because one ordinary skill in the art would recognize it would further maintain the security and confidentiality of consumer information…see Gaspar, par. 7. The combination of Rahul and Gaspar does not explicitly disclose each plurality of questions…related to the user including at least what entities are permitted access to the personal data, what categories of personal data to which access is permitted, and for what purposes the categories of the personal data can be used. However Lacey discloses each plurality of questions…related to the user including at least what entities are permitted access to the personal data, what categories of personal data to which access is permitted, and for what purposes the categories of the personal data can be used (…receiving, from the user, consent to share at least a subset of the requested personal information with the third party when at least a first context profile, of the plurality of context profiles, is active…in particular, consent is tied to specific profiles; i.e., the user may consent to sharing of personal information with the particular third party (interpreted as “what entities”) in some profiles but not in other profiles…receiving, from the user, denial of consent to share at least a subset of the requested personal information with the third party when at least a second context profile, of the plurality of context profiles, is active…thus, for example, a user can permit a third party to access and/or use PII (e.g., the user's height, weight, clothing size, and shopping habits) when the user is in a first profile (e.g., a “shopping” profile), but not when the user is in another profile (e.g., a “work” profile)…(different profiles such as “shopping” profile or “work” profile are interpreted as “what categories”…and given information of each of these profiles are interpreted as “what purposes of the categories”)…see par. 110). Therefore one ordinary skill in the art would have found it obvious before the effective filling date of the claimed invention to use Lacey in the combination of Rahul and Gaspar for including the above limitations because one ordinary skill in the art would recognize it would further improve ways to allow users to control what information is shared, with whom it shared, etc…see Lacey, par. 5
As per claim 10, Raul discloses one or more non-transitory computer-readable media containing instructions that, when executed by one or more processors, cause a system to perform operations, the operations comprising: generating a plurality of questions for a user, each of the plurality of questions including multiple facets of permissions regarding use of personal data related to the user (…the personal information data set is configured in a tabular form…it includes various kinds of data items (interpreted as questions) and data of a privacy status and a consent status for each the data items (interpreted as multiple facets of permissions)…see fig.3 and par. 43-45); sequentially providing at least two questions of the plurality of questions to the user, the at least two questions covering at least what entities are permitted access to the personal data and for what purposes the personal data can be used (see par. 61-62); compiling answers provided by the user to the at least two of the plurality of questions to generate compiled permissions by a consent server (see par. 66-68). Rahul does not explicitly disclose receiving a request from a third party for access to the personal data of the user for a given purpose, the personal data being stored by a data holder and not stored by the consent server when the request is received; and providing a response to the third party based on the compiled permissions and the request. However Gaspar discloses receiving a request from a third party for access to the personal data of the user for a given purpose, the personal data being stored by a data holder and not stored by the consent server when the request is received; and providing a response to the third party based on the compiled permissions and the request (…the application may collect information, such as a social security number associated with the information owner…the application also requests consent to perform a data synchronization, such as a soft credit pull, on behalf of the information owner on an ongoing basis…the service provider may receive information, such as a social security number, along with the consent to perform a data synchronization…the service provider stores the consent from the information owner, and uses the information (e.g., social security number) to request a data synchronization from an external third party partner…the service provider receives an ongoing consent from the information owner, in which case the service provider may request data synchronizations from the external third party partner on a periodic basis…the external third party partner receives the information and request from the service provider, confirms the information, generates a credit report, and sends the confirmation and credit report to the service provider…the external third party partner that generates a credit report may be the same as, or may be different from, the external third party partner that verifies identification information…upon receipt of the credit report, the service provider may store the credit report, excluding any personally identifiable information associated with the information owner…the service provider may send the credit report to the information owner for review and confirmation of the credit report… the service provider registers with an external third party partner and issues a redirect to and aggregation tool associated with the external third party partner…see par. 73, 84). Therefore one ordinary skill in the art would have found it obvious before the effective filling date of the claimed invention to use Gaspar in Rahul for including the above limitations because one ordinary skill in the art would recognize it would further maintain the security and confidentiality of consumer information…see Gaspar, par. 7. The combination of Rahul and Gaspar does not explicitly disclose each plurality of questions…related to the user including at least what entities are permitted access to the personal data, what categories of personal data to which access is permitted, and for what purposes the categories of the personal data can be used. However Lacey discloses each plurality of questions…related to the user including at least what entities are permitted access to the personal data, what categories of personal data to which access is permitted, and for what purposes the categories of the personal data can be used (…receiving, from the user, consent to share at least a subset of the requested personal information with the third party when at least a first context profile, of the plurality of context profiles, is active…in particular, consent is tied to specific profiles; i.e., the user may consent to sharing of personal information with the particular third party (interpreted as “what entities”) in some profiles but not in other profiles…receiving, from the user, denial of consent to share at least a subset of the requested personal information with the third party when at least a second context profile, of the plurality of context profiles, is active…thus, for example, a user can permit a third party to access and/or use PII (e.g., the user's height, weight, clothing size, and shopping habits) when the user is in a first profile (e.g., a “shopping” profile), but not when the user is in another profile (e.g., a “work” profile)…(different profiles such as “shopping” profile or “work” profile are interpreted as “what categories”…and given information of each of these profiles are interpreted as “what purposes of the categories”)…see par. 110). Therefore one ordinary skill in the art would have found it obvious before the effective filling date of the claimed invention to use Lacey in the combination of Rahul and Gaspar for including the above limitations because one ordinary skill in the art would recognize it would further improve ways to allow users to control what information is shared, with whom it shared, etc…see Lacey, par. 5
As per claim 19, Raul discloses a consent server, comprising: one or more processors; and one or more non-transitory computer-readable media containing instructions that, when executed by the one or more processors (see par. 51), cause the consent server to perform operations, the operations comprising: generating a plurality of questions for a user, each of the plurality of questions including multiple facets of permissions regarding use of personal data related to the user (…the personal information data set is configured in a tabular form…it includes various kinds of data items (interpreted as questions) and data of a privacy status and a consent status for each the data items (interpreted as multiple facets of permissions)…see fig.3 and par. 43-45); sequentially providing at least two questions of the plurality of questions to the user, the at least two questions covering at least what entities are permitted access to the personal data and for what purposes the personal data can be used (see par. 61-62); compiling answers provided by the user to the at least two of the plurality of questions to generate compiled permissions (see par. 66-68). Rahul does not explicitly disclose receiving a request from a third party for access to the personal data of the user for a given purpose, the personal data being stored by a data holder and not stored by the consent server when the request is received; and providing a response to the third party based on the compiled permissions and the request. However Gaspar discloses receiving a request from a third party for access to the personal data of the user for a given purpose, the personal data being stored by a data holder and not stored by the consent server when the request is received; and providing a response to the third party based on the compiled permissions and the request (…the application may collect information, such as a social security number associated with the information owner…the application also requests consent to perform a data synchronization, such as a soft credit pull, on behalf of the information owner on an ongoing basis…the service provider may receive information, such as a social security number, along with the consent to perform a data synchronization…the service provider stores the consent from the information owner, and uses the information (e.g., social security number) to request a data synchronization from an external third party partner…the service provider receives an ongoing consent from the information owner, in which case the service provider may request data synchronizations from the external third party partner on a periodic basis…the external third party partner receives the information and request from the service provider, confirms the information, generates a credit report, and sends the confirmation and credit report to the service provider…the external third party partner that generates a credit report may be the same as, or may be different from, the external third party partner that verifies identification information…upon receipt of the credit report, the service provider may store the credit report, excluding any personally identifiable information associated with the information owner…the service provider may send the credit report to the information owner for review and confirmation of the credit report… the service provider registers with an external third party partner and issues a redirect to and aggregation tool associated with the external third party partner…see par. 73, 84). Therefore one ordinary skill in the art would have found it obvious before the effective filling date of the claimed invention to use Gaspar in Rahul for including the above limitations because one ordinary skill in the art would recognize it would further maintain the security and confidentiality of consumer information…see Gaspar, par. 7. The combination of Rahul and Gaspar does not explicitly disclose each plurality of questions…related to the user including at least what entities are permitted access to the personal data, what categories of personal data to which access is permitted, and for what purposes the categories of the personal data can be used. However Lacey discloses each plurality of questions…related to the user including at least what entities are permitted access to the personal data, what categories of personal data to which access is permitted, and for what purposes the categories of the personal data can be used (…receiving, from the user, consent to share at least a subset of the requested personal information with the third party when at least a first context profile, of the plurality of context profiles, is active…in particular, consent is tied to specific profiles; i.e., the user may consent to sharing of personal information with the particular third party (interpreted as “what entities”) in some profiles but not in other profiles…receiving, from the user, denial of consent to share at least a subset of the requested personal information with the third party when at least a second context profile, of the plurality of context profiles, is active…thus, for example, a user can permit a third party to access and/or use PII (e.g., the user's height, weight, clothing size, and shopping habits) when the user is in a first profile (e.g., a “shopping” profile), but not when the user is in another profile (e.g., a “work” profile)…(different profiles such as “shopping” profile or “work” profile are interpreted as “what categories”…and given information of each of these profiles are interpreted as “what purposes of the categories”)…see par. 110). Therefore one ordinary skill in the art would have found it obvious before the effective filling date of the claimed invention to use Lacey in the combination of Rahul and Gaspar for including the above limitations because one ordinary skill in the art would recognize it would further improve ways to allow users to control what information is shared, with whom it shared, etc…see Lacey, par. 5
As per claims 2, 11, the combination of Raul, Gaspar and Lacey discloses wherein the at least two questions are binary questions such that the user is able to respond with a single affirmative or negative response (Rahul: see par. 61-62).
As per claims 3, 12, the combination of Raul, Gaspar and Lacey discloses wherein the at least two questions are multi-modal such that each individual questions addresses at least two instances of a combination of what entities are permitted access to the personal data and for what purposes the personal data can be used (Rahul: see par. 65-67).
As per claims 4, 13, 20, the combination of Raul, Gaspar and Lacey discloses wherein the generating and sequentially providing questions is repeated until a series of entries related to a combination of what entities are permitted access to the personal data and for what purposes the personal data can be used are filled for the user (Raul: see par. 43-46).
As per claims 5, 14, the combination of Raul, Gaspar and Lacey discloses wherein the plurality of questions further include separate categories of personal data (Raul: see fig.3).
As per claims 6, 15, the combination of Raul, Gaspar and Lacey discloses wherein the consent server stores a limited version of demographic information of the user (Gaspar: see par. 49-50). The motivation for claim 6 is the same motivation as in claim 1 above.
As per claims 7, 16, the combination of Raul, Gaspar and Lacey discloses wherein the limited version of the demographic information is limited to age, gender, name, address, and telephone number (Gaspar: see par. 49-50). The motivation for claim 7 is the same motivation as in claim 1 above.
As per claims 8, 17, the combination of Raul, Gaspar and Lacey discloses wherein the entities of one of the at least two questions includes both a named entity and partners of the named entity (Gaspar: see par. 43). The motivation for claim 8 is the same motivation as in claim 1 above.
As per claims 9, 18, the combination of Raul, Gaspar and Lacey discloses wherein the named entity includes at least one of a clinic, medical office, or hospital and the partners of the named entity include at least one of a laboratory, a vendor, a service provider (Gaspar: see par. 43), a medical office referring to the named entity, or a medical office referring from the named entity. The motivation for claim 9 is the same motivation as in claim 1 above.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure (see PTO-form 892).
The following Patents and Papers are cited to further show the state of the art at the time of Applicant’s invention with respect to permission tracking and/or an associated data exchange.
Doran et al (Pub. No. US 2021/0125297); “Systems and Methods for Intelligent Contract Analysis and Data Organization”;
-Teaches intelligently analyzing contracts and subsequently organizing personally identifiable information (PII)…see par. 20.
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to GHAZAL B SHEHNI whose telephone number is (571)270-7479. The examiner can normally be reached Mon-Fri 9am-5pm PCT.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Philip Chea can be reached at 5712723951. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/GHAZAL B SHEHNI/Primary Examiner, Art Unit 2499